A security engineer is deciding between a trusted platform module (TPM) and a hardware security module (HSM) for a specific need on new hypervisor hosts. The requirement is to bind disk encryption keys to a known-good boot state so the volume unlocks only when firmware and boot components are unchanged. Which component fits this requirement, and why?
- AThe TPM, because it stores platform configuration measurements and can seal keys so they release only when the measured boot state matches expected values. Correct
- BThe HSM, because it is validated to a higher assurance level and therefore supersedes the TPM for any host-based key binding requirement.
- CThe HSM, because it can attest to firmware integrity across the fleet and release keys centrally once each host reports a clean boot.
- DThe TPM, because it performs high-volume network cryptographic operations for many tenants while keeping keys inside a shared boundary.
Why A is correct: Sealing a key to platform configuration register values so it releases only under a known-good boot state is exactly what a TPM provides on a host.
Why B is wrong: Higher validation assurance does not give an HSM measured-boot sealing; that capability is specific to the TPM, so assurance level is the wrong basis for the choice.
Why C is wrong: Firmware measurement and boot-state sealing are TPM functions performed on the host itself; an HSM does not measure a server's boot sequence.
Why D is wrong: High-volume shared network crypto for tenants describes an HSM; a TPM is a low-throughput per-host root of trust, so the reasoning is inverted.