CCSP - Cloud Security Operations - Section 5.1

Build and implement physical and logical infrastructure for cloud environment.

Hardware-specific security configuration requirements, installation and configuration of management tools, and virtualisation management tools.

hardware security module (HSM)trusted platform module (TPM)hardening baselinesvirtualisation management tools

Practice question for this objective

Free sampleCloud Security Operationsmedium

A security engineer is deciding between a trusted platform module (TPM) and a hardware security module (HSM) for a specific need on new hypervisor hosts. The requirement is to bind disk encryption keys to a known-good boot state so the volume unlocks only when firmware and boot components are unchanged. Which component fits this requirement, and why?

  • AThe TPM, because it stores platform configuration measurements and can seal keys so they release only when the measured boot state matches expected values. Correct
  • BThe HSM, because it is validated to a higher assurance level and therefore supersedes the TPM for any host-based key binding requirement.
  • CThe HSM, because it can attest to firmware integrity across the fleet and release keys centrally once each host reports a clean boot.
  • DThe TPM, because it performs high-volume network cryptographic operations for many tenants while keeping keys inside a shared boundary.
Distinguish that a TPM seals keys to a measured boot state on a host, whereas an HSM is a shared boundary for high-volume key operations. A TPM records boot component measurements in platform configuration registers and can seal a key so it is released only when those measurements match a known-good state, which directly meets a boot-bound disk encryption requirement that an HSM does not address.

Why A is correct: Sealing a key to platform configuration register values so it releases only under a known-good boot state is exactly what a TPM provides on a host.

Why B is wrong: Higher validation assurance does not give an HSM measured-boot sealing; that capability is specific to the TPM, so assurance level is the wrong basis for the choice.

Why C is wrong: Firmware measurement and boot-state sealing are TPM functions performed on the host itself; an HSM does not measure a server's boot sequence.

Why D is wrong: High-volume shared network crypto for tenants describes an HSM; a TPM is a low-throughput per-host root of trust, so the reasoning is inverted.

See more CCSP practice questions, answers explained.

More in this domain

Back to all Cloud Security Operations objectives, or the CCSP cert hub.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.