CAS-004 Security Architecture Practice Question
A security architect is designing a PKI for an organization that requires high assurance certificates. The architect needs to protect the root CA private key. Which solution provides the highest level of security for the root CA key?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a Hardware Security Module (HSM) for key management
Hardware Security Modules (HSMs) provide tamper-resistant, dedicated hardware for key generation and storage, offering the highest security for root CA keys. Smart cards are less secure for large-scale root CA operations. Encrypted files on a server are vulnerable. A dedicated VM provides software-based isolation but is less secure than HSM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the key in an encrypted file on a secure server
Why it's wrong here
Software-based storage is vulnerable to attacks even with encryption; it does not provide tamper resistance.
- ✗
Generate the key on a dedicated virtual machine
Why it's wrong here
Virtual machines lack physical security and are susceptible to hypervisor attacks.
- ✓
Use a Hardware Security Module (HSM) for key management
Why this is correct
HSMs provide physical tamper protection and dedicated cryptographic processing, meeting high assurance requirements.
- ✗
Keep the key on a smart card stored in a safe
Why it's wrong here
Smart cards are suitable for personal use but not practical for managing a root CA key due to performance and scalability limitations.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.