mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Is implementing a solution to securely store and…
A security engineer is implementing a solution to securely store and manage cryptographic keys for a fleet of IoT devices. The devices have limited processing power and cannot perform asymmetric operations. Which of the following is the BEST approach?
⚠ Common exam trap
CompTIA often tests the misconception that TPMs are always suitable for low-power devices, but the trap here is that TPMs require the device to perform asymmetric operations (e.g., RSA key generation) which IoT devices with limited processing power cannot handle, making pre-provisioning from an HSM the only viable option.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a cloud-based Hardware Security Module (HSM) to generate and store keys, and provision them to devices during manufacturing.
IoT devices with limited processing power cannot efficiently perform asymmetric operations, so pre-provisioning keys from a cloud-based HSM during manufacturing ensures secure key generation and storage without burdening the device. The HSM provides tamper-resistant key generation and lifecycle management, and the keys are injected into the device's secure storage (e.g., eFuse or secure element) before deployment, eliminating the need for on-device asymmetric cryptography.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use a cloud-based Hardware Security Module (HSM) to generate and store keys, and provision them to devices during manufacturing.
Why this is correct
A cloud HSM provides secure key generation, storage, and lifecycle management; provisioning keys during manufacturing ensures they are not exposed.
- ✗
Install a Trusted Platform Module (TPM) in each device to store keys on the device.
Why it's wrong here
TPMs are designed for individual devices, not for centralized fleet management; they also require asymmetric operations which IoT devices may not support.
- ✗
Use a cloud KMS to generate and wrap keys, then store the wrapped key in the device.
Why it's wrong here
The wrapped key is still stored on the device, and if the wrapping key is compromised, the keys are exposed. This does not fully address storage security.
- ✗
Store keys in obfuscated form in the device firmware and use a custom algorithm for encryption.
Why it's wrong here
Obfuscation is not a secure cryptographic practice; keys stored in firmware can be extracted through reverse engineering.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.