easyMultiple SelectObjective-mapped
CAS-004 Practice Question: Which TWO of the following are essential…
Which TWO of the following are essential characteristics of a hardware security module (HSM)? (Select TWO.)
⚠ Common exam trap
The CAS-004 exam often tests the distinction between 'essential characteristics' and 'common but non-essential features' — the trap here is that candidates confuse optional integration capabilities (like PKI support or user authentication) with the fundamental purpose of an HSM, which is tamper-resistant key storage and cryptographic acceleration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Hardware acceleration of cryptographic operations.
HSMs are dedicated hardware appliances that offload cryptographic operations from the main CPU, providing hardware acceleration for algorithms such as AES, RSA, and ECC. This acceleration is critical for high-throughput environments like TLS termination or code signing, where software-based cryptography would create a performance bottleneck.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Hardware acceleration of cryptographic operations.
Why this is correct
HSMs offload cryptographic processing from the main CPU.
- ✓
Tamper-resistant key storage.
Why this is correct
HSMs are designed to protect keys from physical tampering.
- ✗
Virtualization of the hardware root of trust.
Why it's wrong here
HSMs are physical devices; virtualization is separate.
- ✗
Integration with public key infrastructure (PKI) to replace certificate authorities.
Why it's wrong here
HSMs support PKI but do not replace CAs.
- ✗
User authentication and authorization.
Why it's wrong here
User authentication is not a primary function of HSMs; they focus on key management.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.