Which statement accurately describes the difference between hardware security modules (HSMs) and cloud KMS in key management?

• A. Cloud KMS stores keys offline; HSMs are cloud-only
• B. HSMs provide secure key storage and cryptographic operations
• C. KMS is only for symmetric keys; HSM is for public keys
• D. KMS cannot enforce access controls

Answer: (B)

Hardware security modules are purpose-built devices that store cryptographic keys inside tamper-resistant hardware and perform cryptographic operations—like encryption, decryption, and signing—inside the module so the keys never leave in plaintext. This combination of secure storage and in-device computation is what makes HSMs uniquely protective of keys.

A cloud KMS, on the other hand, is a managed service in the cloud for managing keys and applying cryptographic operations within the cloud environment. It may leverage HSM-backed keys behind the scenes, but its primary role is governance—creating, rotating, and controlling access to keys and enforcing policies—rather than being the hardware that directly executes every cryptographic operation.

So the statement that best captures the essence of HSMs is that they provide secure key storage and cryptographic operations. The other options misstate where keys reside (offline vs. cloud), the types of keys involved, or the access-control capabilities of KMS.