ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Using a hardware security module such as AWS CloudHSM addresses both needs. Each CloudHSM appliance includes a FIPS-validated hardware random number generator that continuously supplies high-quality entropy to its deterministic random bit generator, allowing rapid creation of strong cryptographic keys without blocking. Switching to /dev/urandom may avoid blocking but offers lower assurance of fresh hardware-based entropy, which some high-assurance environments require. Increasing the key size or caching random bytes does not resolve the underlying shortage of entropy and can introduce new risks. Therefore, generating keys inside AWS CloudHSM is the most suitable choice.