ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Generating the CA's signing key pair inside a certified hardware security module (HSM) keeps the private key in tamper-resistant hardware, ensures use of a hardware random number generator for strong entropy, and allows secure escrow/backup to another HSM without the key ever existing in plaintext. This aligns with NIST key-management guidance and FIPS 140-2 Level 3 recommendations for protecting high-value private keys. Creating keys on a workstation and moving them, deriving them from a passphrase, or relying on default 1024-bit keys would all expose the private key to software attack surfaces or insufficient key strength, violating secure generation and storage best practices.