From a TA perspective, which practice strengthens key management?

• A. Store all keys in plain text on a server.
• B. Rotate keys only after a decade.
• C. Use hardware-backed keystores (HSM/TPM) and rotate keys periodically.
• D. Share keys across multiple services.

Answer: (C)

Key management is strongest when keys are protected in hardware-backed storage and managed through a deliberate rotation plan. Hardware security modules (HSMs) and trusted platform modules (TPMs) keep cryptographic keys inside tamper-resistant hardware, so the keys aren’t exposed in memory or on disk where they could be stolen. This protects confidentiality and reduces the risk of key leakage during operations. Regularly rotating keys shortens the time window an attacker could misuse a compromised key and helps limit the impact across systems that rely on those keys. Together, these practices create stronger, more auditable control over cryptographic material.

Storing keys in plain text on a server is insecure because any breach could expose the keys directly. Rotating keys only after a decade leaves a very long period during which a compromised key could be misused. Sharing keys across multiple services expands the blast radius; if one service is compromised, all others using the same key are at risk and tracking usage becomes difficult.