Which component stores and protects both symmetric and asymmetric encryption keys, hashes, and digital certificates?

• A. Trusted Platform Module (TPM) stores and protects both symmetric and asymmetric encryption keys, hashes, and digital certificates.
• B. Secure Boot prevents unwanted processes from executing during the boot operation.
• C. Self-Encrypting Drive (SED) is a HDD or SSD with an encryption circuit built into the drive.
• D. Host-Based Firewall accepts or drops packets based on the application or port.

Answer: (A)

The essential idea being tested is hardware-backed storage and protection for cryptographic material. A trusted platform module is a dedicated hardware component that securely generates, stores, and uses cryptographic keys—both symmetric and asymmetric—inside its tamper-resistant environment. It also keeps hashes and digital certificates securely, and it can perform cryptographic operations without exposing the keys to the rest of the system. This tight hardware protection helps maintain integrity and trust, since keys and certificates never leave the TPM in plain form and are bound to the platform’s state.

Other options describe different security functions that don’t focus on secure key storage across both key types or on protecting certificates and hashes. Secure Boot prevents loading unauthorized firmware or software during startup, which is about integrity verification of the boot process rather than storing cryptographic material. A Self-Encrypting Drive encrypts data at rest with a built-in encryption controller, but the emphasis is on the drive’s encryption keys and access control rather than a general secure storage and management of keys, hashes, and certificates. A Host-Based Firewall controls network traffic based on rules, not cryptographic key storage.