CISSP Exam - Question 98

Solution is Bitlocker and storing location is TPM.. Ans: A

A TPM is a specific device to keep it's own keys secure (source of identity) While an HSM is a general device to secure foreign keys (verify identity)

BitLocker is a full-disk encryption feature provided by Microsoft Windows operating systems. It uses a root key, which is protected by the Trusted Platform Module (TPM) or other authentication mechanisms, to secure the encryption of data on the endpoint.

TPM is not a solution for encrypting. It's for key storing. How are you gonna encrypt data only using TPM? You need some software which will encrypt data. It's Bitlocker. "The user must create a password, which is needed every time they access their PC or drive."

HSMs are nothing to do with endpoints.

Bitlocker is the only encryption solution listed, and it does include a root key. TPM and HSM can store these keys.

D. Hardware security module (HSM). A hardware security module (HSM) is a dedicated physical device that provides secure cryptographic operations and key management. It includes a root key, which is a master key that is used to generate and manage other keys within the HSM. The root key is securely stored within the HSM, ensuring its confidentiality and protection. While TPM provides secure storage for encryption keys, it does not specifically include a root key. The root key mentioned in the question typically refers to a master key or a key hierarchy used in key management systems like Hardware Security Modules (HSMs). HSMs are specialized devices that offer more advanced key management functionalities and are often used in high-security environments. So, while TPM is a valid solution for secure and efficient endpoint encryption, it does not explicitly include a root key as mentioned in the question.

The correct answer is "B" (TPM). See https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/tpm-fundamentals "Each TPM has a master wrapping key, called the storage root key, which is stored within the TPM itself." In PKI, there is no notion of a "root key". There is a "root certificate", which key is usually stored in a HSM, but this key is not called a root key. Therefore, answer "D" is incorrect. The question is "secure and efficient method of encrypting data on an endpoint", meaning Bitlocker, however, Bitlocker does not include a root key, but a TPM does.

Ans is A. Its asking which one can do encrtpytion and has use key crypto. TPM and HSM only store crypto keys, it is not any encryption device. https://support.microsoft.com/en-us/topic/what-is-tpm-705f241d-025d-4470-80c5-4feeb24fa1ee

OSG - A TPM is an example of a hardware security module (HSM). So, D includes B.

The solution that includes a root key is: B. Trusted Platform Module (TPM). A Trusted Platform Module (TPM) is a hardware-based security device that provides secure generation and storage of cryptographic keys, including root keys. It is designed to ensure the integrity of the platform and can be used to securely encrypt data on an endpoint. While BitLocker is a robust encryption solution, it does not inherently include a root key. BitLocker works in conjunction with a Trusted Platform Module (TPM) to provide enhanced security, but the TPM is the component that generates and stores the root key. BitLocker itself is a software feature that encrypts entire volumes and relies on the TPM for secure key management. In contrast, the TPM is specifically designed to generate, store, and manage cryptographic keys, including root keys, making it the correct answer for a solution that includes a root key.

B. Don't understand what is "root key". TPM is the best guess. https://learn.microsoft.com/en-us/javascript/api/azure-iot-provisioning-service/tpmattestation?view=azure-node-latest storageRootKey The storage root key is embedded in the Trusted Platform Module (TPM) security hardware. It is used to protect TPM keys created by applications, so that these keys cannot be used without the TPM. Unlike the endorsement key (which is generally created when the TPM is manufactured), the storage root key is created when you take ownership of the TPM. This means that if you clear the TPM and a new user takes ownership, a new storage root key is created. This property is not typically manipulated by the service client. The storageRootKey is a base64 encoded value.

An endpoint is any device that is physically an end point on a network. Laptops, desktops, mobile phones, tablets, servers, and virtual environments can all be considered endpoints. what can be installed on all end points?

on top of all the CISSP study guide and student edition mentions - "Computers that incorporate a TPM can create cryptographic keys and encrypt them so that they can only be decrypted by the TPM. This process, often called wrapping or binding a key, can help protect the key from disclosure. Each TPM has a master wrapping key, called the storage root key, which is stored within the TPM itself. The private portion of a storage root key or endorsement key that is created in a TPM is never exposed to any other component, software, process, or user." https://security.stackexchange.com/questions/181539/how-are-bitlocker-fde-keys-stored-in-the-tpm

HSM includes a root key.

A Hardware Security Module (HSM) is a secure physical device that provides cryptographic functions and key management. HSMs are specifically designed to secure and manage cryptographic keys, including root keys, in a tamper-resistant and highly secure environment. They offer a robust solution for encrypting data on an endpoint by safeguarding the encryption keys used in the process.

Answer D) HSM https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-understand-concepts#:~:text=A%20hardware%20security%20module%20(HSM,authentication%20and%20provides%20crypto%2Dprocessing. TPM does not handle ROOT KEYS..it handles a STORAGE ROOT KEY, but that is used as the master key for TPM access and not the same as a ROOT KEY Bitlocker does not manage any keys. https://www.linkedin.com/advice/0/what-best-practices-managing-tpm-keys-certificates#:~:text=The%20TPM%20can%20create%20and,platform%20configuration%20registers%20(PCRs).

Only HSM includes a root key

TPM = endpoint device

Comparison: TPM: Integrated into endpoint devices. Secure storage of root keys. Used for disk encryption (e.g., BitLocker). Cost-effective for individual devices. HSM: External hardware used in server environments. Provides high-security key management for enterprise applications. More expensive and complex to implement on individual endpoints.

BitLocker is a full disk encryption feature built into Windows that uses a root key to encrypt the data on an endpoint. The root key is typically protected using a Trusted Platform Module (TPM) chip, which provides hardware-based security for the encryption keys, ensuring that they are not easily accessible or tampered with.

While BitLocker can leverage TPM for secure key storage and encryption, it does not include a root key itself. The root key comes from the TPM, not BitLocker.

The Bitlocker use Root Key for the encryption and stores Root key in TPM

A Trusted Platform Module (TPM) is a hardware-based security feature that includes a root key stored in a secure cryptographic processor. TPM is used for encryption, secure boot, and system integrity verification. It helps in securely encrypting data on endpoints by managing encryption keys, such as those used by BitLocker in Windows.

The solution (Bitlocker) includes the use of a root key, which is stored in the TPM

TPM is right. bitlocker can work without TPM as well. however bitlocker + TPM improves security.

changing to A, just realised that the keyword is encryption. and bitlocker only provide encryption when TPM is used along with bitlocker it uses root key. but TPM itself is not a encryption method.

TPM is a hardware component that stores cryptographic keys securely, including the root key used for encryption, but by itself, it is not an encryption solution.

Not A. BitLocker is a full disk encryption tool that can use TPM to protect keys, but it does not include a root key itself — it relies on TPM for that. Not C. VSAN is a virtualized storage infrastructure concept, not a cryptographic or key management solution. Not D. HSM can manage root keys, but it is typically used in enterprise or server environments, not individual endpoints.