Skip to content
AI Security

Interview question · Cryptography, PKI & TLS

When do you need a hardware security module rather than a cloud KMS, and what does each protect against?

Both keep keys out of application memory; they differ in who you must trust and what you can prove. The scored answer chooses by threat model and requirement, not by fashion.

hardEssentialNewPreparation tags: Amazon, Google, MicrosoftUpdated Nov 2026

Both keep keys out of application memory; they differ in who you must trust and what you can prove. The scored answer chooses by threat model and requirement, not by fashion.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

10 answers per topic instead of 5, plus saved progress and bookmarks · costs nothingor unlock all 529 remaining answers · $25

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

Your company needs to protect a code-signing key and the keys that encrypt customer data, and someone asks whether a cloud KMS is enough.

  1. What does a cloud KMS provide?
  2. What does a dedicated HSM add?
  3. Is KMS enough for customer data keys?
  4. What about the code-signing key?
  5. What matters more than the device choice?
  6. What would you recommend?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Premium opens every answer and ladder.

UP NEXT ON YOUR JOURNEY
Next in this trackDesign encryption and key custody for high-value model weights.Next in this trackWhat do confidential computing and attestation actually buy you for model inference?Next in this trackHow and why do you derive multiple keys from one secret with a KDF such as HKDF?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.