Which activity should be performed to verify that keys exist in approved forms at all times?

Which activity should be performed to verify that keys exist in approved forms at all times?

• A. Review only the user access logs
• B. Examine system configurations and key storage locations
• C. Inspect the physical safes where keys are stored
• D. Check only data encryption results

Answer: (B)

Key management hinges on ensuring the actual key material is stored and used in approved forms, and that the system is configured to rely on those approved forms at all times. Examining system configurations and key storage locations provides a complete view: it shows what forms of keys are permitted, where they are kept (for example, in an HSM or encrypted vault), how they are provisioned and rotated, and which processes have access. This directly verifies that keys exist in the approved forms and are accessible only as intended. Relying on user access logs only reveals who accessed things, not whether the keys themselves are stored and managed in approved formats. Inspecting physical safes focuses on physical custody but doesn't verify digital key management or configurations. Checking data encryption results shows whether encryption is functioning, but not whether the keys are maintained in approved forms or stored in approved locations.

Key management hinges on ensuring the actual key material is stored and used in approved forms, and that the system is configured to rely on those approved forms at all times. Examining system configurations and key storage locations provides a complete view: it shows what forms of keys are permitted, where they are kept (for example, in an HSM or encrypted vault), how they are provisioned and rotated, and which processes have access. This directly verifies that keys exist in the approved forms and are accessible only as intended.

Relying on user access logs only reveals who accessed things, not whether the keys themselves are stored and managed in approved formats. Inspecting physical safes focuses on physical custody but doesn't verify digital key management or configurations. Checking data encryption results shows whether encryption is functioning, but not whether the keys are maintained in approved forms or stored in approved locations.