A security architect is designing a new infrastructure using both type 1 and type 2 virtual machines. In addition to the normal complement of security controls (e.g. antivirus, host hardening…

A vTPM is a hypervisor-instantiated software emulation of a physical Trusted Platform Module that is assigned per virtual machine. It provides the full TPM 2.0 feature set including secure key generation, storage, and attestation needed for code signing, and operates entirely within the virtualization stack without any dependency on a physical TPM chip or hardware pass-through configuration.

An HSM is a dedicated physical hardware appliance for cryptographic operations - accessing it from a VM requires either a network-attached HSM with a client library or hardware pass-through, both of which violate the no-hardware-pass-through requirement.

A physical TPM is a discrete chip soldered to or installed in the host motherboard and cannot be shared across VMs; assigning it to a VM requires hardware pass-through, which the requirement explicitly prohibits.

INE (formerly eLearnSecurity) is a cybersecurity training and certification organization, not a cryptographic technology, and provides no mechanism for secure key storage in any environment.