An SSL/TLS private key is installed on a corporate web proxy in order to inspect HTTPS requests. Which of the following describes how this private key should be stored so that it is protected from…

Full disk encryption protects data at rest when the disk is unmounted, but the key would still be exposed in memory or on the filesystem while the proxy is actively running.

Storing the key on encrypted removable media still requires decryption and loading into the system for use, leaving it exposed during operation and vulnerable to theft when loaded.

A Hardware Security Module (HSM) is purpose-built to store and protect cryptographic keys in tamper-resistant hardware. The private key never leaves the HSM in plaintext - all cryptographic operations are performed inside the device, making key theft extremely difficult even if an attacker gains OS-level access to the proxy.

Storing the key on the web proxy filesystem provides no additional protection beyond OS file permissions, making it vulnerable to any attacker who compromises the operating system.