Cloud access security brokers (CASB) are used to consistently apply security policies across cloud services and don’t protect encryption keys, making it an incorrect answer. Hardware security modules (HSMs) are specifically designed to safeguard encryption keys, avoiding the need for a human being to directly interact with the key, making it our correct answer here. Some cloud providers offer cloud-based HSM services to their customers as an advanced security offering. Data loss prevention (DLP) systems block the exfiltration of sensitive information and, again, don’t protect encryption keys. Neither do intrusion prevention systems (IPSs), which detect and block security threats.