Providing tamper resistant key generation and hardware backed cryptographic key storage is correct because hardware security modules are designed to generate and store cryptographic keys inside tamper resistant hardware and to perform cryptographic operations without exposing key material.

HSMs create keys in a protected environment and they keep keys in hardware that resists extraction and tampering. They commonly have validations such as FIPS 140 2 and FIPS 140 3 and they can provide attestation and strict role separation which auditors and regulators expect for strong key custody and cryptographic protection.

Delivering multi region failover and redundancy to maintain service continuity is not an HSM capability. That option describes availability and disaster recovery design which is handled by replication and architecture rather than by cryptographic hardware.

Routing incoming traffic among instances with Google Cloud Load Balancing is a networking and traffic management service. It does not provide tamper resistant key generation or hardware backed key storage which are the central features of an HSM.

Enforcing physical data center entry restrictions and badge access controls are physical facility controls. They support overall security but they do not provide the cryptographic key generation and hardware backed custody that HSMs deliver.

Full AWS Practitioner Certification Question