mediumMultiple ChoiceObjective-mapped
220-1201 Practice Question: A technician is configuring a new server and…
A technician is configuring a new server and needs to ensure that only signed operating system bootloaders can be loaded. Which UEFI feature should be enabled?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Secure Boot
Secure Boot enforces cryptographic verification of bootloaders, preventing unauthorized code from running during boot. This is a key security feature in UEFI. The question tests understanding of Secure Boot's purpose and implementation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Fast Boot
Why it's wrong here
Enabling Fast Boot primarily optimizes the boot process by skipping certain hardware initialization steps or resuming from a hibernation state, rather than performing a full cold boot. While this feature reduces startup time, it offers no mechanism for verifying the digital signatures of bootloaders or operating system components. Therefore, it fails to enhance system security against malicious code during the critical startup phase.
- ✗
Enable Legacy Boot
Why it's wrong here
Enabling Legacy Boot, also known as Compatibility Support Module (CSM), allows the system to boot using traditional BIOS-style methods, which predates and bypasses the UEFI Secure Boot process. This configuration explicitly permits the execution of bootloaders and operating systems that are not digitally signed or verified. Consequently, it introduces a significant security vulnerability by allowing potentially malicious or unauthorized code to run at startup.
- ✓
Enable Secure Boot
Why this is correct
Enabling Secure Boot is the correct action for enhancing server security as it is a UEFI firmware feature designed to prevent unauthorized or malicious software from loading during the system startup process. It works by verifying the digital signatures of all boot components, including the bootloader, kernel, and drivers, against a database of trusted keys stored in the firmware. If any component's signature is not valid or recognized, Secure Boot will block its execution, thereby protecting the server from rootkits and other low-level malware.
- ✗
Enable Boot from USB
Why it's wrong here
Enabling "Boot from USB" merely configures the system's boot order to prioritize a USB device as a potential startup source, which is useful for installing operating systems or running diagnostic tools. This setting does not implement any security verification mechanisms for the boot process itself. It does not prevent unauthorized code from executing if a malicious USB drive is used, as it is solely a boot source selection, not a security feature.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 220-1201 question from scratch — 972 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1201 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1201 exam.