CAS-004 Security Engineering Practice Question
A security architect is designing a secure boot chain for an IoT device. Which THREE components are essential to ensure the integrity of the firmware update process? (Select THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Firmware update files signed with a private key
A secure boot chain requires that the bootloader verifies the firmware signature using a public key stored in read-only memory. The firmware must be signed by a trusted entity, and updates must be delivered over a secure channel (e.g., TLS) to prevent tampering. Encryption of firmware at rest is not essential for integrity; integrity verification is through signatures. Rolling back to a previous version should be prevented, but that is a separate concern.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Firmware update files signed with a private key
Why this is correct
Signing ensures authenticity and integrity of the update.
- ✗
A mechanism to prevent firmware rollback to older versions
Why it's wrong here
Rollback prevention is important but not essential for the integrity of the update process itself.
- ✗
Encryption of firmware at rest on the device
Why it's wrong here
Encryption protects confidentiality, not integrity of the update process.
- ✓
Secure over-the-air (OTA) update delivery mechanism (e.g., TLS)
Why this is correct
Protects the update in transit from tampering.
- ✓
A hardware root of trust (e.g., read-only memory) storing the public key
Why this is correct
Provides a trusted anchor for signature verification.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.