CAS-004 Security Engineering Practice Question
A security architect is designing a secure boot process for a new line of embedded devices. The boot ROM loads the bootloader, which then loads the OS kernel. To ensure that only signed code is executed, which mechanism should the bootloader use to verify the kernel?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify a digital signature on the kernel using a public key stored in the boot ROM
The bootloader should verify a digital signature on the kernel image using a public key embedded in the boot ROM or bootloader. This ensures both integrity and authenticity of the kernel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Decrypt the kernel using a symmetric key stored in the boot ROM
Why it's wrong here
Decryption provides confidentiality but not authenticity; symmetric keys are harder to manage securely.
- ✓
Verify a digital signature on the kernel using a public key stored in the boot ROM
Why this is correct
Digital signature verification ensures the kernel is from a trusted source and has not been tampered.
- ✗
Check that the kernel file size matches the expected value
Why it's wrong here
File size is trivial to bypass and provides no security.
- ✗
Compare the kernel hash against a list of known good hashes stored in the bootloader
Why it's wrong here
Hashing alone does not prove authenticity; an attacker could modify both kernel and hash list.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.