CAS-004 Security Engineering Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  HSM

  Why it's wrong here

  An HSM safeguards cryptographic keys and accelerates cryptographic operations; it does not execute arbitrary sensitive code in a CPU-protected enclave. Hardware-enforced code isolation is provided by confidential-computing enclaves such as Intel SGX or AMD SEV. An HSM is correct when the requirement is key storage and cryptographic processing, not code isolation.

• ✗

  TPM 2.0

  Why it's wrong here

  A TPM 2.0 stores platform measurements, keys, and attestation data; it cannot run tenant code inside a CPU-protected environment. Confidential-computing enclaves such as Intel SGX or AMD SEV provide that execution isolation. A TPM is the right choice for secure boot, measured boot, and key sealing rather than isolated computation.

• ✓

  Intel SGX

  Why this is correct

  Intel SGX creates hardware-isolated enclaves within the CPU, encrypting code and data in memory so even the operating system or hypervisor cannot read them. This directly satisfies the stem's requirement for hardware-enforced isolation of sensitive computations, providing stronger protection than virtualisation or process-level sandboxing alone.

• ✗

  ARM TrustZone

  Why it's wrong here

  ARM TrustZone partitions a processor into secure and non-secure worlds, but its secure world typically hosts a trusted OS, not arbitrary tenant workloads, and it lacks the memory-encryption isolation of confidential-computing enclaves such as Intel SGX or AMD SEV. TrustZone suits embedded trusted execution, not multi-tenant sensitive computation.