hardMultiple SelectObjective-mapped
CAS-004 Practice Question: Is designing a secure enclave for processing…
A security engineer is designing a secure enclave for processing sensitive personally identifiable information (PII). The enclave must protect data at rest and in use, and must support attestation to verify its integrity. Which THREE technologies should the engineer incorporate? (Choose three.)
⚠ Common exam trap
CompTIA often tests the distinction between hardware roots of trust (TPM, HSM) and actual secure enclave technologies (SGX, SEV, TrustZone), so candidates mistakenly choose TPM or HSM because they associate them with 'trust' and 'security' without understanding that enclaves require isolated memory regions for processing data in use.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AMD Secure Encrypted Virtualization (SEV)
AMD Secure Encrypted Virtualization (SEV) encrypts the memory of virtual machines, protecting data in use from the hypervisor and other VMs. It also supports attestation via the AMD Secure Processor, which generates a signed measurement of the VM's initial state, allowing a remote party to verify integrity. This makes SEV a valid choice for a secure enclave that must protect data at rest and in use and support attestation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Trusted Platform Module (TPM)
Why it's wrong here
TPM provides platform attestation but not enclave computation.
- ✓
AMD Secure Encrypted Virtualization (SEV)
Why this is correct
Encrypts memory for VMs, supports attestation.
- ✓
ARM TrustZone
Why this is correct
Creates a secure world for trusted execution.
- ✓
Intel Software Guard Extensions (SGX)
Why this is correct
Provides enclave isolation and attestation.
- ✗
Hardware Security Module (HSM)
Why it's wrong here
HSM is for key management, not enclave computation.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.