CAS-004 Security Engineering Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Platform Configuration Registers (PCRs)

  Why this is correct

  PCRs hold cumulative hash measurements of each boot component, extending values sequentially so any tampering alters the final register state. This satisfies the measured boot requirement, letting attestation compare PCR values against known-good baselines to detect modification before execution.

• ✗

  Endorsement Key (EK)

  Why it's wrong here

  The Endorsement Key is a unique, immutable identity key burned into the TPM for attestation identity, not the mechanism that records component measurements. It is tempting because EK underpins remote attestation, so it would be the correct answer if the question asked how a TPM proves its own identity to a verifier.

• ✗

  Secure boot

  Why it's wrong here

  Secure Boot verifies signatures of boot components against trusted keys and halts on mismatch, but it does not extend measurements into PCRs for later attestation. It is tempting because Secure Boot does prevent tampered components from executing, which would be correct if the question asked how to block unauthorised boot code rather than measure it.

• ✗

  Sealed storage

  Why it's wrong here

  Sealed storage encrypts data bound to specific PCR values, releasing it only when those measurements match; it consumes measurements rather than creating them. It is tempting because sealing is genuinely used to protect secrets contingent on a trusted boot state, which would be correct if the question asked how to bind a disk key to boot integrity.