CAS-004 Security Engineering Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  HSM

  Why it's wrong here

  An HSM protects and stores cryptographic keys, performing signing and encryption operations, but it does not extend boot-time measurements into PCRs or provide the measured-boot chain needed for remote attestation. HSMs are correct when key material must be generated and used inside tamper-resistant hardware.

• ✗

  Secure Enclave

  Why it's wrong here

  A Secure Enclave isolates secrets and executes trusted code, yet it does not maintain Platform Configuration Registers or measure boot components for remote attestation. Secure Enclaves are correct when application code needs an isolated execution environment with sealed storage on a device.

• ✓

  TPM 2.0

  Why this is correct

  TPM 2.0 provides the hardware root of trust: it stores boot measurements in Platform Configuration Registers and holds the attestation key used for remote attestation. PCRs reside in shielded TPM memory, so software cannot rewrite them, satisfying the tamper-resistant integrity measurement constraint.

• ✗

  UEFI Secure Boot

  Why it's wrong here

  UEFI Secure Boot verifies bootloader and kernel signatures against trusted keys, but it does not store measurements in Platform Configuration Registers or generate the quote needed for remote attestation. Secure Boot is correct when the goal is preventing unsigned boot code from loading.