SY0-701 Security Architecture Practice Question
A security architect is designing a solution to process highly sensitive financial transactions in a shared cloud environment. The architect needs to ensure that the processor and memory used to handle transaction data are isolated from the host operating system and other virtual machines, even if the hypervisor is compromised. Which technology is specifically designed to provide this level of isolation for code and data during runtime?
⚠ Common exam trap
Test-takers frequently confuse a TPM or HSM with runtime memory isolation, but those technologies focus on storage and cryptographic operations, not on protecting code and data during active execution in a compromised hypervisor environment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Secure enclave (e.g., Intel SGX)
Secure enclave technology, such as Intel SGX, provides hardware-enforced isolation by creating trusted execution environments (TEEs) within the CPU. Code and data inside an enclave are encrypted in memory and decrypted only within the processor, ensuring that even a compromised hypervisor or host OS cannot access the transaction data during runtime. This meets the requirement for processor and memory isolation in a shared cloud environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Trusted Platform Module (TPM)
Why it's wrong here
A Trusted Platform Module is a passive hardware root of trust that stores platform configuration measurements in PCRs and protects cryptographic keys, but it does not execute application logic or mediate memory access. It can attest to the integrity of the boot process via measured boot, yet it offers no runtime enclave in which a process can hide data from the OS. Even if the TPM is present, a compromised kernel can directly read the memory of any ordinary user-space process.
When this WOULD be correct
A question asking for a hardware root of trust to verify platform integrity at boot time, or to securely store encryption keys and perform platform attestation, would have TPM as the correct answer.
- ✗
Hardware Security Module (HSM)
Why it's wrong here
A Hardware Security Module is a dedicated cryptographic appliance for generating, storing, and using keys, often with tamper protection, but it is not a general-purpose secure processor for running application code. It performs specific operations like signing, encryption, and key derivation, and it does not provide an isolated address space for the larger application's data. The host application must pass plaintext to the HSM, so the memory of the calling process remains exposed to the OS, hypervisor, or malware.
When this WOULD be correct
A question asking for a dedicated hardware device to securely store cryptographic keys and perform cryptographic operations (e.g., signing, encryption) for a payment processing system, especially when compliance with standards like FIPS 140-2 is required.
- ✓
Secure enclave (e.g., Intel SGX)
Why this is correct
A secure enclave, such as Intel Software Guard Extensions (SGX), creates hardware-enforced encrypted regions of memory that protect code and data from access by the host OS, hypervisor, or other processes, even if those lower layers are compromised.
- ✗
UEFI Secure Boot
Why it's wrong here
UEFI Secure Boot establishes a chain of trust only during the boot sequence: the firmware verifies the digital signature of the boot loader, and the boot loader verifies the OS kernel. Once the operating system is running, Secure Boot has no mechanism to enforce memory isolation or protect application code from the host OS or hypervisor. It cannot create a private execution context for sensitive data, so an attacker with kernel-level access would still have full visibility into the process's memory.
When this WOULD be correct
A question asks: 'Which technology prevents unauthorized operating systems or bootkits from loading during the boot process on a secure system?' In that context, UEFI Secure Boot is the correct answer because it verifies digital signatures of boot components.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Secure enclave (e.g., Intel SGX)Correct answer▾
Why this is correct
A secure enclave, such as Intel Software Guard Extensions (SGX), creates hardware-enforced encrypted regions of memory that protect code and data from access by the host OS, hypervisor, or other processes, even if those lower layers are compromised.
✗Trusted Platform Module (TPM)Wrong answer — click to see why▾
Why this is wrong here
TPM provides hardware-based key storage and attestation but does not isolate runtime code and memory from the host OS or hypervisor. It cannot protect data during processing in a shared cloud environment.
★ When this WOULD be the correct answer
A question asking for a hardware root of trust to verify platform integrity at boot time, or to securely store encryption keys and perform platform attestation, would have TPM as the correct answer.
Why candidates choose this
Candidates may confuse TPM's hardware security capabilities with runtime isolation, assuming that any hardware security module can protect data during processing, not just at rest or in transit.
✗Hardware Security Module (HSM)Wrong answer — click to see why▾
Why this is wrong here
An HSM provides hardware-based protection for cryptographic keys and operations, but it does not isolate the processor and memory used to run code and data during runtime from the host OS or hypervisor. It is a peripheral device, not a runtime execution environment.
★ When this WOULD be the correct answer
A question asking for a dedicated hardware device to securely store cryptographic keys and perform cryptographic operations (e.g., signing, encryption) for a payment processing system, especially when compliance with standards like FIPS 140-2 is required.
Why candidates choose this
Candidates may confuse HSM's hardware security with runtime isolation, assuming that any 'hardware security' module protects code and data execution, not just key storage and crypto operations.
✗UEFI Secure BootWrong answer — click to see why▾
Why this is wrong here
UEFI Secure Boot ensures that only signed firmware and bootloaders execute during system startup, but it does not provide runtime isolation for code and data in memory or CPU. It cannot protect against a compromised hypervisor or isolate transaction processing from the host OS.
★ When this WOULD be the correct answer
A question asks: 'Which technology prevents unauthorized operating systems or bootkits from loading during the boot process on a secure system?' In that context, UEFI Secure Boot is the correct answer because it verifies digital signatures of boot components.
Why candidates choose this
Candidates may confuse boot-time integrity with runtime isolation, or think that Secure Boot extends to protect applications during execution, not just the boot chain.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Hypervisor
A hypervisor is software that creates and runs virtual machines by allowing multiple operating systems to share a single hardware host.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.