SY0-701 Security Architecture Practice Question
Exhibit
UEFI Setup - Secure Boot: Disabled - Boot order: USB, External NIC, Internal SSD - Firmware admin password: Not configured - BitLocker status: Enabled Incident note: A technician confirmed the laptop was started from a USB recovery stick that bypassed the normal corporate login workflow.
Based on the exhibit, which hardening change best prevents a laptop from booting unapproved tools from external media?
Exhibit: UEFI Setup - Secure Boot: Disabled - Boot order: USB, External NIC, Internal SSD - Firmware admin password: Not configured - BitLocker status: Enabled
Incident note: A technician confirmed the laptop was started from a USB recovery stick that bypassed the normal corporate login workflow.
⚠ Common exam trap
CompTIA often tests the misconception that host firewall rules can control local device access, but firewalls operate at the network layer and cannot block USB storage devices, which are managed by hardware or OS-level policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Secure Boot and change the firmware boot order so only the internal SSD is allowed first.
Enabling Secure Boot ensures that only signed, trusted firmware and bootloaders can execute, preventing unauthorized tools like USB recovery sticks from loading. Changing the boot order to prioritize the internal SSD over USB media stops the system from even attempting to boot from external devices, directly addressing the incident where the laptop bypassed corporate login via a USB stick.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable Secure Boot and change the firmware boot order so only the internal SSD is allowed first.
Why this is correct
This is the best control because Secure Boot validates that the bootloader is trusted, and restricting the boot order reduces the chance of booting from unapproved removable media. Together, these changes stop many pre-boot attacks and unauthorized recovery tools before the operating system starts. BitLocker helps protect data at rest, but it does not by itself prevent booting alternate media.
- ✗
Extend the Windows login timeout so users have more time to notice suspicious activity.
Why it's wrong here
Extending the Windows login timeout only adjusts how long an idle session remains active before requiring re-authentication, a post-boot OS policy. It does not affect the UEFI/BIOS firmware boot sequence, Secure Boot validation, or the ability to select a USB recovery stick via the boot menu. Because an attacker can boot alternate media before the Windows sign-in screen ever appears, this setting cannot stop pre-boot attacks or unauthorized recovery tools.
- ✗
Turn off BitLocker so recovery tools can boot without errors.
Why it's wrong here
Disabling BitLocker would remove full-disk encryption, but the boot from the USB recovery stick succeeded because Secure Boot was disabled and the boot order prioritised USB over the internal SSD—BitLocker does not block booting from external media. It is tempting because BitLocker can prevent offline data access, and turning it off might seem necessary if a recovery tool encounters an encrypted drive; however, the correct hardening change would be enabling Secure Boot to validate the bootloader’s digital signature, which directly prevents unauthorised external boot media from loading.
- ✗
Install a host firewall rule to block USB storage devices from the network.
Why it's wrong here
A host firewall rule operates on network traffic, filtering IP packets based on ports, protocols, or program paths, and it has no visibility into USB mass-storage devices attached to the firmware or boot process. USB boot attacks occur through the UEFI/BIOS boot manager, which reads the drive directly without invoking the OS network stack, so firewall rules cannot intervene. Moreover, if the recovery stick is used to boot a live environment, it does not rely on network connectivity, rendering the firewall rule ineffectual.
Go deeper
Related to this question
Learn chapter
Secure Network Design Principles
Key term
Secure boot
Secure Boot is a security feature that ensures a device starts up using only trusted software that is digitally signed by the manufacturer.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.