hardMultiple ChoiceObjective-mapped
CISSP Practice Question: Designing secure boot for IoT devices to ensure…
A company is designing secure boot for IoT devices to ensure only trusted firmware runs. The devices have limited resources. Which mechanism provides the highest assurance of boot integrity?
⚠ Common exam trap
Many candidates confuse integrity verification (ensuring code hasn't been tampered with) with confidentiality protections (like encryption) or access controls (like passwords), leading them to pick full disk encryption or BIOS passwords instead of the hardware-based attestation provided by a TPM.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a TPM to measure boot components and compare to stored hashes.
A Trusted Platform Module (TPM) provides hardware-rooted trust by measuring each boot component (e.g., BIOS, bootloader, OS kernel) and storing the measurements in Platform Configuration Registers (PCRs). These measurements are compared against known-good hashes stored in the TPM, ensuring that any tampering with firmware is detected before execution. This offers the highest assurance for resource-constrained IoT devices as it relies on immutable hardware rather than software-based checks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a software-based integrity check that runs after boot.
Why it's wrong here
A software-based integrity check executed after the boot process has already started is inherently vulnerable. If malicious code has already infected the bootloader or operating system kernel, it can easily disable, bypass, or falsify the results of any subsequent software-only integrity verification. This approach fails to establish a root of trust from the very beginning of the boot chain, leaving the system susceptible to early-stage compromises.
- ✗
Set a BIOS password to prevent unauthorized changes.
Why it's wrong here
Setting a BIOS password primarily restricts unauthorized access to the BIOS/UEFI setup utility, preventing manual changes to boot order or system settings. However, it does not actively verify the cryptographic integrity or authenticity of the firmware itself, nor does it prevent a sophisticated attacker from physically tampering with the boot firmware (e.g., reflashing the chip) or subverting the boot process after the BIOS has passed control to the next stage.
- ✓
Use a TPM to measure boot components and compare to stored hashes.
Why this is correct
A Trusted Platform Module (TPM) provides a hardware root of trust by securely storing cryptographic keys and performing integrity measurements. During the secure boot process, the TPM measures each boot component (firmware, bootloader, kernel) before it executes, extending these measurements into Platform Configuration Registers (PCRs). These PCR values are then compared against known good hashes (golden measurements) stored securely within the TPM or a trusted repository, ensuring that only authorized and untampered software loads.
- ✗
Implement full disk encryption (FDE).
Why it's wrong here
Full Disk Encryption (FDE) primarily protects data confidentiality by encrypting the entire storage device, rendering its contents unreadable without the correct decryption key. While crucial for data at rest, FDE operates at a layer above the initial boot process. It does not verify the integrity of the boot firmware, bootloader, or operating system kernel itself, meaning a compromised boot chain could still load malicious software even if the disk data remains encrypted.
Go deeper
Related to this question
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.