CISSP Security Architecture and Engineering Practice Question
A company wants to ensure that only authorized software can run on its laptops. They decide to use a hardware component that validates the boot process by measuring each component before it loads. Which technology is being used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Trusted Platform Module (TPM)
TPM (Trusted Platform Module) enables measured boot, where the TPM stores measurements of boot components and verifies their integrity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Trusted Platform Module (TPM)
Why this is correct
The Trusted Platform Module (TPM) is a secure cryptoprocessor designed to secure hardware by integrating cryptographic keys into devices. It performs a "measured boot" process, where each component loaded during startup (firmware, boot loader, operating system kernel) is cryptographically hashed and the measurements are stored in secure PCRs (Platform Configuration Registers). This allows the system to verify the integrity of the boot path and, through remote attestation, prove to a third party that the system booted with an authorized and untampered software configuration.
- ✗
Trusted Execution Environment (TEE)
Why it's wrong here
A Trusted Execution Environment (TEE) provides an isolated, secure area within a main processor, guaranteeing code and data loaded inside are protected with respect to confidentiality and integrity. While it protects sensitive operations and data *during* execution from the main operating system, it does not inherently measure or verify the integrity of the boot process itself. Therefore, a TEE cannot ensure that only authorized software *can boot* initially, as its security domain activates after the boot sequence.
- ✗
Security Kernel
Why it's wrong here
A security kernel is the core component of an operating system or hypervisor that enforces the security policy, primarily focusing on access control and isolation between different processes or virtual machines. It mediates all access requests to system resources, ensuring that subjects only interact with objects according to defined rules. However, its function is to manage and enforce security *after* the system has booted, not to measure or validate the integrity of the software loaded during the initial boot sequence.
- ✗
Hypervisor
Why it's wrong here
A hypervisor, also known as a Virtual Machine Monitor (VMM), is software that creates and runs virtual machines (VMs) by abstracting the underlying hardware. Its primary role is to manage the allocation of physical resources to multiple guest operating systems and ensure their isolation. While a hypervisor can provide a secure foundation for VMs, it does not inherently perform integrity checks or attestation on the boot process of the host system or the guest operating systems to ensure only authorized software can initially load.
Go deeper
Related to this question
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.