CISSP Security Architecture and Engineering Practice Question
A security team is investigating a vulnerability where an attacker can intercept and modify data as it moves between processes within a CPU's secure enclave. Which technology is designed to protect against such attacks by creating a trusted execution environment?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Intel Software Guard Extensions (SGX)
Intel SGX provides a TEE that isolates code and data in enclaves, protecting from other processes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Trusted Platform Module (TPM)
Why it's wrong here
The Trusted Platform Module (TPM) is a secure cryptoprocessor designed to provide hardware-based security functions, primarily for platform integrity verification and secure key storage. While it establishes a hardware root of trust and supports remote attestation by storing cryptographic hashes of system components, it does not create isolated execution environments or enclaves to protect code and data from unauthorized access or modification during runtime. Therefore, it cannot directly mitigate vulnerabilities related to code execution within a protected memory region.
- ✓
Intel Software Guard Extensions (SGX)
Why this is correct
Intel Software Guard Extensions (SGX) is a set of CPU instructions that allows developers to protect specific code and data from disclosure or modification. It achieves this by creating "enclaves," which are isolated, hardware-protected memory regions within an application's address space. Even if the operating system, hypervisor, or other privileged software is compromised, the code and data inside an SGX enclave remain protected, making it suitable for mitigating vulnerabilities that target runtime execution integrity and confidentiality.
- ✗
Measured Boot
Why it's wrong here
Measured Boot is a process that uses a Trusted Platform Module (TPM) to record cryptographic hashes (measurements) of all boot components, from firmware to the operating system kernel, into Platform Configuration Registers (PCRs). These measurements can later be used for remote attestation to verify the integrity of the boot process. However, Measured Boot only ensures that the system booted with expected software; it does not provide any runtime protection for executing code or data within isolated memory regions once the system is operational.
- ✗
Secure Boot
Why it's wrong here
Secure Boot is a UEFI firmware feature designed to prevent malicious software from loading during the system startup process. It works by verifying the digital signatures of boot components, such as bootloaders, operating system kernels, and drivers, against a database of trusted keys. If a component's signature is not valid or not trusted, Secure Boot prevents it from loading. While crucial for initial system integrity, Secure Boot does not offer any protection for code or data once the operating system has loaded and applications are executing in memory.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.