CISSP Security Architecture and Engineering Practice Question
Which component of a trusted computing base (TCB) implements the reference monitor concept by enforcing access control decisions for all subjects and objects in the system?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security kernel
The security kernel is the part of the TCB that implements the reference monitor, mediating all access requests.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Trusted platform module
Why it's wrong here
The Trusted Platform Module (TPM) is a specialized cryptographic hardware component designed to provide hardware-rooted security functions, such as secure key storage, platform integrity measurement, and cryptographic operations. While a TPM contributes significantly to the overall trust of a system and can be considered part of a larger trusted computing system, it is not the component that implements the core access control policies of the Trusted Computing Base (TCB) itself. Its role is to establish a hardware root of trust, not to enforce all system-wide security policies.
- ✗
Trusted computing base
Why it's wrong here
The Trusted Computing Base (TCB) is the complete collection of all hardware, firmware, and software components within a system that are critical to enforcing the security policy. It represents the totality of protection mechanisms upon which the system's security depends. Therefore, the TCB is not a single component that implements anything; rather, it is the set of all components that must be trusted to maintain the system's security posture, with the security kernel being a crucial part of it.
- ✗
Reference monitor
Why it's wrong here
The reference monitor is an abstract conceptual model that dictates how all access requests between subjects and objects in a system are mediated and controlled according to a defined security policy. It specifies the rules for access control and ensures that no unauthorized operations occur. However, the reference monitor itself is not a physical or software component; it is a design principle or a theoretical construct, and thus cannot be the component that implements the TCB.
- ✓
Security kernel
Why this is correct
The security kernel is the concrete implementation of the abstract reference monitor concept within a Trusted Computing Base (TCB). It is the core of the operating system that enforces the system's access control policies, mediating all subject-object interactions to ensure security. This critical component is responsible for isolating processes, managing memory, and controlling access to resources, making it the actual mechanism that implements the TCB's security functions.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.