CISSP Security Architecture and Engineering Practice Question
Which component of a trusted computing base (TCB) implements the reference monitor concept by enforcing access control decisions for all subjects and objects in the system?
⚠ Common exam trap
The trap is conflating the abstract reference monitor concept with its concrete implementation (security kernel), or confusing the broader TCB with the specific enforcement component.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security kernel
The security kernel is the hardware, firmware, and software component of the TCB that implements the reference monitor concept by mediating all access requests between subjects and objects. It enforces the access control policy and is the only portion of the TCB that must be tamper-proof and always invoked. While the reference monitor is the abstract concept, the security kernel is its concrete implementation within the TCB.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Trusted platform module
Why it's wrong here
The Trusted Platform Module (TPM) is a specialized cryptographic hardware component designed to provide hardware-rooted security functions, such as secure key storage, platform integrity measurement, and cryptographic operations. While a TPM contributes significantly to the overall trust of a system and can be considered part of a larger trusted computing system, it is not the component that implements the core access control policies of the Trusted Computing Base (TCB) itself. Its role is to establish a hardware root of trust, not to enforce all system-wide security policies.
- ✗
Trusted computing base
Why it's wrong here
The Trusted Computing Base (TCB) is the complete collection of all hardware, firmware, and software components within a system that are critical to enforcing the security policy. It represents the totality of protection mechanisms upon which the system's security depends. Therefore, the TCB is not a single component that implements anything; rather, it is the set of all components that must be trusted to maintain the system's security posture, with the security kernel being a crucial part of it.
- ✗
Reference monitor
Why it's wrong here
The reference monitor is an abstract conceptual model that dictates how all access requests between subjects and objects in a system are mediated and controlled according to a defined security policy. It specifies the rules for access control and ensures that no unauthorized operations occur. However, the reference monitor itself is not a physical or software component; it is a design principle or a theoretical construct, and thus cannot be the component that implements the TCB.
- ✓
Security kernel
Why this is correct
The security kernel is the concrete implementation of the abstract reference monitor concept within a Trusted Computing Base (TCB). It is the core of the operating system that enforces the system's access control policies, mediating all subject-object interactions to ensure security. This critical component is responsible for isolating processes, managing memory, and controlling access to resources, making it the actual mechanism that implements the TCB's security functions.
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
Trusted computing base
The trusted computing base is the entire set of hardware, firmware, and software components that are critical to a system's security, meaning that any flaw in these components can break the entire security policy.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.