CISSP Security Architecture and Engineering Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  It is only available in cloud environments

  Why it's wrong here

  Trusted Execution Environments (TEEs) are not exclusive to cloud environments; they are widely implemented across various computing platforms. Modern smartphones, IoT devices, and embedded systems frequently incorporate TEEs, such as ARM TrustZone, to secure sensitive operations directly on the device hardware. This pervasive deployment demonstrates their utility beyond just large-scale cloud infrastructure.

• ✗

  It runs as a separate virtual machine

  Why it's wrong here

  A Trusted Execution Environment (TEE) does not operate as a separate, full-fledged virtual machine. Instead, a TEE is a hardware-backed secure area within a main processor, designed to run small, isolated applications or trusted apps. Unlike a general-purpose VM that hosts an entire operating system, a TEE provides a minimal, secure execution environment with limited resources, focusing on specific security-critical tasks.

• ✗

  It requires a TPM chip

  Why it's wrong here

  A Trusted Execution Environment (TEE) does not inherently require a Trusted Platform Module (TPM) chip, as they serve distinct but complementary security functions. While a TPM provides secure storage for cryptographic keys and performs platform integrity measurements, a TEE creates an isolated execution environment for code and data. TEEs typically rely on dedicated secure hardware extensions, like ARM TrustZone or Intel SGX, rather than a separate TPM chip for their core isolation capabilities.

• ✓

  It provides hardware-enforced isolation from the main OS

  Why this is correct

  A fundamental characteristic of a Trusted Execution Environment (TEE) is its ability to provide robust hardware-enforced isolation from the main operating system. This isolation ensures that code and data running within the TEE are protected from unauthorized access or tampering by the rich OS, hypervisor, or any other software running in the less privileged 'normal world.' This hardware-level separation is critical for maintaining the integrity and confidentiality of sensitive computations.

• ✓

  It protects code and data from unauthorized access even by the OS

  Why this is correct

  A key benefit of a Trusted Execution Environment (TEE) is its capacity to protect sensitive code and data from unauthorized access, even by a potentially compromised main operating system or hypervisor. By executing within a secure, isolated hardware enclave, the TEE ensures that critical intellectual property, cryptographic keys, or personal data remain confidential and their integrity is preserved. This strong protection extends beyond software vulnerabilities, safeguarding against malicious actors who might gain control over the primary OS.

Go deeper

Related to this question