CAS-003 · Question #561
A security engineer is working to secure an organization's VMs. While reviewing the workflow for creating VMs on demand, the engineer raises a concern about the integrity of the secure boot process…
The correct answer is B. Enable the vTPM on a Type 2 hypervisor. A virtual TPM (vTPM) provides a VM guest with the same secure boot attestation capabilities that a physical TPM chip provides for bare-metal systems. It stores cryptographic measurements of each stage of the VM's boot process and can verify that the boot sequence has not been…
Question
A security engineer is working to secure an organization's VMs. While reviewing the workflow for creating VMs on demand, the engineer raises a concern about the integrity of the secure boot process of the VM guest. Which of the following would BEST address this concern?
Options
- AConfigure file integrity monitoring of the guest OS.
- BEnable the vTPM on a Type 2 hypervisor.
- COnly deploy servers that are based on a hardened image.
- DProtect the memory allocation of a Type 1 hypervisor.
How the community answered
(43 responses)- A5% (2)
- B58% (25)
- C26% (11)
- D12% (5)
Explanation
A virtual TPM (vTPM) provides a VM guest with the same secure boot attestation capabilities that a physical TPM chip provides for bare-metal systems. It stores cryptographic measurements of each stage of the VM's boot process and can verify that the boot sequence has not been tampered with-directly addressing the engineer's concern about guest boot integrity. File integrity monitoring (A) watches for changes to files after the OS is running, not during boot. Deploying hardened images (C) reduces attack surface but does not continuously attest boot integrity. Protecting memory allocation of a Type 1 hypervisor (D) relates to hypervisor isolation, not guest secure boot validation.
Topics
Community Discussion
No community discussion yet for this question.