An organization implemented a secure boot on its most critical application servers which produce content and capability for other consuming servers A recent incident, however led the organization to…

Question

Options

• AAn attacker masqueraded as an internal DNS server
• BAn attacker leveraged a heap overflow vulnerability in the OS
• CAn attacker was able to overwrite an OS integrity measurement register
• DAn attacker circumvented IEEE 802.1X network-level authentication requirements.

• A
  27% (15)
• B
  9% (5)
• C
  54% (30)
• D
  11% (6)

Explanation

Secure boot validates the integrity of the boot chain but relies on TPM Platform Configuration Registers (PCRs) to store integrity measurements at each boot stage. If an attacker was able to overwrite these PCR values (integrity measurement registers), they could mask OS-level tampering while still appearing to pass local validation - secure boot alone would not catch this because the stored measurements were compromised. A centralized attestation service solves this by comparing a server's TPM measurements against known-good golden values stored externally, detecting manipulation even when the local PCRs have been altered. Option A (DNS masquerade) would not require attestation as a remedy. Option B (heap overflow) would be patched at the OS level. Option D (802.1X bypass) would be addressed with NAC controls.

No community discussion yet for this question.