CAS-003 · Question #758
A security analyst is reviewing an endpoint that was found to have a rookit installed. The rootkit survived multiple attempts to clean the endpoints, as well as an attempt to reinstall the QS. The…
The correct answer is A. Utilize measured boot attestation. This answer is correct. A rootkit that survives an OS reinstall almost certainly resides at the firmware or bootloader level, below the OS. Measured boot attestation uses the TPM chip to cryptographically hash and record each component in the boot chain (firmware → bootloader →…
Question
A security analyst is reviewing an endpoint that was found to have a rookit installed. The rootkit survived multiple attempts to clean the endpoints, as well as an attempt to reinstall the QS. The security analyst needs to implement a method to prevent other endpoint from having similar issues. Which of the following would BEST accomplish this objective?
Options
- AUtilize measured boot attestation.
- BEnforce the secure boot process.
- CReset the motherboard's TPM chip.
- DReinstall the OS with known-good media.
- EConfigure custom anti-malware rules.
How the community answered
(68 responses)- A68% (46)
- B1% (1)
- C4% (3)
- D18% (12)
- E9% (6)
Explanation
This answer is correct. A rootkit that survives an OS reinstall almost certainly resides at the firmware or bootloader level, below the OS. Measured boot attestation uses the TPM chip to cryptographically hash and record each component in the boot chain (firmware → bootloader → OS loader) and compare those measurements against a known-good baseline. Any tampering is detected and flagged. Secure boot (B) only verifies digital signatures - it does not provide a measurement chain that detects all firmware-level rootkits. Reinstalling the OS (D) has already failed.
Topics
Community Discussion
No community discussion yet for this question.