GSLC · Question #35
You are responsible for the security computers in college labs. Since a number of students have significant computer skills, you wish to make security impossible to breach through normal operating…
The correct answer is B. Implement bios security that prevents the system from loading if the correct password is not entered. BIOS/UEFI firmware passwords enforce authentication before the operating system loads, preventing all OS-level and software-based circumvention methods.
Question
You are responsible for the security computers in college labs. Since a number of students have significant computer skills, you wish to make security impossible to breach through normal operating system based means. Furthermore, you want to have the security require a password that must be entered before the operating system even loads. What will you do to accomplish the task?
Options
- AImplement biometric security.
- BImplement bios security that prevents the system from loading if the correct password is not entered.
- CImplement an operating system password that prevents the system from loading if the correct
- DImplement hard drive encryption with a password tied into the operating system password.
How the community answered
(27 responses)- B89% (24)
- C4% (1)
- D7% (2)
Why each option
BIOS/UEFI firmware passwords enforce authentication before the operating system loads, preventing all OS-level and software-based circumvention methods.
Biometric security solutions typically require a loaded operating system or dedicated hardware driver to function, and do not prevent the OS from starting if the biometric reader is bypassed or removed.
A BIOS/UEFI password is enforced at the firmware level during the Power-On Self-Test (POST) phase, halting the boot sequence before any OS code executes; this means OS recovery tools, live boot media, and OS-based hacking utilities cannot be used to bypass the control, directly meeting the requirement that security cannot be breached through OS-based means.
An operating system login password can be circumvented by booting from external USB or CD media, using OS recovery environments, or replacing system files - all standard techniques available to skilled users.
Hard drive encryption tied to the OS password still requires the operating system to load before authentication occurs, leaving it vulnerable to attacks that operate outside the running OS, such as drive removal or firmware-level tools.
Concept tested: BIOS/UEFI pre-boot password authentication security
Source: https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-uefi
Topics
Community Discussion
No community discussion yet for this question.