Examkin

Question

Difficulty: HardMitigation Strategies and Enterprise Hardening Practices

During a physical security assessment of an organization's remote branch offices, security auditors discover that unauthorized individuals could gain brief physical access to server hardware hosting edge compute workloads. The audit highlights a critical risk: an attacker with local physical access could reboot the system, modify kernel boot parameters, and force the operating system to load compromised drivers that disable host security software prior to OS initialization. Which of the following enterprise hardening strategies is the MOST effective technical mitigation to prevent this unauthorized pre-boot tampering?

  1. Enable UEFI Secure Boot paired with Measured Boot using a Hardware Root of Trust (TPM) to enforce signature verification and boot chain integrity validation.Answer
  2. B
    Implement continuous network microsegmentation and IPsec tunnel encapsulation for all traffic originating from branch office server nodes.
  3. C
    Deploy an inline Web Application Firewall (WAF) to inspect all inbound traffic destined for local administration APIs running on the edge server.
  4. D
    Configure high-interaction honeypots on adjacent local subnet segments to detect and log physical network reconnaissance.

Answer

Enabling UEFI Secure Boot paired with Measured Boot using a Hardware Root of Trust (TPM) to enforce signature verification and boot chain integrity validation.
The correct answer emphasizes UEFI Secure Boot along with Measured Boot and TPM verification. This establishes a trusted boot chain where each stage validates the cryptographic signature of the subsequent stage (firmware -> bootloader -> kernel -> boot-start drivers). If a bootloader parameter or driver has been tampered with by a local attacker, the digital signature check fails and the system refuses to boot the unverified code, effectively preventing early-stage driver suppression.

Step-by-Step Solution

1
Analyze the threat scenario described in the audit finding.
Identified that the vulnerability occurs during the host hardware initialization phase (pre-boot), where an attacker with physical access tampers with bootloader parameters and boot-start drivers.
Understanding the precise execution phase of the threat is essential for selecting a control that operates at or below that initialization boundary.
2
Evaluate technical mitigation controls capable of restricting host boot behavior.
UEFI Secure Boot establishes a Hardware Root of Trust using cryptographic keys stored in firmware/TPM to inspect digital signatures on bootloaders, OS kernels, and early-launch anti-malware drivers before execution.
If an untrusted driver or modified kernel is detected during startup, Secure Boot halts initialization, preventing the execution of malicious early-stage drivers.
3
Differentiate preventive system hardening from network, application, or detective controls.
Network encryption, WAF filtering, and honeypots do not operate at the firmware/hardware initialization layer and cannot inspect pre-boot integrity.
System hardening against physical pre-boot tampering requires low-level firmware security features rather than perimeter or application-layer defenses.

Key Concept

Hardware Root of Trust, UEFI Secure Boot, and Measured Boot in Enterprise Host Hardening
Estimated Time:2m 0s
Rate this question

Topics

Mitigation Strategies and Enterprise Hardening Practices

More questions from this topic