Edge Identity and Authentication GCSA Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company uses edge devices that are manufactured by a third party. They want to ensure that the devices have not been tampered with during shipping. Which approach provides the strongest assurance?

   • AUse a checksum of the firmware provided by the manufacturer.
   • BUse a hardware root of trust that measures the device firmware at boot and attests the measurements to a trusted server.
   • CCheck that the device packaging is intact and has a tamper-evident seal.
   • DCompare the device serial number with the shipping manifest.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company manufactures edge devices that run a custom operating system. The security team wants to ensure that only the company's signed OS images can be booted on the devices. Which control should be implemented on the device?

   • AEncrypt the OS image with a key stored on the device.
   • BEnable secure boot with the company's public key embedded in the device firmware.
   • CUse a bootloader that only loads images from a specific USB port.
   • DUse a BIOS password to prevent unauthorized users from changing boot settings.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What does 'provenance' refer to in the context of supply chain security for edge components?

   • AThe processing speed of the component
   • BThe cost of the component
   • CThe physical size of the component
   • DThe origin and chain of custody of the component
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Why is edge identity considered critical for securing distributed and cloud-native environments?

   • AIt guarantees that edge devices never need to rotate their credentials
   • BIt eliminates the need for monitoring edge device activity
   • CIt allows edge devices to bypass the central cloud for all communication
   • DIt provides a trusted basis for enforcing access control and verifying the legitimacy of edge entities
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A smart-city project deploys edge devices that run firmware from a third-party vendor. The security team wants to ensure that only authentic and unmodified firmware is installed on the devices. Which control should they implement?

   • ADownload the firmware from the vendor's website and compare the file size with the vendor's documentation.
   • BInstall the firmware only if the vendor's website uses HTTPS.
   • CVerify a cryptographic signature of the firmware image against the vendor's public key before installation, and record the image hash in an immutable audit log.
   • DUse a checksum from the vendor's support forum to validate the firmware.
   Reveal Solution Discussion Select an answer first