3.4 - Understand Security Capabilities of Information Systems (IS) (e.g., Memory Protection, Trusted Platform Module (TPM), Encryption/decryption) CISSP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security administrator is configuring a new laptop for a remote employee. The administrator wants to ensure that the laptop's hard drive is encrypted and that the encryption key is protected by a hardware component that is tied to the device. The employee should be able to log in with a password, and the drive should unlock automatically at boot without requiring a separate USB key. Which technology should the administrator use?

   • AA software-based encryption tool that stores the key in the Windows registry.
   • BBitLocker Drive Encryption with a TPM-based key protector.
   • CA smart card that the user inserts at every boot.
   • DA hardware security module (HSM) connected via USB.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A multinational corporation's security team must implement a key management solution for a new payment processing system. The system requires that cryptographic keys be stored in a tamper-resistant environment, that keys be automatically rotated every 90 days, and that a designated compliance officer be able to access encrypted data if a key custodian is unavailable. The solution must also allow the compliance officer to access keys only under a dual-control process. Which solution BEST meets these requirements?

   • AEncrypt the keys with a master password and store the password in a shared team document.
   • BUse a Hardware Security Module (HSM) with built-in key rotation and configure key escrow with dual-control recovery.
   • CUse a cloud key management service (KMS) and grant the compliance officer full access to all keys.
   • DStore keys in a software vault on the application server and schedule a cron job to rotate them.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   How does Measured Boot differ from Secure Boot?

   • AMeasured Boot is a software-only feature, while Secure Boot requires hardware
   • BMeasured Boot prevents all malware, while Secure Boot only detects it
   • CMeasured Boot records integrity measurements in the TPM, while Secure Boot verifies signatures and blocks untrusted components
   • DMeasured Boot encrypts the boot process, while Secure Boot hashes it
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In application-level encryption, where does the encryption and decryption of data occur?

   • AAt the operating system level, for all files
   • BAt the storage device level, transparent to the application
   • CWithin the application code, before data is written to storage
   • DAt the network layer, during transmission
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company encrypts its critical data with keys managed by a single key custodian. The custodian is suddenly unavailable, and the company cannot access its encrypted data. The security team must implement a solution that ensures data is recoverable in such emergencies while maintaining the confidentiality of the keys from any single individual. Which solution BEST meets these requirements?

   • AImplement a key escrow system where the keys are split into multiple parts and distributed to different trusted individuals, requiring a quorum to reassemble.
   • BUse a hardware security module (HSM) and give the custodian's backup the HSM administrator password.
   • CPrint the encryption keys and store them in a safe deposit box at a bank.
   • DStore a copy of the encryption keys in a cloud storage bucket with the security team's shared account.
   Reveal Solution Discussion Select an answer first