ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
Your organization is provisioning a new cluster of bare-metal servers to host critical micro-services. To align with secure configuration practices for underlying hardware, which action should be performed first to establish a trusted hardware baseline before any operating system is installed?
Apply the latest vendor-supplied operating system security patches.
Enable UEFI Secure Boot and verify that all firmware components are signed by trusted keys.
Configure default-deny rules on the host's software firewall.
Install host-based intrusion detection agents as part of the golden image.
Establishing a secure hardware baseline begins with safeguards that protect the platform's lowest-level firmware because every later control depends on that trust. Enabling UEFI Secure Boot (or a comparable hardware root-of-trust mechanism) and validating that the platform firmware is digitally signed prevents unauthorized or malicious code from running during the very first stages of the boot process. Host-based intrusion detection, host firewall rules, and OS patching are all important, but they operate after the system firmware has already executed; if the firmware is compromised, these higher-layer controls can be bypassed. Therefore, configuring Secure Boot and verifying firmware signatures is the essential first step when defining and implementing secure configurations for the underlying hardware.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is UEFI Secure Boot, and how does it establish a hardware root of trust?
Open an interactive chat with Bash
Why is securing firmware more critical than applying OS patches?
Open an interactive chat with Bash
What is a ‘trusted key’ and how is it used in UEFI Secure Boot?
Open an interactive chat with Bash
What is UEFI Secure Boot?
Open an interactive chat with Bash
Why is it important to check firmware signatures?
Open an interactive chat with Bash
What is meant by 'hardware root of trust'?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)