CISSP - Security Architecture and Engineering (13% of the exam) - Section 3.4

Understand security capabilities of Information Systems such as memory protection, TPM, and encryption/decryption.

Describe the security capabilities provided by TPM, memory protection mechanisms, secure enclaves, and trusted execution environments in modern information systems. Recognise how these hardware-level controls protect against firmware attacks, code injection, and unauthorised access to sensitive data in memory.

TPMmemory protectionsecure enclavetrusted execution environment

Practice question for this objective

Free sampleSecurity Architecture and Engineeringmedium

A security architect is documenting how a Trusted Platform Module (TPM) supports platform integrity on a fleet of corporate laptops. Which statement most accurately describes the role TPM plays in this scenario?

AIt provides a hardware root of trust that securely stores keys and platform measurements used to attest the boot state of the system. Correct
BIt performs bulk symmetric encryption of the system disk by streaming sectors through its on-chip cipher engine to accelerate full-disk encryption performance.
CIt isolates running application memory into an encrypted enclave that the operating system kernel cannot inspect during process execution.
DIt enforces address space layout randomisation and non-executable memory pages to prevent buffer overflow exploitation on the host.

Recognise that TPM is a hardware root of trust for key protection and platform measurement, not a bulk cipher or memory isolation device. A TPM is a discrete or firmware co-processor that holds endorsement and storage keys, performs limited cryptographic primitives, and records integrity measurements into Platform Configuration Registers. Those measurements support sealed storage, where keys are released only when the platform matches a known good state, and remote attestation, where another party verifies the platform identity and boot integrity. Bulk encryption, runtime enclave isolation, and memory protection are handled by other components such as the CPU, storage controller, or operating system.

Why A is correct: TPM serves as a hardware root of trust: it shields keys in tamper-resistant storage and records boot measurements into Platform Configuration Registers, which can be used for sealed storage and remote attestation of the platform's integrity.

Why B is wrong: Tempting because TPM is frequently associated with BitLocker and full-disk encryption, but TPMs do not perform bulk data encryption; they store and protect the key material while the CPU or storage controller handles bulk cipher operations.

Why C is wrong: This describes a trusted execution environment such as Intel SGX or ARM TrustZone, not a TPM. The TPM is a passive co-processor for key protection and measurement; it does not provide runtime memory isolation for applications.

Why D is wrong: ASLR and NX page enforcement are memory protection features of the operating system and CPU memory management unit. The TPM has no role in randomising address layouts or marking pages non-executable.

See more CISSP practice questions, answers explained.

Exam traps in Security Architecture and Engineering

Answers that look right on this material and are not. Each one is a distractor from a different question in the CISSP bank for this domain.

Enabling Data Execution Prevention so that memory pages marked as data cannot be executed as instructions by the processor.
Why it is wrong: DEP prevents shellcode execution from data pages, which mitigates buffer overflows, but it does not hide the contents of memory from a privileged kernel or administrator inspecting the process address space.
A TEE protects keys at rest in tamper-resistant storage, while a TPM provides an isolated processor mode for executing sensitive code at runtime.
Why it is wrong: This reverses the two roles. TPMs are oriented toward key storage and platform measurement, while a TEE provides the isolated execution context. A candidate who memorises the labels without the function can swap them.
The rising aisle temperature, because it sits well above the recommended ASHRAE envelope and threatens equipment lifespan and availability.
Why it is wrong: An aisle temperature near 27 to 29 degrees Celsius is at the upper boundary of the ASHRAE recommended envelope and inside the allowable envelope, so it warrants attention but is not the most pressing problem. The wide humidity swing is a more direct risk to the equipment.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.