A security architect is documenting how a Trusted Platform Module (TPM) supports platform integrity on a fleet of corporate laptops. Which statement most accurately describes the role TPM plays in this scenario?
- AIt provides a hardware root of trust that securely stores keys and platform measurements used to attest the boot state of the system. Correct
- BIt performs bulk symmetric encryption of the system disk by streaming sectors through its on-chip cipher engine to accelerate full-disk encryption performance.
- CIt isolates running application memory into an encrypted enclave that the operating system kernel cannot inspect during process execution.
- DIt enforces address space layout randomisation and non-executable memory pages to prevent buffer overflow exploitation on the host.
Why A is correct: TPM serves as a hardware root of trust: it shields keys in tamper-resistant storage and records boot measurements into Platform Configuration Registers, which can be used for sealed storage and remote attestation of the platform's integrity.
Why B is wrong: Tempting because TPM is frequently associated with BitLocker and full-disk encryption, but TPMs do not perform bulk data encryption; they store and protect the key material while the CPU or storage controller handles bulk cipher operations.
Why C is wrong: This describes a trusted execution environment such as Intel SGX or ARM TrustZone, not a TPM. The TPM is a passive co-processor for key protection and measurement; it does not provide runtime memory isolation for applications.
Why D is wrong: ASLR and NX page enforcement are memory protection features of the operating system and CPU memory management unit. The TPM has no role in randomising address layouts or marking pages non-executable.