SY0-701 Question 356
Single answerAttestationA company is rolling out remote access for administrators to manage critical servers from company-issued laptops. The security team wants the VPN gateway to allow connections only from devices that can cryptographically prove they booted into a known-good state and that their platform security components have not been tampered with. Which of the following best meets this requirement?
- A
Require a TPM-based remote attestation process that validates platform measurements before granting VPN access
- B
Deploy full disk encryption so the VPN gateway knows the device has not been modified
- C
Use code signing certificates on administrative tools to prove the endpoint boot state is trusted
- D
Require multifactor authentication for all administrators connecting to the VPN
Show answer and explanation
Correct answer: A
Explanation
The key requirement is device trust based on cryptographic proof of system integrity, which is exactly what attestation addresses. In practice, attestation often relies on a TPM to store keys securely and report signed measurements recorded during measured boot. A verifier compares those measurements against expected values or policy before allowing access. This approach is aligned with widely used platform trust models and guidance from standards and vendor documentation related to TPMs, measured boot, and remote attestation. By contrast, full disk encryption protects stored data, code signing validates software origin and integrity at the file level, and MFA verifies user identity. None of those controls alone provide evidence of the endpoint's boot integrity. For Security+ purposes, attestation is specifically about proving the trustworthiness or integrity state of a device or platform to another system before access is granted.
- A. Correct.
Correct. Attestation is the process of providing evidence about the integrity of a system, typically using a hardware root of trust such as a Trusted Platform Module (TPM). In remote attestation, measurements collected during secure or measured boot can be signed and presented to a verifier, such as a VPN or network access control system, to demonstrate that the device booted into an expected state and that critical security components are trustworthy.
- B. Incorrect.
Incorrect. Full disk encryption protects data at rest if a device is lost or stolen, but it does not by itself prove to a remote verifier that the current boot state is known-good or that platform measurements match an approved baseline. A system can be encrypted and still boot into an untrusted or altered configuration.
- C. Incorrect.
Incorrect. Code signing helps verify the integrity and publisher of specific software packages or executables, but it does not attest to the overall platform state during boot. Signed administrative tools do not prove that the operating system, bootloader, firmware, or security hardware have not been tampered with.
- D. Incorrect.
Incorrect. Multifactor authentication validates the user's identity, not the device's integrity. While MFA is a strong control for remote administrative access, it does not provide cryptographic evidence that the laptop booted securely or that its platform state is trustworthy.