SY0-701 Question 465
Single answerAttestationA company is deploying laptops to remote employees and wants to allow VPN access only from devices that can prove they booted into a trusted state and still have full-disk encryption enabled. The security team wants a hardware-backed method to verify the device's integrity before granting access. Which of the following best meets this requirement?
- A
Use attestation with a TPM to provide signed evidence of the device's boot measurements and security state
- B
Require users to present a smart card certificate during VPN authentication
- C
Enable biometric authentication on the laptop before allowing the VPN client to start
- D
Install a host-based firewall and block outbound traffic until the user logs in
Show answer and explanation
Correct answer: A
Explanation
Attestation is used to verify the trustworthiness or integrity state of a system, often by relying on a TPM and measured boot data. In enterprise environments, remote or device attestation can be integrated with network access control, conditional access, or VPN posture checks to determine whether a device should be allowed to connect. This is different from user authentication methods such as smart cards or biometrics, which verify who the user is rather than whether the platform is in a known-good state. Best practices from trusted computing guidance and vendor documentation on TPM, secure/measured boot, and endpoint posture assessment support using attestation when access decisions must depend on the integrity of the endpoint rather than only the identity of the user.
- A. Correct.
Correct. Attestation uses hardware-backed trust, typically through a Trusted Platform Module (TPM), to provide evidence about a platform's integrity. In this scenario, the company needs proof that the laptop booted into a trusted state and that certain security controls, such as full-disk encryption, are enabled. TPM-based attestation can report measurements collected during the boot process and can be used by an access control system to evaluate whether the endpoint is trustworthy before granting VPN access.
- B. Incorrect.
Incorrect. A smart card certificate can strongly authenticate the user, but it does not prove the security state of the endpoint itself. This option addresses user identity, not device integrity. A compromised or improperly configured laptop could still be used with a valid smart card.
- C. Incorrect.
Incorrect. Biometrics verify the user's identity locally, but they do not provide hardware-backed evidence that the system booted securely or that encryption remains enabled. This is a common confusion between authentication of a person and attestation of a device's health or trust state.
- D. Incorrect.
Incorrect. A host-based firewall can help control traffic, but it does not provide cryptographic proof of system integrity or measured boot status. It is a protective control, not an attestation mechanism. The device could have a firewall enabled and still be untrusted or tampered with.