SY0-701 Question 466
Single answerAttestationA company is deploying a remote access solution for third-party contractors who will connect from unmanaged laptops. Before allowing access to a sensitive financial application, the security team wants the VPN gateway to verify that each endpoint booted with trusted firmware and that critical boot components were not modified. The verification must be based on cryptographic proof from the device rather than a user statement or a simple software check. Which of the following best meets this requirement?
- A
Require users to digitally sign an acceptable use policy before connecting
- B
Use TPM-based remote attestation to validate measured boot values before granting access
- C
Deploy host-based antivirus and allow access if the latest signatures are installed
- D
Check whether the device presents a valid client certificate during TLS authentication
Show answer and explanation
Correct answer: B
Explanation
Attestation is the process of providing evidence about a system's state so another system can assess trust before allowing access or executing sensitive operations. In this scenario, the key requirement is to verify boot integrity with cryptographic proof from the endpoint. TPM-based remote attestation is the best fit because a Trusted Platform Module can securely record measurements of firmware, bootloaders, and related components during measured boot, then report those measurements for validation. This is distinct from authentication controls like client certificates and distinct from compliance checks like antivirus status. Industry best practices and vendor guidance for measured boot and remote attestation consistently emphasize TPM-backed measurements and PCR validation when establishing trust in platform integrity prior to network or application access.
- A. Incorrect.
This is incorrect. A signed acceptable use policy may support accountability and policy enforcement, but it does not provide any technical assurance about the integrity of firmware, the bootloader, or other startup components. It relies on user acknowledgment rather than cryptographic evidence of platform state.
- B. Correct.
This is correct. TPM-based remote attestation is designed to provide cryptographic proof of a system's measured state, typically using Platform Configuration Register (PCR) values populated during measured boot. A relying party, such as a VPN or NAC system, can compare those measurements against known-good values before granting access. This directly addresses the requirement to verify trusted firmware and boot integrity using device-generated evidence rather than user claims.
- C. Incorrect.
This is incorrect. Antivirus status can indicate whether malware protection is present and updated, but it does not prove the integrity of pre-OS components such as firmware, bootloaders, or early boot files. A system could have current AV signatures and still have a compromised boot chain.
- D. Incorrect.
This is incorrect. A valid client certificate helps authenticate the device or user to the VPN, but authentication is not the same as attestation. The certificate proves possession of a private key associated with an identity; it does not, by itself, prove that the system booted in a trusted state or that measured boot values match an approved baseline.