I85PREP
⌘ K
TEE Engineer License study materials
TEE Engineer License study resources

TEE Engineer License practice questions

One question at a time. Build your TEE Engineer License understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1TEE Fundamentals and Threat Modeling

In TEE threat modeling, what does the term 'Rich Execution Environment' (REE) refer to?

  1. The debug interface used by chip manufacturers during factory testing
  2. The hardware random number generator that seeds keys inside the secure world
  3. The conventional OS and application stack, such as a general-purpose Linux or Android environment, that runs alongside the TEE Correct answer.
  4. The secure boot ROM that verifies firmware signatures before the main processor starts

Explanation

The REE is the normal, feature-rich operating environment (e.g., Linux, Android, Windows) whose attack surface the TEE is designed to be isolated from. It is considered untrusted relative to the secure world, so TEE designs assume the REE may be fully compromised.

Question 2TEE Fundamentals and Threat Modeling

Which statement best captures the core security guarantee a TEE is expected to provide?

  1. It prevents physical probing of the SoC package by encapsulating the die in epoxy resin
  2. It protects the confidentiality and integrity of code and data in the secure world even if the REE is compromised Correct answer.
  3. It guarantees that all code running in the REE has been digitally signed by a trusted vendor
  4. It encrypts all network traffic leaving the device regardless of which world generated it

Explanation

The defining property of a TEE is isolation: trusted code and secrets remain confidential and integrity-protected against a compromised rich OS, including kernel-level attackers. Physical attacks and network encryption are separate concerns handled by other mechanisms.

Question 3TEE Fundamentals and Threat Modeling

A security architect lists assets to protect when designing a payment app on a TEE-enabled phone. Which asset is the TEE primarily responsible for shielding?

  1. The public marketing content served by the payment provider's web front end
  2. The list of installed social media applications on the device
  3. The device's screen brightness calibration table stored in the display driver
  4. The long-term payment credential used to authorize transactions Correct answer.

Explanation

TEE threat models focus on high-value secrets and operations, and a long-term payment credential is exactly the kind of asset the secure world exists to protect. Marketing content and general device metadata have low sensitivity and are normally handled in the REE.

Question 4TEE Fundamentals and Threat Modeling

In a TEE threat model, what is the 'trusted computing base' (TCB)?

  1. The subset of the REE kernel modules that are loaded at boot time
  2. The set of third-party applications that users have explicitly granted permissions to
  3. The complete set of hardware and software components whose correct behavior the security guarantees depend on Correct answer.
  4. The collection of servers in the cloud that the device connects to for updates

Explanation

The TCB comprises everything that must behave correctly for the security policy to hold, so minimizing it is a central design principle. Code outside the TCB is assumed potentially hostile when reasoning about the guarantees.

Question 5TEE Fundamentals and Threat Modeling

What does remote attestation allow a relying party to establish about a TEE-enabled device?

  1. That the user has consented to every permission requested by installed applications
  2. That the device is running a specific, unmodified trusted software image, verified by a signed measurement Correct answer.
  3. That the device's REE has no unpatched vulnerabilities at the time of the request
  4. That the device's battery has not been replaced since manufacturing

Explanation

Remote attestation produces a signed report of measurements taken by trusted code, letting a remote service confirm the identity and integrity of the trusted environment. It does not make claims about REE patch level or user consent.

Question 6TEE Fundamentals and Threat Modeling

Which adversary capability is explicitly assumed by most TEE threat models for the rich execution environment?

  1. The attacker can rewrite the on-die secure boot ROM after manufacture
  2. The attacker controls the REE kernel and can tamper with its drivers and memory Correct answer.
  3. The attacker can read secrets from the secure world by observing cache timing without any software access
  4. The attacker can decrypt any memory bus traffic without physical access

Explanation

Standard TEE threat models grant the attacker full control of the REE, including kernel privileges, because a compromised OS is a realistic and common scenario. Attacks that require physical access or ROM modification are handled by separate, stronger threat categories.

Question 7TEE Fundamentals and Threat Modeling

In TEE terminology, what distinguishes a 'trustlet' from a normal application?

  1. A trustlet is any application that has been installed from an official app store
  2. A trustlet is a firmware blob that configures the memory controller at boot
  3. A trustlet is a protected application component that executes inside the TEE and uses its isolation services Correct answer.
  4. A trustlet runs only while the device screen is on and unlocked

Explanation

A trustlet (or trusted application) runs in the secure world and relies on TEE isolation to protect its code and data. Ordinary apps run in the REE and cannot directly access secure-world resources.

Question 8TEE Fundamentals and Threat Modeling

Why do TEE designs generally place the secure world's memory in a region that the REE cannot map or access?

  1. To simplify debugging by giving the REE visibility into secure-world execution
  2. To prevent the untrusted OS from reading or corrupting secure-world code and data Correct answer.
  3. To allow the REE to reclaim secure memory whenever free memory runs low
  4. To reduce the cost of DRAM by sharing pages more efficiently between worlds

Explanation

Memory isolation enforced by hardware (e.g., address-space controllers or memory protection units) is what makes the TEE guarantee credible against a hostile REE. If the REE could map secure pages, confidentiality and integrity would both fail.

Question 9TEE Fundamentals and Threat Modeling

A mobile OS kernel is fully compromised by malware. Under a standard TEE threat model, which outcome should still hold?

  1. The attacker can execute arbitrary code inside the TEE by invoking a legitimate trusted application API
  2. The attacker can neither read nor alter data processed inside the TEE's trusted applications Correct answer.
  3. The attacker can disable attestation and forge a valid signed report for the device
  4. The attacker can read the plaintext of keys held in the secure world but cannot modify them

Explanation

The central claim of a TEE is that even a fully compromised REE kernel cannot disclose or modify protected secure-world state. Interfaces exposed to the REE are mediated and validated, so they do not grant arbitrary execution or forgery.

Question 10TEE Fundamentals and Threat Modeling

An engineer proposes passing a raw pointer from the REE into a trusted application so it can read a large buffer directly. Why is this rejected in a sound TEE design?

  1. The TEE instruction set does not support loading from REE addresses at all
  2. Pointers are slower to dereference than copying through shared memory
  3. The REE could change the buffer contents or mapping after validation, creating a time-of-check to time-of-use attack Correct answer.
  4. Passing pointers would exceed the maximum message size of the TEE mailbox

Explanation

Shared memory is untrusted and mutable, so any validated buffer can be altered concurrently by the REE, a classic TOCTOU hazard. Correct designs copy data into secure memory or use carefully synchronized shared-memory protocols with revalidation.

Question 11TEE Fundamentals and Threat Modeling

A team wants to prove to a cloud service that a key was generated inside the device's TEE and never exported. Which mechanism should they rely on?

  1. A self-signed certificate generated by the REE application at first launch
  2. A timestamp from the device's REE system clock included in the request
  3. A hash of the application binary stored in the REE filesystem
  4. Attestation of a TEE-held key, where the attestation key signs a statement binding the public key to the TEE Correct answer.

Explanation

Attestation binds a public key to the trusted environment using a key that only the TEE can use, which is what gives the relying party confidence about key origin. REE-generated artifacts can be forged by a compromised OS and therefore prove nothing.

Question 12TEE Fundamentals and Threat Modeling

During a design review, an engineer notes that the TEE exposes a command that returns whether a given PIN is correct. Why is this interface a threat-model concern?

  1. It provides an oracle that lets a compromised REE brute-force the PIN without rate limiting inside the TEE Correct answer.
  2. It causes the TEE to allocate memory on the REE heap
  3. It requires the REE to sign the request with a key it does not possess
  4. It leaks the PIN length through the size of the response message

Explanation

Any interface that reveals a yes/no secret comparison becomes an oracle for an attacker who controls the caller, unless the TEE itself enforces attempt limits and lockout. Trusting the REE to throttle attempts is unsound because the REE is untrusted.

Question 13TEE Fundamentals and Threat Modeling

Which statement correctly describes the relationship between secure boot and a TEE?

  1. Secure boot and the TEE are the same mechanism implemented in different processor modes
  2. Secure boot guarantees runtime isolation, so a TEE is unnecessary once it is enabled
  3. Secure boot establishes a verified chain of trust at startup, while the TEE provides runtime isolation for trusted code Correct answer.
  4. The TEE verifies boot firmware signatures on behalf of secure boot at every context switch

Explanation

Secure boot and TEE isolation address different phases and properties: boot-time integrity versus runtime confidentiality and integrity. A complete platform uses both, and neither substitutes for the other.

Question 14TEE Fundamentals and Threat Modeling

A trusted application stores a secret and exposes a command that returns its length. An attacker with REE control calls the command repeatedly with varying inputs and observes response timing. What class of threat is being exercised?

  1. A side-channel attack exploiting an information leak through an observable channel Correct answer.
  2. A rollback attack against the trusted application's version counter
  3. A denial-of-service attack that exhausts secure-world memory
  4. A fault-injection attack on the secure-world power rail

Explanation

Timing and other observable variations that depend on secret data are side channels, and they are a standard entry in TEE threat models because the attacker controls the calling environment. Defenses include constant-time implementation and avoiding secret-dependent branches.

Question 15TEE Fundamentals and Threat Modeling

Which practice best mitigates rollback attacks against a trusted application's persistent state?

  1. Encrypting the state with a key derived from the device's public serial number
  2. Compressing the state before writing it to flash to save space
  3. Binding the state to a monotonic counter maintained in secure hardware or protected storage Correct answer.
  4. Storing the state in the REE filesystem with a checksum appended to each record

Explanation

Rollback protection requires a trusted freshness anchor, such as a hardware monotonic counter, so that restoring older state is detectable. Checksums in untrusted storage can be recomputed by an attacker and therefore do not prevent rollback.

Question 16TEE Fundamentals and Threat Modeling

A trusted application must process a message supplied by an REE client. Which input-handling approach best fits the TEE threat model?

  1. Validate all fields and lengths inside the TEE before use, treating the message as fully attacker-controlled Correct answer.
  2. Assume the message is well formed because it came through the TEE driver
  3. Rely on the REE kernel to sanitize the message before forwarding it to the TEE
  4. Trust the message because the REE client passed a signature check performed in the REE

Explanation

Because the REE and its drivers are untrusted, every message crossing the boundary must be treated as hostile and validated in the secure world. Delegating validation to the REE defeats the purpose of isolation.

Question 17TEE Fundamentals and Threat Modeling

Which scenario is outside the protection scope of a typical TEE threat model?

  1. A remote attacker who exploits a vulnerability in a trusted application's command parser
  2. A physical attacker who decapsulates the chip and probes internal buses Correct answer.
  3. A malicious app running with normal user privileges in the REE
  4. A compromised REE kernel that tampers with driver memory

Explanation

Standard TEE threat models focus on software attackers and assume the hardware is intact; invasive physical probing is handled by separate hardware tamper-resistance measures. A TEE alone is not claimed to resist die-level attacks.

Question 18TEE Fundamentals and Threat Modeling

What is the purpose of a world switch in a TEE architecture?

  1. To swap the contents of the REE kernel with a backup image during updates
  2. To migrate a running application from one device to another over the network
  3. To change the CPU clock frequency when the device enters a low-power state
  4. To transition the processor between the normal world and the secure world with a controlled state save and restore Correct answer.

Explanation

A world switch is the controlled transition between REE and TEE execution, during which register state and memory mappings are switched so that neither world can observe the other's protected state. Its correctness is security-critical because bugs can leak state across worlds.

Question 19TEE Fundamentals and Threat Modeling

A vendor wants to reduce the TEE's attack surface. Which change best aligns with threat-modeling principles?

  1. Moving input parsing into the REE so the TEE receives only pre-parsed structures
  2. Minimizing the number of exposed commands and the amount of trusted code that parses untrusted input Correct answer.
  3. Adding more debugging commands to the secure world so issues can be diagnosed in production
  4. Enabling all optional TEE features by default to avoid configuration complexity

Explanation

A smaller exposed interface and a smaller parsing TCB reduce the number of paths an attacker can reach, consistent with the principle of least privilege and TCB minimization. Moving parsing to the REE does not help because the REE is untrusted.

Question 20TEE Fundamentals and Threat Modeling

An attacker repeatedly powers off a device mid-operation to interrupt a trusted application's state update. Which threat category does this represent?

  1. A cache-eviction attack against the secure world's working set
  2. A man-in-the-middle attack on the attestation channel
  3. A fault or interruption attack targeting the atomicity of persistent state updates Correct answer.
  4. A side-channel attack measuring electromagnetic emissions

Explanation

Inducing interruptions to break multi-step updates is a fault-style attack, and robust trusted applications must make state transitions atomic or journaled so partial updates cannot be exploited. The attacker's goal is often to leave state in an inconsistent or privileged condition.

Question 21TEE Fundamentals and Threat Modeling

Why is an attestation key typically kept inside the TEE rather than in the REE?

  1. Because the REE cannot perform the cryptographic operations required for signing
  2. Because a compromised REE holding the key could forge attestation reports for the device Correct answer.
  3. Because the TEE has more storage capacity than the REE filesystem
  4. Because attestation keys must be rotated on every world switch

Explanation

The value of attestation rests on the signing key being usable only by trusted code; if the REE could access it, an attacker could mint reports for arbitrary claims. Keeping the key in the secure world bounds its use to verified trusted code.

Question 22TEE Fundamentals and Threat Modeling

A design lets the REE choose which trusted application binary is loaded into the secure world at runtime. Why is this a serious weakness?

  1. It forces the TEE to use slower memory for code execution
  2. It increases the size of the REE kernel image beyond flash capacity
  3. It allows a compromised REE to substitute a malicious or vulnerable trusted application, defeating the isolation guarantee Correct answer.
  4. It prevents the TEE from using hardware cryptographic accelerators

Explanation

The set of trusted applications and their integrity must be enforced by the secure world's own boot and loading policy, not by the untrusted REE. Otherwise an attacker controlling the REE can load code that leaks secrets or bypasses policy.

Question 23TEE Fundamentals and Threat Modeling

Consider a TEE that clears general-purpose registers on world exit but leaves floating-point and vector register state untouched. What is the most likely consequence?

  1. Secure-world data may leak into the REE through the uncleared vector register file Correct answer.
  2. The REE will be unable to execute floating-point instructions after the switch
  3. Attestation reports will be rejected because measurements change
  4. The TEE will lose its ability to enforce memory isolation

Explanation

World-switch code must sanitize all architectural state that could carry secrets, including vector and floating-point registers, not just general-purpose ones. Leaving that state intact creates a direct disclosure channel from the secure world to the REE.

Question 24TEE Fundamentals and Threat Modeling

A trusted application implements a PIN check with an early return as soon as a mismatching byte is found. Why does this violate sound TEE practice?

  1. Early return prevents the TEE from using hardware acceleration for comparison
  2. The comparison result cannot be attested if the function returns early
  3. Early return causes the trusted application to exceed its memory quota
  4. The comparison time depends on the position of the first mismatch, leaking information about the correct PIN Correct answer.

Explanation

Byte-by-byte early exit creates a timing side channel that reveals how many leading bytes matched, which an attacker controlling the REE can exploit across many queries. Constant-time comparison avoids secret-dependent branching and timing variation.

Question 25TEE Fundamentals and Threat Modeling

An attacker with REE kernel control modifies the shared-memory buffer after the TEE validates it but before the TEE reads it. Which defense most directly addresses this?

  1. Asking the REE to lock the buffer against modification during the call
  2. Encrypting the buffer with a key the REE also holds
  3. Increasing the size of the shared buffer so races are less likely
  4. Copying the data into secure memory in a single validated step, or revalidating with a synchronization protocol that detects modification Correct answer.

Explanation

The race is a time-of-check to time-of-use problem, and the robust fixes are to move data into secure memory atomically or to use a protocol that detects concurrent modification. Trusting the REE to lock or protect the buffer is unsound because the REE is the attacker.

Question 26TEE Fundamentals and Threat Modeling

In a typical TEE threat model, what is the primary security boundary that the TEE is designed to enforce?

  1. Isolation of trusted code and data from a compromised rich execution environment, including its kernel and privileged software Correct answer.
  2. Isolation of the boot firmware from physical attackers who can probe the memory bus
  3. Isolation of user-mode processes from each other within a single rich-OS user account
  4. Isolation of one network tenant's traffic from another tenant's traffic at the hypervisor layer

Explanation

The defining assumption of a TEE is that the rich execution environment, up to and including its kernel and hypervisor, may be fully compromised, so the TEE must protect trusted assets from that software. Physical bus probing and network multi-tenancy are handled by other mechanisms and lie outside the standard TEE boundary.

Question 27TEE Fundamentals and Threat Modeling

A trusted application receives a serialized request from an REE client through shared memory and must decide how to consume it safely. Which approach is most consistent with TEE threat modeling?

  1. Have the REE client pre-validate the message so the trusted application can skip its own checks
  2. Copy the message into TEE-private memory, validate its structure and bounds, then parse only the private copy Correct answer.
  3. Parse the message in place inside the shared buffer and trust the length field supplied by the client
  4. Map the shared buffer as writable in the secure world so the trusted application can fix malformed fields

Explanation

Shared memory is attacker-controlled in the TEE threat model, so the trusted application must treat it as untrusted input: copy it into private memory, validate lengths and structure, and parse the private snapshot to avoid time-of-check-to-time-of-use races. Relying on the client for validation inverts the trust relationship.

Question 28TEE Fundamentals and Threat Modeling

A TEE design keeps the secure world's code and data in the same physical DRAM region as the REE but relies on the rich-OS page tables to mark those pages inaccessible. Why is this design weaker than one backed by a memory-protection unit or address-space controller?

  1. It forces every trusted application to run at a lower privilege level than the REE kernel, which removes access to cryptographic instructions
  2. It requires the secure world to be re-entered on every interrupt, which leaks timing information about trusted execution
  3. A compromised REE kernel can reprogram the page tables to map the secure pages, so isolation rests on software that the threat model already assumes is compromisable Correct answer.
  4. It prevents the TEE from using cache-coherent DMA, which makes attestation impossible to implement correctly

Explanation

If isolation depends on page tables owned by the REE kernel, then an attacker who controls that kernel can simply remap the secure pages, which the threat model explicitly assumes. Hardware-enforced memory partitioning keeps the secure region unmapable by REE software regardless of page-table state.

Question 29TEE Architectures and Platform Isolation

In a TEE design, what is the security boundary that separates the trusted execution environment from the rich operating system running on the same processor?

  1. The system call table, which is enforced by the kernel scheduler
  2. The page cache, which is enforced by the file system
  3. The network firewall, which is enforced by the hypervisor
  4. The trust boundary, which is enforced by hardware isolation mechanisms Correct answer.

Explanation

A TEE relies on a hardware-enforced trust boundary that partitions the processor into a trusted world and a normal world. All transitions across that boundary are mediated by privileged firmware or hardware, so the rich OS cannot directly read or write TEE state.

Question 30TEE Architectures and Platform Isolation

Which statement best describes the purpose of a Trusted Execution Environment in a mobile system-on-chip?

  1. It manages thermal throttling for the CPU clusters
  2. It accelerates graphics rendering for the display pipeline
  3. It provides an isolated execution context for sensitive code and data alongside the rich OS Correct answer.
  4. It replaces the bootloader during the manufacturing process

Explanation

A TEE provides an isolated processing environment whose confidentiality and integrity are protected from the normal world, even though it shares the CPU. Sensitive operations such as key handling and secure payments run there.

Question 31TEE Architectures and Platform Isolation

In ARM TrustZone, into which two worlds does the processor split execution?

  1. Secure world and non-secure world Correct answer.
  2. Kernel space and user space
  3. Physical address space and virtual address space
  4. Hypervisor mode and guest mode

Explanation

TrustZone divides the processor into a secure world and a non-secure world, with a hardware signal controlling access to secure resources. The secure world hosts the trusted OS while the non-secure world runs the rich OS.

Question 32TEE Architectures and Platform Isolation

What is the role of the secure monitor in an ARM TrustZone platform?

  1. It provides the file system for the rich OS
  2. It compiles trusted applications at build time
  3. It encrypts DRAM traffic transparently
  4. It handles transitions between the secure and non-secure worlds Correct answer.

Explanation

The secure monitor runs at the highest privilege level and is responsible for saving and restoring context when execution switches between worlds. It is the only code allowed to perform that world switch.

Question 33TEE Architectures and Platform Isolation

What does the NS bit control in an ARM TrustZone system?

  1. The number of CPU cores that may enter the secure world
  2. The security state of memory accesses and the resulting access permissions Correct answer.
  3. The size of the translation lookaside buffer
  4. The frequency at which the secure timer fires

Explanation

The NS bit is propagated with memory transactions and determines whether the access is treated as secure or non-secure. The TrustZone address space controller uses it to permit or deny access to protected memory regions.

Question 34TEE Architectures and Platform Isolation

How does Intel SGX protect the memory of an enclave from the operating system?

  1. By encrypting enclave pages with keys held inside the CPU Correct answer.
  2. By running the OS inside the same enclave
  3. By marking the pages read-only in the OS page tables
  4. By relying on the hypervisor to hide the pages from the OS

Explanation

SGX encrypts enclave pages in DRAM and keeps the decryption keys within the processor package. The OS still manages the page tables but cannot read enclave plaintext, giving confidentiality against a malicious OS.

Question 35TEE Architectures and Platform Isolation

What is an enclave measurement in Intel SGX?

  1. A runtime counter of instructions executed inside the enclave
  2. A random nonce generated for each enclave launch
  3. A cryptographic hash that identifies the enclave's initial code and data Correct answer.
  4. A timestamp recorded when the enclave is created

Explanation

The measurement is a hash over the enclave's initial contents, computed during loading. Remote parties verify it through attestation to confirm which code is running before releasing secrets.

Question 36TEE Architectures and Platform Isolation

Which component of a confidential computing platform performs remote attestation of a TEE?

  1. The cloud tenant's application binary
  2. The guest driver inside the protected virtual machine
  3. The hardware root of trust together with the attestation service Correct answer.
  4. The hypervisor's network stack

Explanation

Attestation relies on a hardware root of trust that signs evidence about the TEE's identity and configuration. A relying party verifies that evidence, often with the aid of an attestation service that checks certificate chains and revocation.

Question 37TEE Architectures and Platform Isolation

An engineer is choosing between a TEE based on a separate secure processor and one based on partitioning the main CPU. Which trade-off primarily motivates the partitioned-CPU design?

  1. It guarantees higher cryptographic throughput than a dedicated security core
  2. It removes the need for any secure boot chain
  3. It avoids the cost of a dedicated core while still isolating security-sensitive code Correct answer.
  4. It eliminates the trust boundary between worlds

Explanation

Partitioning the main CPU reuses existing silicon for trusted code, lowering area and cost compared with a separate secure processor. The trade-off is that the TEE shares microarchitectural resources with the rich OS, which enlarges the attack surface.

Question 38TEE Architectures and Platform Isolation

A trusted OS running in the secure world receives a call from a non-secure application. What must the platform verify before servicing the request?

  1. That the caller's identity and parameters conform to the defined secure service interface Correct answer.
  2. That the caller's network connection is encrypted
  3. That the caller's binary was signed by the device vendor
  4. That the caller's process has the highest scheduling priority

Explanation

The secure world must treat all non-secure input as untrusted and validate identity and parameters at the interface. Without such validation, a malicious rich-OS caller could drive the trusted service into unsafe states.

Question 39TEE Architectures and Platform Isolation

Why does a TEE typically maintain its own memory carve-out rather than allocating pages from the rich OS on demand?

  1. Because static memory uses less DRAM bandwidth than dynamic allocation
  2. Because the rich OS allocator is slower than a static carve-out
  3. Because the TEE cannot address memory outside the carve-out
  4. Because the rich OS cannot be trusted to preserve the confidentiality and integrity of TEE pages Correct answer.

Explanation

If the rich OS controlled allocation, it could reclaim, remap, or alias TEE pages and thereby violate isolation. A protected carve-out enforced by hardware prevents the normal world from accessing that region.

Question 40TEE Architectures and Platform Isolation

A confidential virtual machine runs under a hypervisor that is assumed to be untrusted. Which mechanism keeps the hypervisor from reading guest memory?

  1. Guest page-table permissions set by the guest kernel
  2. Hypervisor-level access control lists on guest RAM
  3. Hardware memory encryption with keys inaccessible to the hypervisor Correct answer.
  4. Periodic scrubbing of guest memory by the guest

Explanation

Confidential VMs depend on hardware memory encryption whose keys are managed by the security processor and never exposed to the hypervisor. The hypervisor retains control of scheduling and page tables but sees only ciphertext.

Question 41TEE Architectures and Platform Isolation

What security property does sealing provide to data produced inside an enclave?

  1. It binds the data to a specific enclave identity so only that enclave can unseal it Correct answer.
  2. It compresses the data to reduce storage cost
  3. It replicates the data across multiple enclaves for availability
  4. It publishes the data to a public ledger for auditability

Explanation

Sealing encrypts data with a key derived from the enclave's identity and the platform, so it can be persisted and later recovered only by an enclave with the matching identity. This lets enclaves store secrets outside their protected memory safely.

Question 42TEE Architectures and Platform Isolation

In a TrustZone system, a DMA-capable peripheral is programmed by the non-secure OS. Why must the platform restrict that peripheral's access to secure memory?

  1. Because secure memory is mapped only in the secure MMU
  2. Because the peripheral could otherwise read or overwrite secure memory without CPU involvement Correct answer.
  3. Because peripherals cannot generate interrupts in the secure world
  4. Because DMA transfers are always slower than CPU copies

Explanation

A bus master can access memory independently of the CPU, so without restrictions a compromised driver could direct the device to exfiltrate or corrupt secure data. A TrustZone-aware memory controller or SMMU enforces the security state on those transactions.

Question 43TEE Architectures and Platform Isolation

What is the primary function of a device attestation report in a confidential computing deployment?

  1. To measure the network latency between tenant and host
  2. To log every system call made by the guest
  3. To describe the hardware model and firmware version to the user interface
  4. To provide signed evidence about the TEE and its configuration for a relying party to verify Correct answer.

Explanation

An attestation report contains signed claims about the platform and the TEE, such as measurements and security configuration. The relying party checks the signature and the claims before provisioning secrets.

Question 44TEE Architectures and Platform Isolation

A developer enables a debug interface on a production TEE to simplify troubleshooting. What is the main security consequence?

  1. It disables memory encryption for the entire platform
  2. It increases the enclave measurement value, weakening attestation
  3. It prevents the secure monitor from switching worlds
  4. It creates a path for privileged parties to inspect or modify trusted state, undermining isolation Correct answer.

Explanation

Debug access bypasses the protections that isolate the TEE, letting an operator or attacker read secrets and alter trusted code. Production attestation policies therefore require debug to be disabled and reported as such.

Question 45TEE Architectures and Platform Isolation

Which statement correctly distinguishes a TEE from a full virtual machine in terms of isolation granularity?

  1. A TEE isolates at the level of a process or application, while a VM isolates an entire guest operating system Correct answer.
  2. A TEE provides no isolation and relies entirely on the VM
  3. Both isolate only individual processes and differ solely in performance
  4. A TEE isolates an entire guest OS, while a VM isolates only a single process

Explanation

A TEE such as an SGX enclave protects a user-level application, whereas a confidential VM protects a whole guest OS and its workloads. The choice depends on whether the tenant needs to protect an application or an entire software stack.

Question 46TEE Architectures and Platform Isolation

An attestation verifier receives a quote signed by a hardware key but finds the quote's measurement does not match the expected enclave. What should the verifier do?

  1. Request the enclave to re-sign the quote with its own key
  2. Accept the quote because the hardware signature is valid
  3. Ignore the measurement and check only the firmware version
  4. Reject the quote and refuse to release secrets to the enclave Correct answer.

Explanation

A valid hardware signature proves the quote came from genuine hardware, but the measurement binds it to specific code. A mismatch means the running code is not the expected code, so secrets must not be released.

Question 47TEE Architectures and Platform Isolation

Why do side-channel attacks such as cache timing remain a concern for TEEs even when memory encryption is in place?

  1. Because attestation reports include cache contents
  2. Because shared microarchitectural resources leak information about trusted execution Correct answer.
  3. Because encryption keys are stored in plaintext in DRAM
  4. Because the secure monitor logs all cache accesses to the rich OS

Explanation

Encryption protects data at rest in DRAM but does not stop timing or contention effects on shared caches, branch predictors, and other structures. An attacker in the normal world can observe these effects to infer secrets.

Question 48TEE Architectures and Platform Isolation

A platform implements a TEE that shares the last-level cache with the normal world. Which mitigation most directly reduces cross-world cache contention leakage?

  1. Disabling remote attestation for the enclave
  2. Partitioning or way-locking cache resources between worlds Correct answer.
  3. Increasing the enclave measurement size
  4. Reducing the number of attestation quotes per boot

Explanation

Cache partitioning or way-locking assigns distinct cache resources to each world so that one domain cannot observe the other's eviction patterns. This directly limits the shared-state channel that enables contention-based leakage.

Question 49TEE Architectures and Platform Isolation

In a design where the secure monitor saves and restores world context on every switch, what is the main performance and security consideration?

  1. The monitor must disable interrupts permanently to remain secure
  2. The switch cost is constant regardless of state, and leakage is impossible
  3. The monitor must run in the non-secure world to reduce latency
  4. The switch cost grows with the amount of state saved, and any state left unsaved may leak between worlds Correct answer.

Explanation

Each world switch must save and restore registers and other state, so the cost scales with the state set. Incomplete save or restore can leave trusted data visible to the normal world or corrupt the trusted context.

Question 50TEE Architectures and Platform Isolation

A confidential VM's hypervisor is malicious and attempts to replay an old encrypted memory page containing stale but valid ciphertext. Which property of the TEE memory design is intended to detect this?

  1. Compression of the page before encryption
  2. Confidentiality of the page contents
  3. Caching of the page in the last-level cache
  4. Integrity protection that binds ciphertext to its address and version Correct answer.

Explanation

Confidential VMs use integrity mechanisms that bind each ciphertext block to its physical address and a version counter, so moving or replaying an old block is detected. Confidentiality alone would not reveal that the data is stale.