Exam SY0-501 topic 1 question 770 discussion

I think it's C. HROT is used in crypto/secure boot. UEFI is BIOS. TPM is also crypto and part of HROT. It's obviously not Crypto-malware or ARP poisoning.

C. Supply chain...This question is tricky, it's about supplying, they bought the PCs from unrecognized vendor that was much cheaper than the others two.The NIC (Network interface card) are tampered.

From Professor Messer's Notes: Supply chain • September 2015: Hundreds of Cisco routers infected with “SYNful Knock” • Firmware modified for back-door access • Can you trust your new server/router/switch/firewall? • Supply chain cyber security • Use trusted vendors • Critical devices should not be connected to the outside • Verify your hardware is genuine

government doesn't manufacture PC, so it is not hardware root of trust.

SUPPLY CHAIN A supply chain is the end-to-end process of supplying, manufacturing, distributing, and finally releasing goods and services to a customer. For the TPM to be trustworthy, the supply chain of chip manufacturers, firmware authors, OEM resellers, and administrative staff responsible for provisioning the computing device to the end user must all be trustworthy. Anyone with the time and resources to modify the computer's firmware could (in theory) create some sort of backdoor access. It is also critical that no one learn the endorsement key programmed into each TPM. Anyone obtaining the endorsement key will be able to impersonate that TPM.

I believe the answer is C. Without assuming anything, the tampered NIC represents a serious vulnerability as this component connects the computer to a computer network. It also has to do with secure systems design. Cheaper does not always mean better. From Darril Gibson's book: "There have been many incidents where new computers were shipped with malware. As an example, Microsoft researchers purchased several new computers in China and found them infected with the Nitol virus. These computers were also running counterfeit versions of Windows. This helps illustrate the importance of purchasing computers from reputable sources."

It's A.

I think A. Hardware root of trust is the right answer