Which statement best describes secure boot's function?

• A. Measured boot records measurements in PCRs.
• B. TA verifies boot integrity using measurements.
• C. It blocks all firmware execution.
• D. Secure boot validates firmware signatures.

Answer: (D)

Secure boot creates a trust chain by checking that each boot component is signed with a trusted key before it runs. The firmware verifies the signature of the next piece in the boot sequence (like the bootloader) against keys stored in hardware, and only if the signature is valid does control pass to it. This prevents tampered or unsigned software from executing during startup, ensuring the system starts from a known-good state. That’s why describing secure boot as validating firmware signatures best captures its function.

Measuring boot and recording measurements in PCRs relate to another approach focused on attestation rather than the direct act of boot-time validation. The idea that it blocks all firmware isn’t accurate—it blocks untrusted or unsigned firmware, while trusted, signed code is allowed to run.