Disclaimer:
Educational Use Only:
The website links provided are to be used strictly for educational and knowledge-gaining purposes only.
No Misuse:
Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.
Respect for Websites and Businesses:
Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.
Acknowledge Value of Knowledge:
Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.
No Endorsement:
The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.
User Responsibility:
By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.
- Which statement best describes “custom firmware” in cybersecurity contexts?
a. A user-mode application that secures browsers
b. A vendor-signed kernel module only for Linux
c. Platform/device firmware tailored or modified beyond the OEM default
d. A cloud-only security policy
Answer: c. (NIST Publications) - Why are firmware attacks particularly dangerous?
a. They are always noisy and easy to detect
b. They target low-privilege code after OS boot
c. They can persist below the OS and evade host defenses
d. They only affect graphics drivers
Answer: c. (MITRE ATT&CK) - Which NIST publication focuses on platform firmware resiliency (detect, protect, recover)?
a. SP 800-171
b. SP 800-193
c. SP 800-30
d. SP 800-61
Answer: b. (NIST Publications) - UEFI Secure Boot’s core promise is to:
a. Prevent any kernel updates
b. Ensure only authorized code runs before the OS
c. Disable all third-party hardware drivers
d. Encrypt all boot components by default
Answer: b. (uefi.org) - Which MITRE ATT&CK sub-technique explicitly covers adversary modification of system firmware for persistence?
a. T1059.003
b. T1542.001 System Firmware
c. T1204.002
d. T1027.002
Answer: b. (MITRE ATT&CK) - Intel Boot Guard primarily verifies:
a. The OS kernel signature only
b. The Initial Boot Block (IBB) at reset
c. User-space antivirus
d. Network boot PXE images only
Answer: b. (Eclypsium) - Which guideline emphasizes authenticated BIOS updates, integrity protection, and non-bypassability on PCs?
a. NIST SP 800-53
b. NIST SP 800-147
c. NIST SP 800-61
d. NIST SP 800-115
Answer: b. (NIST Computer Security Resource Center) - The TPM’s role in measured boot is to:
a. Replace NVIDIA GPU firmware
b. Store and report cryptographic measurements of boot components
c. Render the desktop login screen
d. Patch SMM handlers
Answer: b. (Microsoft Learn) - A custom firmware project aimed at replacing proprietary BIOS/UEFI with open-source code is:
a. BitLocker
b. coreboot
c. SELinux
d. PXE
Answer: b. (coreboot.org) - The first UEFI rootkit seen “in the wild,” disclosed in 2018, was:
a. StuxEFI
b. DarkBIOS
c. LoJax
d. KrakenBoot
Answer: c. (web-assets.esetstatic.com) - In NIST SP 800-193, firmware resiliency includes which three phases?
a. Detect, prevent, obfuscate
b. Identify, quarantine, erase
c. Detect, protect, recover
d. Alert, sandbox, shutdown
Answer: c. (NIST Publications) - Which register/bit configuration is key to blocking unauthorized SPI flash writes outside SMM on many Intel platforms?
a. CR3.PWT
b. BIOS_CNTL with SMM_BWP/EISS
c. EFLAGS.ZF
d. APIC.TPR
Answer: b. (Eclypsium) - The purpose of rollback (anti-rollback) protection in firmware updates is to:
a. Speed up boot times
b. Prevent downgrades to vulnerable versions
c. Enable dual-boot
d. Remove Secure Boot keys
Answer: b. (NIST Publications) - Which standard extends BIOS protection guidelines specifically to servers?
a. SP 800-147B
b. SP 800-63B
c. SP 800-92
d. SP 800-38A
Answer: a. (NIST Computer Security Resource Center) - In Secure Boot, trust is anchored by:
a. Random MAC addresses
b. UEFI key databases (PK/KEK/db) and signatures
c. Browser certificates
d. DHCP options
Answer: b. (uefi.org) - Measured boot differs from Secure Boot by:
a. Encrypting all firmware
b. Sending boot logs to the GPU
c. Recording measurements in TPM for attestation
d. Disabling USB during POST
Answer: c. (Microsoft Learn) - Which open-source project aims to be a silicon root of trust that enforces secure boot at the hardware level?
a. OpenSSL
b. OpenTitan
c. LibreOffice
d. WireGuard
Answer: b. (OpenTitan) - A custom firmware supply-chain risk mitigation recommended by NIST SP 800-193 is to:
a. Ignore update provenance
b. Use authenticated, integrity-protected update mechanisms
c. Prefer unsigned recovery images
d. Disable recovery entirely
Answer: b. (NIST Publications) - MITRE ATT&CK notes that firmware-level persistence is hard to detect because:
a. It runs in the browser sandbox
b. It lives below the OS where host defenses may not see it
c. It only uses JavaScript
d. It is prevented by DHCP
Answer: b. (center-for-threat-informed-defense.github.io) - An example of runtime privileged mode often abused via vulnerable handlers in firmware is:
a. User Mode (Ring 3)
b. SMM (System Management Mode)
c. VMX root mode only for GPUs
d. Hyper-V user partition
Answer: b. (Tom’s Hardware) - A key design goal of coreboot relevant to security is:
a. Rendering 3D UEFI menus
b. Minimal initialization with fast, auditable code path
c. Bundling proprietary antivirus
d. Disabling TPM permanently
Answer: b. (coreboot.org) - LoJax persistence leveraged weaknesses in:
a. GPU shader caching
b. SPI flash write protections / misconfiguration
c. Printer firmware only
d. Bluetooth stacks
Answer: b. (web-assets.esetstatic.com) - NIST SP 800-147 recommends what for BIOS updates?
a. Anonymous unsigned updates
b. Digital signature verification of updates
c. Only manual hex patching
d. Disabling updates
Answer: b. (NIST Computer Security Resource Center) - An example of a hardware feature that verifies early firmware blocks at reset is:
a. PXE Boot
b. Intel Boot Guard
c. SMBIOS tables
d. ACPI S3 resume
Answer: b. (Eclypsium) - A practical defense against “Speed Racer”-style SPI write races is enabling:
a. BIOS_CNTL.BLE only
b. SMM_BWP/EISS so writes require SMM
c. Disabling ACPI
d. Clearing CMOS on every boot
Answer: b. (Eclypsium) - In UEFI, which database holds allowed executable signatures?
a. dbx
b. db
c. crl
d. arp
Answer: b. (uefi.org) - Which publication introduced BIOS integrity measurement/reporting concepts (now historically referenced)?
a. SP 800-155 (draft/obsolete)
b. SP 800-207
c. SP 800-61r2
d. SP 800-63C
Answer: a. (NIST Computer Security Resource Center) - Remote attestation can validate Secure Boot state by:
a. Reading GPU temps
b. Verifying measured secure variables via TPM logs
c. Pinging DHCP servers
d. Checking browser cookies
Answer: b. (Microsoft Learn) - Platform Firmware Resiliency (PFR) solutions for servers typically:
a. Use a hardware root to detect, protect, recover firmware
b. Disable all PCIe devices
c. Replace OS updates with BIOS edits
d. Remove TPM entirely
Answer: a. (latticesemi.com) - A common objective of adversaries modifying custom firmware is to:
a. Improve battery life
b. Establish stealthy persistence pre-OS
c. Increase fan speed
d. Reset BIOS passwords for convenience
Answer: b. (MITRE ATT&CK) - In measured boot, which component typically verifies integrity using the measurement log?
a. The mouse firmware
b. A remote verifier or local security service
c. The wallpaper manager
d. The GPU driver
Answer: b. (Microsoft Learn) - Heads firmware (often with coreboot) focuses on:
a. Overclocking CPUs
b. Tamper-evident boot using TPM-sealed secrets and user keys
c. Disabling all USB ports
d. Running UEFI shell scripts only
Answer: b. (Heads – Wiki) - A modern news example highlighting Secure Boot key management risk is:
a. BIOS passwords expired
b. Microsoft’s older Secure Boot signing key expiry impacting Linux shims without firmware updates
c. HTTPS CA key pinning removed
d. DNSSEC key rollover failure
Answer: b. (Tom’s Hardware) - Which of the following best characterizes SMM vulnerabilities?
a. They are harmless user-space bugs
b. Flaws in SMI handlers can allow code execution with high privilege
c. Only affect ARM devices
d. Are mitigated by browser updates
Answer: b. (Tom’s Hardware) - A core security requirement for custom firmware updates in servers per NIST SP 800-147B is:
a. Require VGA output
b. Authenticated update process with signatures
c. Only network-boot updates
d. No audit logging
Answer: b. (NIST Publications) - MITRE ATT&CK T1542 (Pre-OS Boot) highlights that adversaries may:
a. Modify firmware/boot drivers to persist below the OS
b. Only deploy browser extensions
c. Require physical JTAG always
d. Use ARP poisoning only
Answer: a. (MITRE ATT&CK) - Which open project positions itself as a vendor-agnostic open silicon Root of Trust?
a. TianoCore EDK2
b. OpenTitan
c. GRUB Legacy
d. SeaBIOS
Answer: b. (OpenTitan) - A best practice when deploying custom firmware per NIST SP 800-193 is to ensure:
a. Recovery images are unsigned for speed
b. Recovery can restore trusted, known-good firmware
c. Recovery wipes the TPM owner password
d. Recovery uses telnet only
Answer: b. (NIST Publications) - Which database in UEFI contains disallowed signatures (revocation list)?
a. db
b. PK
c. KEK
d. dbx
Answer: d. (uefi.org) - The LoJax case study primarily demonstrates that attackers can:
a. Only patch GPU vBIOS
b. Install persistent UEFI modules if SPI protections are weak
c. Downgrade Wi-Fi firmware only
d. Abuse DHCP to rewrite BIOS
Answer: b. (web-assets.esetstatic.com) - Microsoft documentation notes measured boot can:
a. Replace ACPI tables
b. Provide a trusted log of boot components for verification
c. Disable Secure Boot
d. Remove TPM NV storage
Answer: b. (Microsoft Learn) - The Intel BIOS write-protection race (“Speed Racer”) is mitigated by:
a. Turning off CPU C-states
b. Setting SMM_BWP/EISS so only SMM code can write
c. Removing Option ROMs
d. Disabling IOMMU
Answer: b. (Eclypsium) - A practical risk with custom firmware on consumer boards surfaced in 2025 was:
a. Universal UEFI removal by vendors
b. Critical SMM flaws on some Gigabyte boards enabling Secure Boot bypass/backdoors
c. Mandatory TPM removal from laptops
d. GPU vendors blocking vbios updates
Answer: b. (Tom’s Hardware) - Which NIST document is the primary reference for BIOS protection on client PCs?
a. SP 800-53B
b. SP 800-147
c. SP 800-207
d. SP 800-184
Answer: b. (NIST) - In Secure Boot, the Platform Key (PK) is used to:
a. Select RAM timings
b. Establish platform ownership and authorize changes to KEK/db
c. Configure GPU power states
d. Manage DHCP leases
Answer: b. (uefi.org) - Which description fits OpenTitan Secure Boot?
a. Allows any unsigned BL0 if CRC passes
b. Guarantees only code signed by creator/owner executes before owner’s code
c. Requires disabling lifecycle states
d. Uses BIOS passwords only
Answer: b. (OpenTitan) - A common goal for custom firmware hardening on PCs is to:
a. Enable legacy CSM always
b. Lock SPI controller and require SMM for writes
c. Disable TPM PCRs
d. Force MBR boot on GPT disks
Answer: b. (Eclypsium) - According to ATT&CK, firmware modification can serve which tactics?
a. Initial Access only
b. Persistence and Defense Evasion
c. Collection only
d. Exfiltration only
Answer: b. (MITRE ATT&CK) - coreboot’s security position emphasizes:
a. Proprietary blobs for secrecy only
b. Auditability and control via open source with fast, minimal init
c. Replacing TPM with software HSM
d. Shipping unsigned Option ROMs by default
Answer: b. (coreboot.org) - A modern operational consideration with Secure Boot keying highlighted in 2025 is:
a. Keys never change and don’t expire
b. Key expirations can require firmware db/KEK updates to keep OS boot shims working
c. Keys are managed by the GPU driver
d. Revocations don’t affect Linux
Answer: b. (Tom’s Hardware)
