Bootloaders, OTA & Security interview questions

1. A.AES shares one secret key and is fast for bulk data; RSA and ECC use key pairs for signatures and key exchange, with ECC P-256 matching RSA-3072 strength
2. B.small first program in reserved flash that validates and jumps to the application, and can replace it over a serial, USB or wireless link
3. C.hardware split of memory and peripherals into secure and non-secure worlds on Cortex-M23 and M33 via the SAU, isolating keys and secure services from the application
4. D.sequence from immutable boot ROM through bootloader to application and OS in which each link is verified or measured by the previous one

Answer + AI explanation with Pro

1. A.Bootloader
2. B.TrustZone for Cortex-M
3. C.Chain of trust
4. D.Symmetric versus asymmetric crypto

Answer + AI explanation with Pro

1. A.Bootloader — sequence from immutable boot ROM through bootloader to application and OS in which each link is verified or measured by the previous one
2. B.Bootloader — two application slots so an update is written to the inactive slot and swapped only after validation, letting the device fall back if the new image fails
3. C.Bootloader — each stage verifies the digital signature of the next against a key anchored in ROM or OTP before executing it, so only authorised firmware ever runs
4. D.Bootloader — small first program in reserved flash that validates and jumps to the application, and can replace it over a serial, USB or wireless link

Answer + AI explanation with Pro

1. A.each stage verifies the digital signature of the next against a key anchored in ROM or OTP before executing it, so only authorised firmware ever runs
2. B.small first program in reserved flash that validates and jumps to the application, and can replace it over a serial, USB or wireless link
3. C.hardware split of memory and peripherals into secure and non-secure worlds on Cortex-M23 and M33 via the SAU, isolating keys and secure services from the application
4. D.AES shares one secret key and is fast for bulk data; RSA and ECC use key pairs for signatures and key exchange, with ECC P-256 matching RSA-3072 strength

Answer + AI explanation with Pro

1. A.Secure boot
2. B.Anti-rollback
3. C.Secure element
4. D.TrustZone for Cortex-M

Answer + AI explanation with Pro

1. A.Secure boot — small first program in reserved flash that validates and jumps to the application, and can replace it over a serial, USB or wireless link
2. B.Secure boot — each stage verifies the digital signature of the next against a key anchored in ROM or OTP before executing it, so only authorised firmware ever runs
3. C.Secure boot — sequence from immutable boot ROM through bootloader to application and OS in which each link is verified or measured by the previous one
4. D.Secure boot — tamper-resistant chip such as ATECC608 or SE050 that stores keys and performs cryptography so private keys never leave the hardware

Answer + AI explanation with Pro

1. A.sequence from immutable boot ROM through bootloader to application and OS in which each link is verified or measured by the previous one
2. B.each stage verifies the digital signature of the next against a key anchored in ROM or OTP before executing it, so only authorised firmware ever runs
3. C.hardware split of memory and peripherals into secure and non-secure worlds on Cortex-M23 and M33 via the SAU, isolating keys and secure services from the application
4. D.tamper-resistant chip such as ATECC608 or SE050 that stores keys and performs cryptography so private keys never leave the hardware

Answer + AI explanation with Pro

1. A.Chain of trust
2. B.Secure element
3. C.TrustZone for Cortex-M
4. D.A/B partitions

Answer + AI explanation with Pro

1. A.Chain of trust — sequence from immutable boot ROM through bootloader to application and OS in which each link is verified or measured by the previous one
2. B.Chain of trust — each stage verifies the digital signature of the next against a key anchored in ROM or OTP before executing it, so only authorised firmware ever runs
3. C.Chain of trust — AES shares one secret key and is fast for bulk data; RSA and ECC use key pairs for signatures and key exchange, with ECC P-256 matching RSA-3072 strength
4. D.Chain of trust — monotonic version counter kept in OTP or secure storage so an attacker cannot reinstall an older signed image with known vulnerabilities

Answer + AI explanation with Pro

1. A.hardware split of memory and peripherals into secure and non-secure worlds on Cortex-M23 and M33 via the SAU, isolating keys and secure services from the application
2. B.hashing the image with SHA-256 and signing with a private ECDSA or RSA key at build time, with the public key embedded in the bootloader for verification
3. C.small first program in reserved flash that validates and jumps to the application, and can replace it over a serial, USB or wireless link
4. D.two application slots so an update is written to the inactive slot and swapped only after validation, letting the device fall back if the new image fails

Answer + AI explanation with Pro

1. A.TrustZone for Cortex-M
2. B.A/B partitions
3. C.Secure element
4. D.Firmware signing

Answer + AI explanation with Pro

1. A.Firmware signing — each stage verifies the digital signature of the next against a key anchored in ROM or OTP before executing it, so only authorised firmware ever runs
2. B.Firmware signing — hashing the image with SHA-256 and signing with a private ECDSA or RSA key at build time, with the public key embedded in the bootloader for verification
3. C.Firmware signing — AES shares one secret key and is fast for bulk data; RSA and ECC use key pairs for signatures and key exchange, with ECC P-256 matching RSA-3072 strength
4. D.Firmware signing — hardware split of memory and peripherals into secure and non-secure worlds on Cortex-M23 and M33 via the SAU, isolating keys and secure services from the application

Answer + AI explanation with Pro

1. A.hashing the image with SHA-256 and signing with a private ECDSA or RSA key at build time, with the public key embedded in the bootloader for verification
2. B.two application slots so an update is written to the inactive slot and swapped only after validation, letting the device fall back if the new image fails
3. C.monotonic version counter kept in OTP or secure storage so an attacker cannot reinstall an older signed image with known vulnerabilities
4. D.tamper-resistant chip such as ATECC608 or SE050 that stores keys and performs cryptography so private keys never leave the hardware

Answer + AI explanation with Pro

1. A.TrustZone for Cortex-M
2. B.Secure boot
3. C.Bootloader
4. D.A/B partitions

Answer + AI explanation with Pro

1. A.A/B partitions — sequence from immutable boot ROM through bootloader to application and OS in which each link is verified or measured by the previous one
2. B.A/B partitions — small first program in reserved flash that validates and jumps to the application, and can replace it over a serial, USB or wireless link
3. C.A/B partitions — two application slots so an update is written to the inactive slot and swapped only after validation, letting the device fall back if the new image fails
4. D.A/B partitions — monotonic version counter kept in OTP or secure storage so an attacker cannot reinstall an older signed image with known vulnerabilities

Answer + AI explanation with Pro

1. A.hardware split of memory and peripherals into secure and non-secure worlds on Cortex-M23 and M33 via the SAU, isolating keys and secure services from the application
2. B.hashing the image with SHA-256 and signing with a private ECDSA or RSA key at build time, with the public key embedded in the bootloader for verification
3. C.tamper-resistant chip such as ATECC608 or SE050 that stores keys and performs cryptography so private keys never leave the hardware
4. D.AES shares one secret key and is fast for bulk data; RSA and ECC use key pairs for signatures and key exchange, with ECC P-256 matching RSA-3072 strength

Answer + AI explanation with Pro

1. A.TrustZone for Cortex-M
2. B.A/B partitions
3. C.Secure boot
4. D.Symmetric versus asymmetric crypto

Answer + AI explanation with Pro

1. A.TrustZone for Cortex-M — each stage verifies the digital signature of the next against a key anchored in ROM or OTP before executing it, so only authorised firmware ever runs
2. B.TrustZone for Cortex-M — two application slots so an update is written to the inactive slot and swapped only after validation, letting the device fall back if the new image fails
3. C.TrustZone for Cortex-M — AES shares one secret key and is fast for bulk data; RSA and ECC use key pairs for signatures and key exchange, with ECC P-256 matching RSA-3072 strength
4. D.TrustZone for Cortex-M — hardware split of memory and peripherals into secure and non-secure worlds on Cortex-M23 and M33 via the SAU, isolating keys and secure services from the application

Answer + AI explanation with Pro

1. A.sequence from immutable boot ROM through bootloader to application and OS in which each link is verified or measured by the previous one
2. B.tamper-resistant chip such as ATECC608 or SE050 that stores keys and performs cryptography so private keys never leave the hardware
3. C.hardware split of memory and peripherals into secure and non-secure worlds on Cortex-M23 and M33 via the SAU, isolating keys and secure services from the application
4. D.hashing the image with SHA-256 and signing with a private ECDSA or RSA key at build time, with the public key embedded in the bootloader for verification

Answer + AI explanation with Pro

1. A.TrustZone for Cortex-M
2. B.Anti-rollback
3. C.Bootloader
4. D.Secure element

Answer + AI explanation with Pro

1. A.Secure element — hashing the image with SHA-256 and signing with a private ECDSA or RSA key at build time, with the public key embedded in the bootloader for verification
2. B.Secure element — small first program in reserved flash that validates and jumps to the application, and can replace it over a serial, USB or wireless link
3. C.Secure element — sequence from immutable boot ROM through bootloader to application and OS in which each link is verified or measured by the previous one
4. D.Secure element — tamper-resistant chip such as ATECC608 or SE050 that stores keys and performs cryptography so private keys never leave the hardware

Answer + AI explanation with Pro

1. A.AES shares one secret key and is fast for bulk data; RSA and ECC use key pairs for signatures and key exchange, with ECC P-256 matching RSA-3072 strength
2. B.hashing the image with SHA-256 and signing with a private ECDSA or RSA key at build time, with the public key embedded in the bootloader for verification
3. C.tamper-resistant chip such as ATECC608 or SE050 that stores keys and performs cryptography so private keys never leave the hardware
4. D.sequence from immutable boot ROM through bootloader to application and OS in which each link is verified or measured by the previous one

Answer + AI explanation with Pro

1. A.Firmware signing
2. B.Symmetric versus asymmetric crypto
3. C.Secure element
4. D.Bootloader

Answer + AI explanation with Pro

1. A.Symmetric versus asymmetric crypto — AES shares one secret key and is fast for bulk data; RSA and ECC use key pairs for signatures and key exchange, with ECC P-256 matching RSA-3072 strength
2. B.Symmetric versus asymmetric crypto — tamper-resistant chip such as ATECC608 or SE050 that stores keys and performs cryptography so private keys never leave the hardware
3. C.Symmetric versus asymmetric crypto — hashing the image with SHA-256 and signing with a private ECDSA or RSA key at build time, with the public key embedded in the bootloader for verification
4. D.Symmetric versus asymmetric crypto — hardware split of memory and peripherals into secure and non-secure worlds on Cortex-M23 and M33 via the SAU, isolating keys and secure services from the application

Answer + AI explanation with Pro

1. A.monotonic version counter kept in OTP or secure storage so an attacker cannot reinstall an older signed image with known vulnerabilities
2. B.sequence from immutable boot ROM through bootloader to application and OS in which each link is verified or measured by the previous one
3. C.hardware split of memory and peripherals into secure and non-secure worlds on Cortex-M23 and M33 via the SAU, isolating keys and secure services from the application
4. D.small first program in reserved flash that validates and jumps to the application, and can replace it over a serial, USB or wireless link

Answer + AI explanation with Pro

1. A.Firmware signing
2. B.A/B partitions
3. C.Secure element
4. D.Anti-rollback

Answer + AI explanation with Pro

1. A.Anti-rollback — two application slots so an update is written to the inactive slot and swapped only after validation, letting the device fall back if the new image fails
2. B.Anti-rollback — monotonic version counter kept in OTP or secure storage so an attacker cannot reinstall an older signed image with known vulnerabilities
3. C.Anti-rollback — tamper-resistant chip such as ATECC608 or SE050 that stores keys and performs cryptography so private keys never leave the hardware
4. D.Anti-rollback — each stage verifies the digital signature of the next against a key anchored in ROM or OTP before executing it, so only authorised firmware ever runs

Answer + AI explanation with Pro