What does UEFI Secure Boot do?

• A. A method to secure network booting.
• B. An encryption standard for hard drives.
• C. Firmware feature that only allows signed bootloaders/kernels to run, protecting against rootkits.
• D. A virtualization extension in CPUs.

Answer: (C)

UEFI Secure Boot is a firmware feature that ensures only digitally signed bootloaders and kernels are allowed to start. During the early stages of startup, the firmware verifies the signatures of the next piece of boot code against trusted keys stored in hardware. If the signature checks out, the boot process continues; if not, the system is halted or requires user intervention. This helps guard against bootkits and rootkits that try to run malicious code before the operating system loads. It’s not about securing network booting, it doesn’t encrypt hard drives, and it isn’t a CPU virtualization feature—the security it provides is specifically about validating the integrity of the boot chain.