Exam SK0-005 topic 1 question 148 discussion

E. Bootloader password F. BIOS/UEFI password If properly configured, a bootloader password or BIOS/UEFI password would prevent a user from installing an OS on a server. These passwords restrict access to the boot process, preventing unauthorized changes to the system. An administrator password or root password would not necessarily prevent a user from installing an OS, as these passwords are used to control access to the operating system once it has already been installed. A Group Policy Object is a configuration tool used in Windows environments to manage security settings and other system configurations for groups of users and computers, but it would not prevent a user from installing an OS. SELinux is a security feature in Linux that provides mandatory access control for processes and files, but it would not prevent a user from installing an OS.

Requiring a boot password upon execution of the boot loader will prevent an unauthorized user from entering boot parameters or changing the boot partition. This prevents users from weakening security (e.g. turning off SELinux at boot time). What is a UEFI password? A UEFI, or BIOS, password is a password that must be entered when the machine is powered on or rebooted in order to continue. Without the password the machine cannot be booted at all — even from external media — and no configuration changes to the UEFI or BIOS settings can be made. https://www.tenable.com/audits/items/CIS_Red_Hat_EL7_STIG_v2.0.0_STIG.audit:1ee8630516da75be0fabf64c11ab70c6 https://askleo.com/how_do_i_remove_a_bios_password/#