An organization upgrades all desktops to Windows 11 and must ensure protection from malicious software...

CompTIA A+ explains that Secure Boot is a UEFI security feature that prevents unauthorized or malicious bootloaders, rootkits, and unsigned OS loaders from starting during the boot process. Secure Boot verifies digital signatures on the OS and critical boot files before allowing startup, ensuring the system has not been tampered with.

TPM (Option A) provides encryption key storage and is used for BitLocker, but alone does not block malicious bootloaders. HSMs (Option B) are enterprise cryptographic devices, not PC boot protection features. BIOS passwords (Option D) restrict access to configuration but do not protect against malicious boot-level malware.

Windows 11 specifically requires Secure Boot, making it the correct protection mechanism for preventing startup-level malware.

Thus, Secure Boot is the proper choice.