SY0-701 - General Security Concepts (12% of the exam) - Section 1.4

Explain the importance of using appropriate cryptographic solutions.

Compare symmetric and asymmetric encryption, explain how hashing and salting protect stored credentials, and describe how digital signatures provide integrity and non-repudiation. Understand the role of a PKI, including how certificates are issued, validated, and revoked through CRL and OCSP mechanisms.

PKIsymmetric vs asymmetrichashing and saltingdigital signaturescertificates and CRL/OCSP

Practice question for this objective

Free sampleGeneral Security Conceptshard

A logistics company is designing a courier mobile app that must send a one megabyte signed manifest to a backend API many times per minute over mobile networks. The cryptography lead wants confidentiality, integrity, and sender authentication, but is worried about CPU drain on low-end Android handsets. Which cryptographic design best meets the performance and security goals?

AEncrypt the entire manifest with the backend's RSA-4096 public key and append an RSA signature over the ciphertext, on the grounds that asymmetric algorithms give the strongest guarantees end to end.
BEncrypt the manifest with AES-256-ECB using a key derived from the courier's device PIN, then HMAC the ciphertext with the same key so that anyone with the PIN can both verify and decrypt the manifest.
CSend the manifest in cleartext over TLS and rely solely on the server certificate to authenticate the backend, on the assumption that TLS already provides end-to-end signing of every request body for both sides.
DEncrypt the manifest with AES-256-GCM using a per-message symmetric key, wrap that key with the backend's RSA-OAEP public key, and sign the ciphertext with the courier's ECDSA private key on a P-256 curve. Correct

Choose a hybrid cryptographic construction that combines symmetric bulk encryption with asymmetric key transport and digital signatures. Real systems almost never use asymmetric algorithms to encrypt bulk data, because they are slow and have small block sizes. The standard pattern is a hybrid scheme: a freshly generated symmetric key encrypts the payload under an authenticated mode such as AES-GCM, an asymmetric public key wraps that symmetric key, and a separate signing key proves who created the message. This gives confidentiality, integrity, and non-repudiation at a CPU cost low enough for mobile devices.

Why A is wrong: Bulk encrypting a one megabyte payload directly with RSA is operationally impossible because RSA can only encrypt blocks smaller than its modulus, and even chunked it is orders of magnitude slower than symmetric ciphers, so handset CPUs and batteries would suffer badly while gaining no extra security.

Why B is wrong: ECB mode leaks structure across identical plaintext blocks and is unsuitable for any non-trivial data, deriving a key from a low-entropy PIN gives a small brute-force space, and reusing one key for both encryption and authentication on the courier side gives no sender authentication for the backend at all.

Why C is wrong: TLS protects the transport hop and authenticates the server, but it does not produce a portable signature over the application payload that ties a specific courier identity to a specific manifest, so it fails the sender authentication and non-repudiation requirement the lead has set out.

Why D is correct: This is the standard hybrid pattern: AES-GCM provides fast authenticated symmetric encryption suited to bulk data, RSA-OAEP safely transports a fresh per-message key to the backend without a shared secret, and ECDSA on P-256 gives compact, low-CPU sender authentication, hitting confidentiality, integrity, and non-repudiation on modest hardware.

See more SY0-701 practice questions, answers explained.

Exam traps in General Security Concepts

Answers that look right on this material and are not. Each one is a distractor from a different question in the SY0-701 bank for this domain.

OCSP requires the relying party to download the certificate authority's complete signed list of revoked serial numbers, whereas a CRL allows the relying party to query the status of just one certificate over an authenticated channel.
Why it is wrong: This option swaps the two mechanisms. The bulk-list download model is the CRL, and the per-certificate query model is OCSP, so a candidate who confuses the acronyms is tempted by this answer.
Symmetric algorithms are inherently insecure for confidentiality, so they are used only for hashing, whereas asymmetric algorithms are reserved for encrypting the bulk of network traffic and large data sets at rest.
Why it is wrong: This option flips real-world practice: symmetric ciphers such as AES are the workhorses of bulk confidentiality, and they are not hashing algorithms. Asymmetric primitives are too slow for bulk traffic and are normally used to negotiate symmetric keys.
Move the AES-256 data encryption key into an environment variable read at application start-up and rotate it every ninety days by re-encrypting all stored patient records under the new key during a maintenance window.
Why it is wrong: Environment variables are not hardware-backed, are readable by anyone who can list the process environment, and the proposed rotation requires re-encrypting all records each cycle, which is exactly the operational pain the architect was told to avoid; this design fails two of the three stated requirements.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.