ExamworthyExamworthy
Open the appStart free

SY0-701 - General Security Concepts - Section 1.4

Explain the importance of using appropriate cryptographic solutions.

Compare symmetric and asymmetric encryption, explain how hashing and salting protect stored credentials, and describe how digital signatures provide integrity and non-repudiation. Understand the role of a PKI, including how certificates are issued, validated, and revoked through CRL and OCSP mechanisms.

PKIsymmetric vs asymmetrichashing and saltingdigital signaturescertificates and CRL/OCSP

Practice question for this objective

Free sampleGeneral Security Conceptshard

A logistics company is designing a courier mobile app that must send a one megabyte signed manifest to a backend API many times per minute over mobile networks. The cryptography lead wants confidentiality, integrity, and sender authentication, but is worried about CPU drain on low-end Android handsets. Which cryptographic design best meets the performance and security goals?

  • AEncrypt the entire manifest with the backend's RSA-4096 public key and append an RSA signature over the ciphertext, on the grounds that asymmetric algorithms give the strongest guarantees end to end.
  • BEncrypt the manifest with AES-256-ECB using a key derived from the courier's device PIN, then HMAC the ciphertext with the same key so that anyone with the PIN can both verify and decrypt the manifest.
  • CSend the manifest in cleartext over TLS and rely solely on the server certificate to authenticate the backend, on the assumption that TLS already provides end-to-end signing of every request body for both sides.
  • DEncrypt the manifest with AES-256-GCM using a per-message symmetric key, wrap that key with the backend's RSA-OAEP public key, and sign the ciphertext with the courier's ECDSA private key on a P-256 curve. Correct
Choose a hybrid cryptographic construction that combines symmetric bulk encryption with asymmetric key transport and digital signatures. Real systems almost never use asymmetric algorithms to encrypt bulk data, because they are slow and have small block sizes. The standard pattern is a hybrid scheme: a freshly generated symmetric key encrypts the payload under an authenticated mode such as AES-GCM, an asymmetric public key wraps that symmetric key, and a separate signing key proves who created the message. This gives confidentiality, integrity, and non-repudiation at a CPU cost low enough for mobile devices.

Why A is wrong: Bulk encrypting a one megabyte payload directly with RSA is operationally impossible because RSA can only encrypt blocks smaller than its modulus, and even chunked it is orders of magnitude slower than symmetric ciphers, so handset CPUs and batteries would suffer badly while gaining no extra security.

Why B is wrong: ECB mode leaks structure across identical plaintext blocks and is unsuitable for any non-trivial data, deriving a key from a low-entropy PIN gives a small brute-force space, and reusing one key for both encryption and authentication on the courier side gives no sender authentication for the backend at all.

Why C is wrong: TLS protects the transport hop and authenticates the server, but it does not produce a portable signature over the application payload that ties a specific courier identity to a specific manifest, so it fails the sender authentication and non-repudiation requirement the lead has set out.

Why D is correct: This is the standard hybrid pattern: AES-GCM provides fast authenticated symmetric encryption suited to bulk data, RSA-OAEP safely transports a fresh per-message key to the backend without a shared secret, and ECDSA on P-256 gives compact, low-CPU sender authentication, hitting confidentiality, integrity, and non-repudiation on modest hardware.

See more SY0-701 practice questions with worked answers.

More in this domain

Back to all General Security Concepts objectives, or the SY0-701 cert hub.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.