SY0-701 · Objective 1.4 · General Security Concepts
1.4 Cryptographic solutions explained
The official objective: “Explain the importance of using appropriate cryptographic solutions.” Here is what it means, what candidates mix up, and 3 practice questions that test it.
What objective 1.4 covers
Objective 1.4 is the largest in Domain 1. You don't need the maths, but you do need to know which tool solves which problem, because nearly every question here is a short scenario that asks for the best fit.
Symmetric encryption, such as AES, uses one shared key to encrypt and decrypt. It is fast, so it protects bulk data: disks, files, databases and the body of a network session. Its weakness is key distribution: both sides need the same secret. Asymmetric encryption, such as RSA or elliptic curve cryptography, uses a public and private key pair. It is slow but solves distribution, because the public key can be shared openly. Real protocols use both: asymmetric methods or a Diffie-Hellman key exchange agree a session key, then symmetric encryption carries the data. When each session uses fresh ephemeral keys, stealing the server's long-term key later doesn't decrypt old traffic. That property is perfect forward secrecy.
Hashing is one-way. It produces a fixed-length digest that changes completely if the input changes, so it proves integrity. Passwords should be stored as hashes, with a unique random salt per user so identical passwords produce different hashes and precomputed rainbow tables fail. Key stretching (PBKDF2, bcrypt) runs the hash many times so each guess in an offline attack is slow.
A digital signature is a hash encrypted with the sender's private key. Anyone with the public key can verify it, which gives integrity, authentication of the sender and non-repudiation. Certificates bind a public key to an identity and are issued by a certificate authority after you submit a certificate signing request. Know the certificate types: wildcard (any host under one domain), SAN (a named list of hosts), and self-signed (no trusted issuer). Revocation is checked with a CRL or OCSP, and OCSP stapling lets the server deliver a fresh status itself.
Hardware matters too. A TPM is a chip in a single device that stores keys and measures the boot process. An HSM is a dedicated, tamper-resistant appliance or cloud service that generates and uses keys for many systems. A secure enclave isolates sensitive operations inside the processor. Other terms in scope: key escrow, tokenization, data masking, steganography, obfuscation and blockchain's tamper-evident ledger.
What candidates mix up
- Encryption versus hashing: encryption is reversible with a key; hashing is not reversible at all.
- Salt versus key stretching: a salt makes each hash unique; stretching makes each guess slow. Good password storage uses both.
- Wildcard versus SAN certificate: a wildcard covers every host under a domain; a SAN lists specific names and covers nothing else.
- TPM versus HSM: a TPM protects one device; an HSM serves keys to many systems.
- Signing uses the sender's private key; encrypting to someone uses the recipient's public key.
Practice questions for 1.4
From the CertRidge SY0-701 question bank. Try each one before opening the answer.
Question 1
Two parties who have never communicated before need to establish a shared secret key over an untrusted network so they can encrypt bulk data efficiently. Which approach solves this key-distribution problem?
- APerform an asymmetric key exchange such as Diffie-Hellman to derive a shared symmetric session key
- BHash the data with SHA-256 before sending it so that only the intended recipient is able to read it
- CConfigure a pre-shared symmetric key on both systems before the first encrypted session begins
- DDigitally sign each message with the sender's private key so it cannot be read while in transit
Show answer and explanation
Answer: A) Perform an asymmetric key exchange such as Diffie-Hellman to derive a shared symmetric session key
Asymmetric key exchange, such as Diffie-Hellman, lets strangers agree on a shared secret over an untrusted network without pre-sharing anything. That secret becomes a symmetric session key for efficient bulk encryption.
- ACorrect. In a Diffie-Hellman exchange, each party sends only its public key over the untrusted network. Both then compute the same shared secret, which is used to derive a symmetric session key for fast bulk encryption. TLS uses this hybrid approach.
- BIncorrect. Hashing is a one-way integrity function. It does not encrypt data or set up a shared key, so it provides no confidentiality.
- CIncorrect. A pre-shared key requires a secure channel to have existed already. These parties have never communicated, so this assumes the key-distribution problem is already solved.
- DIncorrect. A digital signature provides integrity, authenticity and non-repudiation. Anyone with the public key can verify the signature, so it does not provide confidentiality or create a shared key.
Question 2
An organization needs a single TLS certificate that secures www.example.com, api.example.com, and shop.example.com. To limit exposure if the private key is compromised, it must not be valid for any other hostnames. Which certificate type best meets these requirements?
- AA Subject Alternative Name (SAN) certificate listing the three hostnames
- BA wildcard certificate issued for the name *.example.com
- CA single-name certificate issued for the apex domain example.com
- DA code-signing certificate issued to the example.com organization
Show answer and explanation
Answer: A) A Subject Alternative Name (SAN) certificate listing the three hostnames
A SAN (multi-domain) certificate lists specific hostnames, so it covers exactly the three required names. A wildcard would cover every subdomain at that level, which is broader than required.
- AA SAN certificate lists each covered name explicitly, so one certificate protects exactly these three hostnames and nothing else.
- BA wildcard covers every subdomain at that level (for example login.example.com or test.example.com), so it is valid for far more names than required. That breaks the requirement to limit exposure.
- CThe apex domain does not include its subdomains, so a certificate for example.com alone would not match www, api, or shop.
- DCode-signing certificates prove who published software. They are not meant for authenticating TLS servers and would not secure HTTPS connections to these hosts.
Question 3
An application stores each user's password by combining it with a unique random salt and running it through PBKDF2 with a very high iteration count. The goal is to make every guess in an offline cracking attack slow and costly. Which technique does the high iteration count implement?
- AKey stretching
- BTokenization
- CData masking
- DKey escrow
Show answer and explanation
Answer: A) Key stretching
Repeating a salted password hash many times with a function such as PBKDF2 is key stretching. It makes each offline guess expensive, and the salt defeats precomputed rainbow-table attacks.
- ACorrect. Key stretching runs a password through a key derivation function such as PBKDF2 many times, so each guess costs the attacker much more computing time. The unique salt adds protection against precomputed (rainbow table) attacks and stops identical passwords from producing identical hashes.
- BIncorrect. Tokenization replaces sensitive data, such as a card number, with a stand-in token and keeps the original in a secure vault. It does not make password guessing more expensive.
- CIncorrect. Data masking hides part or all of a value when it is displayed or used, for example showing only the last four digits. It does not protect stored password hashes from offline cracking.
- DIncorrect. Key escrow means a trusted third party holds copies of encryption keys so they can be recovered. It has nothing to do with slowing down password guessing.
Other General Security Concepts objectives
Also: the General Security Concepts domain page (12% of the exam), all SY0-701 objectives and the SY0-701 cheat sheet.
Ready for a full SY0-701 practice exam?
Timed practice exams match the real exam's length and domain weights, every result shows your score per domain, and Review Mode re-drills the questions you missed.
Objective numbers and statements from CompTIA's published SY0-701 exam objectives. The explanations and questions are our own. Not affiliated with CompTIA.