SY0-701 General Security Concepts Practice Question
A backup server encrypts large nightly database exports before sending them to an offsite storage system. The organization has already arranged a secure way to share the secret key between the systems, and performance is a concern because the files are very large. Which encryption approach is the best fit?
⚠ Common exam trap
A common mix-up: candidates choose asymmetric encryption because they associate it with 'secure key sharing,' forgetting that the scenario explicitly states the key exchange is already handled, so the focus should be on performance for large data volumes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Symmetric encryption
Symmetric encryption (e.g., AES-256) is the best fit because it uses a single shared secret key for both encryption and decryption, offering significantly higher throughput than asymmetric methods. For large files like nightly database exports, symmetric ciphers are hardware-accelerated (e.g., AES-NI) and introduce minimal performance overhead, while the secure key exchange is already handled separately.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Asymmetric encryption
Why it's wrong here
Asymmetric encryption relies on computationally expensive public-key mathematics, such as modular exponentiation for RSA or elliptic curve operations. Encrypting a large nightly database export block-by-block with such algorithms would impose severe CPU overhead and slow the backup window significantly. In practice, asymmetric keys are used only to encrypt a symmetric data-encryption key, while the actual bulk data is handled by a fast symmetric cipher like AES. Thus, while technically possible, it is a poor choice for this high-volume workload.
- ✓
Symmetric encryption
Why this is correct
Symmetric encryption is the best fit for bulk data because it is fast and efficient. When both sides can securely share the same secret key, large backup files can be encrypted and decrypted with much less overhead than with public-key methods. That makes it the standard choice for protecting high-volume data at rest or in transit.
- ✗
Hashing
Why it's wrong here
Hash functions such as SHA-256 are one-way mappings that produce a fixed-size digest of the input. They provide integrity by letting you detect any change in the data, but they offer absolutely no confidentiality because the original plaintext is not hidden or reversible. An attacker who obtains a hashed backup still has the original file; the hash simply acts as a checksum. Therefore, hashing cannot encrypt the nightly database export.
- ✗
Digital signatures
Why it's wrong here
Digital signatures are created by encrypting a message's hash with a signer's private key, and verification uses the corresponding public key. This cryptographic process proves authenticity, integrity, and non-repudiation, but it does not transform the message content into ciphertext; the signed document remains in readable plaintext. Signing a large database export would allow recipients to confirm it came from the backup server, but it would leave all database contents exposed. Consequently, digital signatures do not provide the confidentiality encryption requires.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Symmetric vs Asymmetric Encryption
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
PSK
A pre-shared key (PSK) is a secret string of characters shared in advance between two parties to authenticate and encrypt wireless or VPN communications.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.