SY0-701 General Security Concepts Practice Question
A branch office needs to send a confidential design document to headquarters over an untrusted network. Headquarters already has the public/private key pair available for document exchange. Which method is most appropriate to keep the file confidential during transit without first sharing a secret key?
⚠ Common exam trap
A common mix-up: candidates confuse digital signatures (which provide authentication and integrity) with encryption (which provides confidentiality), leading them to choose signing the file instead of encrypting it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encrypt the file with headquarters' public key
Encrypting the file with headquarters' public key ensures that only headquarters, possessing the corresponding private key, can decrypt and read the file. This method provides confidentiality over an untrusted network without requiring a pre-shared secret key, as the public key can be freely distributed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Encrypt the file with headquarters' public key
Why this is correct
Encrypting the file with headquarters' public key applies asymmetric encryption (e.g., RSA or ECC) where only the corresponding private key held exclusively by headquarters can decrypt the ciphertext. This directly achieves confidentiality in transit because an eavesdropper who intercepts the file cannot derive the plaintext without that private key. It does not by itself prove that the branch office sent it, but the scenario's requirement is confidentiality, so this is the correct action.
- ✗
Publish a hash of the file for comparison
Why it's wrong here
Publishing a hash produces a fixed-size digest of the document that allows a recipient to verify integrity by recomputing the hash and comparing it, but it does not alter the document itself or hide its content from anyone who captures it. A hash is a one-way function with no key, so it cannot encrypt or decrypt; the original file would still be sent as readable plaintext. Thus, while a hash would detect tampering, it provides zero confidentiality and leaves the design document exposed.
- ✗
Sign the file with the branch office private key only
Why it's wrong here
Signing with the branch office's private key creates a digital signature that proves the file's origin and confirms it has not been modified, because anyone can verify the signature using the branch office's public key. However, a signature is attached to the plaintext message and does not transform or obscure the contents, so anyone wiretapping the connection can read the design document in full. This action addresses authenticity and non-repudiation, not the confidentiality requirement stated in the scenario.
- ✗
Compress the file before sending it
Why it's wrong here
Compressing the file with a tool like ZIP or gzip reduces its size by removing redundant data, but it relies on publicly known compression algorithms that require no secret. Any recipient—or an eavesdropper—can decompress the file using freely available software, so compression provides no cryptographic barrier. The resulting archive is merely a different representation of the same data, and it does nothing to protect the document from being read during transmission.
Go deeper
Related to this question
Learn chapter
CIA Triad — Confidentiality, Integrity, Availability
Key term
Confidentiality
Confidentiality means keeping sensitive information secret and accessible only to authorized people or systems.
Key term
PSK
A pre-shared key (PSK) is a secret string of characters shared in advance between two parties to authenticate and encrypt wireless or VPN communications.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.