SY0-701 General Security Concepts Practice Question
A company suspects the master encryption key used by a cloud storage service may have been exposed. The data must remain protected if someone later obtains a copy of the old key. What is the best next step?
⚠ Common exam trap
A common mix-up: candidates confuse key rotation with password changes or data deletion, failing to recognize that encryption key management requires cryptographic operations to re-protect the data, not just administrative actions like deleting files or changing user credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rotate the key and re-encrypt or rewrap the protected data under the new key.
Key rotation is the correct response because it invalidates the old master encryption key by generating a new one and re-encrypting or rewrapping the protected data under the new key. This ensures that even if an attacker later obtains a copy of the old key, the data remains protected because it is no longer encrypted with that key. In cloud storage services like AWS KMS or Azure Key Vault, this process is typically automated and does not require re-uploading the data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the stored files so the exposed key can no longer be used.
Why it's wrong here
Deleting the stored ciphertext does not revoke the compromised master key. Any copies of the encrypted data that an attacker already exfiltrated, or that reside in backups, snapshots, or logs, remain fully decryptable with the exposed key. Deletion is an availability decision, not a cryptographic control, so it fails to address the key's continued validity and leaves future data unprotected. The proper response is to retire the key via rotation and move the data to fresh key material.
- ✓
Rotate the key and re-encrypt or rewrap the protected data under the new key.
Why this is correct
If a key may be compromised, the secure response is to replace it and move protected data to fresh key material. Rotating the key prevents the old key from being useful going forward, and re-encrypting or rewrapping ensures the data is actually protected by the new key. This reduces the risk that a future attacker can use the leaked key to access stored content.
- ✗
Change every user's password because that will also invalidate the exposed encryption key.
Why it's wrong here
User passwords are authentication credentials, not the underlying master encryption key. Master keys are typically stored in a hardware security module (HSM) or a key management service, independently of user accounts, and are used to wrap or encrypt data at rest. Changing passwords only affects future authentication events; it does not alter, invalidate, or rewrap the master key, so an attacker who possesses that key can still decrypt any captured data. The correct mitigation is key rotation and re-encrypting/rewrapping the data under a new key.
- ✗
Increase file compression so the data becomes harder to read.
Why it's wrong here
Compression is a data-reduction technique, not a security mechanism. It does not modify the encryption key or the ciphertext's relationship to that key, so an attacker with the leaked master key can simply decompress the data after (or even before) decrypting it. Worse, applying compression to sensitive data is known to enable side-channel attacks like CRIME or BREACH, but it certainly does not make the data 'harder to read' for someone who already holds the legitimate key. Only a cryptographic key rotation, followed by re-encryption or rewrapping, can neutralize the leaked key.
Go deeper
Related to this question
Learn chapter
Symmetric vs Asymmetric Encryption
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Encryption key
An encryption key is a string of random characters used by an algorithm to lock (encrypt) and unlock (decrypt) data, ensuring only authorized parties can read it.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.