The correct answer is certificate pinning and preventing local administrators from modifying the trusted root store through endpoint policy. Certificate pinning directly reduces the risk by hard-coding the expected server certificate or public key into the application, so even if a malicious root CA is installed on the system, the browser will reject any proxy certificate that does not match the pinned certificate. This control operates at the application layer, overriding the OS-level trust decisions. On the Security+ SY0-701 exam, this scenario tests your understanding of how trusted root store controls and certificate pinning work together to defend against man-in-the-middle attacks. A common trap is assuming that simply removing the rogue CA is sufficient, but the exam emphasizes proactive controls like pinning and policy-based restrictions on root store modifications. Remember the mnemonic: "Pin it, then restrict the root" — pinning blocks the bad cert, while endpoint policy locks down who can add new CAs.
SY0-701 General Security Concepts Practice Question
This SY0-701 practice question tests your understanding of general security concepts. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Endpoint findings:
- Local root certificate store was modified
- Browser trusts a new enterprise-looking root CA
- TLS warnings no longer appear for the internal portal
- The user has local administrator rights
A developer installed an unknown root CA on a laptop. The browser now accepts a proxy certificate for intranet.apps.example without warnings. Which two controls most directly reduce the chance that this endpoint trusts a malicious interception certificate? Select two.
Endpoint findings:
- Local root certificate store was modified
- Browser trusts a new enterprise-looking root CA
- TLS warnings no longer appear for the internal portal
- The user has local administrator rights
A
Enforce certificate pinning in the application for the expected server certificate.
Certificate pinning reduces the chance that a malicious trusted root on the endpoint can impersonate the server. The app checks for a known certificate or public key, not just any certificate signed by a trusted CA.
B
Allow employees to add any root CA as long as the certificate is password-protected.
Why wrong: Password protection does not make an untrusted root safe. If the endpoint trusts a malicious CA, the browser can still accept forged certificates, which defeats the purpose of certificate validation.
C
Prevent local administrators from modifying the trusted root store through endpoint policy.
Locking down the trusted root store limits the attacker’s ability to add a rogue CA. If users cannot alter trust anchors freely, it becomes much harder to silently intercept TLS traffic on that device.
D
Rely on HTTPS alone because any certificate over TLS is safe.
Why wrong: HTTPS only helps when certificate validation is trustworthy. If the endpoint trusts a malicious root, HTTPS can be used by the attacker just as easily as by the legitimate server.
E
Disable DNS because certificate trust does not depend on hostnames.
Why wrong: Certificate validation does depend on hostnames and trust chains. Disabling DNS does not solve local trust-store tampering, and it would likely break normal application connectivity.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enforce certificate pinning in the application for the expected server certificate.
Option A is correct because certificate pinning hard-codes the expected server certificate or public key into the application, so even if a malicious root CA is trusted by the OS, the application will reject any proxy certificate that does not match the pinned certificate. This directly prevents the browser from accepting the proxy certificate without warnings, as the pinning check occurs at the application layer before the TLS handshake completes.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Enforce certificate pinning in the application for the expected server certificate.
Why this is correct
Certificate pinning reduces the chance that a malicious trusted root on the endpoint can impersonate the server. The app checks for a known certificate or public key, not just any certificate signed by a trusted CA.
Related concept
Read the scenario before looking for a memorised answer.
✗
Allow employees to add any root CA as long as the certificate is password-protected.
Why it's wrong here
Password protection does not make an untrusted root safe. If the endpoint trusts a malicious CA, the browser can still accept forged certificates, which defeats the purpose of certificate validation.
✓
Prevent local administrators from modifying the trusted root store through endpoint policy.
Why this is correct
Locking down the trusted root store limits the attacker’s ability to add a rogue CA. If users cannot alter trust anchors freely, it becomes much harder to silently intercept TLS traffic on that device.
Related concept
Read the scenario before looking for a memorised answer.
✗
Rely on HTTPS alone because any certificate over TLS is safe.
Why it's wrong here
HTTPS only helps when certificate validation is trustworthy. If the endpoint trusts a malicious root, HTTPS can be used by the attacker just as easily as by the legitimate server.
✗
Disable DNS because certificate trust does not depend on hostnames.
Why it's wrong here
Certificate validation does depend on hostnames and trust chains. Disabling DNS does not solve local trust-store tampering, and it would likely break normal application connectivity.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may think password protection on a certificate adds security against interception, but it only protects the private key file, not the trust decision, and the real risk is the unauthorized addition of a root CA to the trusted store.
Detailed technical explanation
How to think about this question
Certificate pinning is implemented via HTTP Public Key Pinning (HPKP) or static pinning in application code, where the client stores a hash of the server's public key or certificate; during TLS, the client verifies that the server's certificate chain includes the pinned key, rejecting any connection that does not match, even if the chain is signed by a trusted CA. Endpoint policies, such as Group Policy in Windows or configuration profiles in macOS, can restrict write access to the certificate store (e.g., via the 'Certificate Services Client - Auto-Enrollment' or by setting registry permissions on 'HKLM\SOFTWARE\Microsoft\SystemCertificates\Root'), preventing local administrators from adding untrusted root CAs.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A developer is choosing between AES-256 (symmetric) and RSA-2048 (asymmetric) for encrypting a large file that will be sent to a partner. Symmetric encryption is fast but requires key exchange; asymmetric is slower but solves the key distribution problem. A hybrid approach — encrypt the file with AES, encrypt the AES key with RSA — is standard. Questions like this test whether you understand when each approach applies.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SY0-701 question in full detail.
General Security Concepts — This question tests General Security Concepts — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Enforce certificate pinning in the application for the expected server certificate. — Option A is correct because certificate pinning hard-codes the expected server certificate or public key into the application, so even if a malicious root CA is trusted by the OS, the application will reject any proxy certificate that does not match the pinned certificate. This directly prevents the browser from accepting the proxy certificate without warnings, as the pinning check occurs at the application layer before the TLS handshake completes.
What should I do if I get this SY0-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.