SY0-701 General Security Concepts Practice Question
A development team needs a centralized service to store, rotate, and control access to encryption keys for applications. Which solution best fits?
⚠ Common exam trap
A common mix-up: candidates confuse a general security appliance (like a WAF or load balancer) with a specialized cryptographic service, or mistakenly think network-level controls (port forwarding) can manage key lifecycles, when only a dedicated key management service provides centralized storage, rotation, and access control for encryption keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Key management service, because it centralizes key storage and rotation controls.
A key management service (KMS) centralizes the lifecycle of cryptographic keys, including secure storage, automated rotation, and fine-grained access control via IAM policies. This directly meets the requirement for a centralized service to store, rotate, and control access to encryption keys for applications, as KMS is purpose-built for these tasks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Key management service, because it centralizes key storage and rotation controls.
Why this is correct
A key management service is designed to store, manage, rotate, and control access to cryptographic keys. It helps reduce the risk of hardcoded or poorly protected keys and gives administrators a central place to enforce lifecycle management. This is the best fit when multiple applications need secure, organized key handling.
- ✗
Port forwarding rule, because it allows applications to reach the encryption system.
Why it's wrong here
Port forwarding rule maps an external IP address and port to an internal service, altering network traffic paths to let clients reach an encryption system. It has no mechanism for storing cryptographic keys, enforcing key access policies, or automating key rotation. While it might expose a key management endpoint to the network, it is a connectivity control, not a key-lifecycle control, and therefore cannot satisfy the requirement for centralized key storage and rotation.
- ✗
Load balancer, because it distributes encryption requests across servers.
Why it's wrong here
A load balancer distributes incoming requests across multiple backend servers based on algorithms such as round-robin or least connections, improving scalability and fault tolerance. Even if it performs TLS termination and handles certificates, it does not provide a centralized repository for application encryption keys or scheduled, policy-driven rotation of those keys. It may front-end a KMS, but it remains a traffic distribution mechanism, not a key management service.
- ✗
Web application firewall, because it protects the keys from injection attacks.
Why it's wrong here
A web application firewall inspects HTTP/S traffic and filters requests using signatures and rules to block injection attempts, such as SQL injection or cross-site scripting. It cannot store, manage, or rotate cryptographic keys because keys reside in a security module or key management service, not in request payloads, and WAF rules are not key-lifecycle policies. Protecting web traffic is complementary to, but fundamentally different from, centralized key management.
Go deeper
Related to this question
Learn chapter
Symmetric vs Asymmetric Encryption
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.