SY0-701 General Security Concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The package can only be decrypted by the vendor's private key

  Why it's wrong here

  This option describes an encryption scenario: if a package were encrypted with a public key, only the corresponding private key could decrypt it. Digital signature verification, however, does not involve decrypting the package content; the vendor signs a cryptographic hash of the file, and the team verifies that signature using the vendor's public key. Thus the statement confuses confidentiality (encryption) with authenticity/integrity (signing).

• ✓

  The package was likely created by the vendor and was not altered after signing

  Why this is correct

  Digital signature verification checks that the signed data matches what the signer produced and that the signer controlled the corresponding private key. This gives the team confidence in authenticity and integrity. If the file had been modified after signing, verification would fail. That is why signatures are commonly used for software updates and trusted releases.

• ✗

  The package is encrypted with the vendor's public key

  Why it's wrong here

  Saying the package is encrypted with the vendor's public key would imply the vendor used asymmetric encryption to protect the data's confidentiality, so that only the vendor's private key can read it. Code-signing processes do not require or imply encryption of the payload; they compute a digest and sign that digest, leaving the actual file in plaintext. Successful signature verification tells the team the file's integrity and origin are intact, not that the file was encrypted for secrecy.

• ✗

  The vendor's certificate has not expired

  Why it's wrong here

  A certificate expiration check is only a part of validating the signer's identity and key lifecycle; it does not demonstrate that a specific signed file has not been modified. Even if the vendor's certificate is currently valid, an attacker could alter the package, causing the signature verification to fail. The verification's core result is a cryptographic binding between the vendor's private key and the package's exact contents, whereas cert expiration merely indicates whether the certificate is within its issuance validity period.