SY0-701 General Security Concepts Practice Question
A system administrator downloads a vendor patch package and a separate checksum file. After the download completes, the administrator runs a command that produces a SHA-256 value for the package and compares it to the vendor's published value. Which cryptographic primitive is being used for the comparison?
⚠ Common exam trap
Many exam-takers confuse integrity verification via hashing with authentication provided by digital signatures, especially when the question mentions a 'vendor' and 'comparison'—leading them to incorrectly choose digital signatures (Option C) even though no signature verification is performed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Hashing
The administrator is using SHA-256 to compute a fixed-length digest of the downloaded package and comparing it to the vendor's published checksum. This is a classic application of a cryptographic hash function (hashing), which produces a unique, irreversible fingerprint of data. The comparison verifies integrity—ensuring the package has not been altered during transit—but does not provide authentication or non-repudiation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Hashing
Why this is correct
Hashing creates a fixed-length digest from data so the receiver can compare values and detect changes. In this scenario, the administrator is generating a SHA-256 result and comparing it to the vendor's published value to confirm the package has not changed. That use case is about integrity verification rather than encryption or identity proof.
- ✗
Symmetric encryption
Why it's wrong here
Symmetric encryption uses a single shared secret key to transform plaintext into ciphertext, providing confidentiality between parties. It does not produce a fixed-length digest or support the checksum comparison described, because no key is used in the scenario and no data is being hidden or decrypted. The administrator is checking for accidental changes to the package, not protecting it from unauthorized viewing.
- ✗
Digital signatures
Why it's wrong here
Digital signatures do verify integrity and authenticity by signing a hash with a private key and verifying it with a public key, but the scenario explicitly states that a SHA-256 value is generated and compared to the vendor's published value. No private key, public key, or signature verification process is involved here, so the operation is a straightforward integrity check rather than an authentication mechanism.
- ✗
Asymmetric encryption
Why it's wrong here
Asymmetric encryption uses a public/private key pair to encrypt data for confidentiality or to exchange keys, but it does not generate a comparable checksum for a downloaded file. In this scenario, there is no encryption attempt, no key exchange, and no ciphertext; the administrator is simply comparing a computed SHA-256 digest against a known value. Key-based operations would add unnecessary complexity and do not match the described action.
Go deeper
Related to this question
Learn chapter
Hashing Algorithms
Key term
SHA-256
SHA-256 is a cryptographic hash function that takes any input data and produces a fixed 256-bit string of characters, like a unique digital fingerprint, used to verify data integrity and secure passwords.
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.