SY0-701 General Security Concepts Practice Question
A systems administrator downloads a patch and a SHA-256 checksum file from the vendor. The administrator hashes the patch locally and the values match. What does the matching hash primarily confirm?
⚠ Common exam trap
Many exam-takers confuse integrity (hash matching) with authenticity (digital signature) or confidentiality (encryption), leading them to incorrectly select options about private keys or secure transmission.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file has not been altered since the vendor published the checksum.
A SHA-256 checksum is a cryptographic hash that acts as a fingerprint for the file. When the locally computed hash matches the vendor-published checksum, it confirms the file's integrity — that the patch has not been modified or corrupted since the vendor generated the checksum. This does not verify confidentiality, authenticity of the signer, or installation success.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The file has not been altered since the vendor published the checksum.
Why this is correct
A SHA-256 checksum is a cryptographic hash of the file's contents. Matching the vendor-published hash verifies integrity: the downloaded file is bit-for-bit identical to the file the vendor hashed, so it hasn't been altered (accidentally or maliciously) since publication. However, this only proves integrity, not authenticity unless the hash was obtained over a trusted channel.
- ✗
The file remains confidential during transmission.
Why it's wrong here
A hash is a deterministic mathematical digest, not an encryption mechanism. It does not hide or encrypt the patch data, so confidentiality is entirely absent. The checksum only provides integrity verification, not any assurance that the transmission was private or that the file wasn't intercepted.
- ✗
The vendor's private key was used to encrypt the patch.
Why it's wrong here
Hash verification compares computed digests; it doesn't involve any keys or encryption. The vendor's private key is used in digital signatures (e.g., signing the hash), but a bare SHA-256 checksum doesn't authenticate the signer. Without a trusted signature, anyone could have published the hash, so the private key's usage is not demonstrated.
- ✗
The patch will definitely install successfully on every system.
Why it's wrong here
A matching hash confirms the file content is unchanged, but it says nothing about system compatibility, dependencies, or environmental requirements. Installation success depends on factors like OS version, architecture, existing software, and permissions, which a checksum cannot validate.
Go deeper
Related to this question
Learn chapter
CIA Triad — Confidentiality, Integrity, Availability
Key term
SHA-256
SHA-256 is a cryptographic hash function that takes any input data and produces a fixed 256-bit string of characters, like a unique digital fingerprint, used to verify data integrity and secure passwords.
Key term
Confidentiality
Confidentiality means keeping sensitive information secret and accessible only to authorized people or systems.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.