SY0-701 General Security Concepts Practice Question
A vendor distributes a Linux package through multiple mirrors. Security wants to verify that the package really came from the vendor and was not altered after publication, even if a mirror or CDN is compromised. Which cryptographic mechanism should be checked?
⚠ Common exam trap
Test-takers frequently confuse a simple hash (which provides integrity only if the hash source is trusted) with a digital signature (which provides both integrity and authentication even when the distribution channel is untrusted).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A digital signature created with the vendor's private key
A digital signature created with the vendor's private key provides both authentication (proving the package came from the vendor) and integrity (detecting any alteration after signing). Even if a mirror or CDN is compromised, the signature verification will fail if the package has been tampered with, because only the vendor's corresponding public key can validate the signature. This is the standard mechanism used by package managers like APT (with signed Release files) and RPM (with GPG signatures).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A hash value published on the mirror site alone
Why it's wrong here
A hash value published on the mirror alone only proves that the file matches a value available at the same location; if the mirror is compromised, an attacker can replace both the package and the hash with a malicious file and a recomputed digest. For the hash to be meaningful, it must be delivered out-of-band from a trusted source, such as the vendor's secure website, but even then it only attests to data integrity, not to the identity or authenticity of the file's creator. Thus, a mirror-published hash cannot prevent an attacker who controls the mirror from distributing a tampered package that still appears to 'verify'.
- ✓
A digital signature created with the vendor's private key
Why this is correct
A digital signature provides authenticity and integrity. If the package was signed with the vendor's private key, anyone with the matching public certificate can verify that the package came from the vendor and has not been altered since signing. This works even if the download is mirrored or relayed by an untrusted CDN, because verification does not depend on trusting the transport path.
- ✗
Symmetric encryption of the package with a shared secret
Why it's wrong here
Symmetric encryption uses a single pre-shared key for both encryption and decryption, so any party with that key can decrypt the package, but it provides no proof of origin. Because the same key is shared between the vendor and the consumer, a malicious distributor who knows the key could re-encrypt a modified package and the receiver would have no way to distinguish it from an authentic one. Additionally, symmetric encryption alone does not generate an integrity tag; the ciphertext can be altered or replaced without detection. Therefore, while it offers confidentiality, it is wholly inadequate for verifying that a package came from a specific vendor and was not tampered with.
- ✗
Key stretching with a slow password algorithm
Why it's wrong here
Key stretching algorithms such as PBKDF2, bcrypt, and scrypt are designed to make password guessing computationally expensive by deriving a cryptographic key from a low-entropy password through many repeated rounds. They serve a single purpose: to slow down offline brute-force and dictionary attacks on user-chosen passwords. Applying key stretching to a downloaded package would neither generate a vendor-specific identity nor bind the package's content to a signer, and it would not detect modifications because the derived key has no relation to the file's integrity. It is a one-way derivation used in authentication, not a mechanism for software provenance or tamper detection.
Visual reference
Go deeper
Related to this question
Learn chapter
Security Controls
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
Key term
Digital signature
A cryptographic technique used to verify the authenticity and integrity of a digital message or document, ensuring it came from the claimed sender and was not altered.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security team downloads a software update package signed by the vendor. The team verifies the signature using the vendor's public key before approving deployment. What does this verification primarily confirm?
medium- A.The package can only be decrypted by the vendor's private key
- ✓ B.The package was likely created by the vendor and was not altered after signing
- C.The package is encrypted with the vendor's public key
- D.The vendor's certificate has not expired
Why B: Digital signature verification using the vendor's public key confirms that the package was signed with the vendor's private key, which only the vendor possesses. This provides authentication of the signer's identity and integrity of the data, ensuring the package has not been modified since signing. It does not provide confidentiality, as the package itself is not encrypted.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.