SY0-701 General Security Concepts Practice Question
Exhibit
backup.sh excerpt: ``` openssl enc -aes-256-cbc -in finance.tar -out finance.tar.enc -kfile /opt/backup/finance.key chmod 600 /opt/backup/finance.key # same key file copied to all backup servers ``` Backup administrator note: - All sites use the same encryption key so restores are simple. - The key file is stored on the local backup server.
Based on the exhibit, what is the best improvement to reduce the impact if one backup server is compromised?
⚠ Common exam trap
Watch out — candidates often think renaming or hiding the key file (Option A) is a valid security measure, but CompTIA tests the principle that security through obscurity (hiding files) is not a substitute for proper key management and isolation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store encryption keys in a centralized KMS or HSM and use distinct keys with rotation.
Using a centralized Key Management System (KMS) or Hardware Security Module (HSM) with distinct, rotated keys ensures that compromising one backup server does not expose the encryption keys for all backups. This isolates the impact to only the data encrypted with that specific key, and key rotation further limits the window of exposure. In contrast, sharing a single key file across servers creates a single point of failure, as compromising one server reveals the key for all backups.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Keep the same key file but rename it so attackers cannot find it easily.
Why it's wrong here
Renaming the key file relies on security through obscurity, which is not a viable control. An attacker who compromises the backup server can inspect running processes, memory dumps, command-line history, and file-system metadata to discover the key regardless of its filename. Moreover, retaining the same key on every server preserves the original design flaw: a single compromised host still exposes all encrypted backups.
- ✗
Replace AES with SHA-256 so the backups are harder to read.
Why it's wrong here
SHA-256 is a one-way cryptographic hash function, not a reversible encryption algorithm. Replacing AES with SHA-256 would make it computationally infeasible to recover the original backup data, because hashing destroys information rather than protecting it with a key. Furthermore, hashes provide integrity, not confidentiality, and are not designed for decryption, so the backups would become unrecoverable even for authorized administrators.
- ✓
Store encryption keys in a centralized KMS or HSM and use distinct keys with rotation.
Why this is correct
This is the best improvement because the current design places the same key on every backup server, creating a large blast radius if one host is compromised. Centralized key management through a KMS or HSM improves control, auditing, rotation, and separation of duties. Distinct keys also limit how much data exposure results from one server compromise.
- ✗
Email the key file to backup operators so they can restore data quickly.
Why it's wrong here
Emailing the key file introduces an insecure transmission channel and creates additional copies of the secret in mail servers, client devices, and backup operators' inboxes. This expands the attack surface and undermines auditability, as there is no centralized record of who accessed the key or when it was used. Unlike a KMS, email also provides no API-level access control, key rotation, or separation of duties, making it an unacceptable substitute for proper key management.
Go deeper
Related to this question
Learn chapter
Security Controls
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Key rotation
Key rotation is the process of replacing an old cryptographic key with a new one to maintain security and limit the damage from a potential key compromise.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.