Question 122 of 1,013
SY0-701 General Security Concepts Practice Question
Exhibit
Backup job configuration: algorithm=AES-256-GCM key_file=/opt/backup/key.bin rotation=disabled same_key_for_all_sites=true backup_media copied to an offsite vault each night
Based on the exhibit, what should be implemented to reduce the blast radius if a backup server is compromised later?
Backup job configuration: algorithm=AES-256-GCM key_file=/opt/backup/key.bin rotation=disabled same_key_for_all_sites=true backup_media copied to an offsite vault each night
⚠ Common exam trap
CompTIA often tests the distinction between encryption and hashing, and the trap here is that candidates may confuse SHA-256 (a hash) with AES (an encryption algorithm), or assume that storing the key in a password-protected archive provides adequate security, ignoring that the key is still co-located with the data on the compromised server.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use envelope encryption with unique data encryption keys protected by a KMS-managed key encryption key.
Envelope encryption with unique data encryption keys (DEKs) protected by a KMS-managed key encryption key (KEK) ensures that even if the backup server is compromised, the attacker cannot decrypt all backups because each backup uses a different DEK, and the KEK is stored externally in a KMS. This limits the blast radius to only the data encrypted with the compromised DEK, rather than exposing all historical backups encrypted with a single static key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use envelope encryption with unique data encryption keys protected by a KMS-managed key encryption key.
Why this is correct
Envelope encryption creates a key hierarchy in which each backup gets a unique data encryption key (DEK), and that DEK is wrapped by a key encryption key (KEK) managed inside a KMS. Because the KEK never leaves the KMS and can be rotated or access-controlled independently, compromise of one backup's wrapped DEK does not reveal the KEK or unlock other backups. Unique per-backup DEKs also make forensic isolation, cryptoperiod limits, and revocation practical, directly reducing the blast radius of any single key exposure.
- ✗
Store the same key in a password-protected ZIP archive on the backup server.
Why it's wrong here
Storing a single reusable key inside a password-protected ZIP on the backup server keeps the key and the protected data on the same compromised system, so an attacker who steals the backups can also steal the ZIP. ZIP password encryption typically derives a single, human-memorizable key with a low-entropy KDF and provides no real key hierarchy, making offline password and dictionary attacks practical. This approach lacks separate storage, rotation, per-object key uniqueness, and audited KMS access, so it does not meaningfully reduce the impact of a key compromise.
- ✗
Replace AES with SHA-256 so the files cannot be opened directly.
Why it's wrong here
SHA-256 is not an encryption algorithm but a one-way cryptographic hash function: it deterministically digests input and cannot recover the original bytes, so replacing AES with SHA-256 would make backups permanently unrestorable rather than merely unopenable. Hashing is designed for integrity and verification, not confidentiality, and no mode of SHA-256 can provide decryption or key-based access control. Applying a hash to backup files destroys the data instead of protecting it, so this option fails the core backup requirement of recoverability.
- ✗
Keep one key forever and increase the backup frequency.
Why it's wrong here
Keeping one key forever and increasing backup frequency multiplies the volume of ciphertext protected by that same static key, so if the key is ever compromised, every past and future backup is exposed simultaneously. Long-lived keys also accumulate risk through increased cryptanalysis exposure, weaker compliance with key rotation standards such as NIST SP 800-57, and no ability to revoke one backup's access without re-encrypting everything. Generating more backups under the same key adds more data at risk without changing the key's cryptoperiod or reducing its blast radius.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 30, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.