The correct action is to re-download the update from the trusted source and verify the hash again. This is because a hash verification file integrity check is a cryptographic safeguard; when the computed hash of a downloaded file does not match the vendor’s published hash, it signals that the file has been corrupted during transit or tampered with by an attacker. Installing such a file could introduce malware or break system stability, so the only safe step is to delete the compromised copy, obtain a fresh download from the official source, and recompute the hash to confirm integrity. On the Security+ SY0-701 exam, this scenario tests your understanding of integrity controls and the principle of “trust but verify” in the update management domain. A common trap is choosing to install anyway or to check a different hash algorithm, but the correct path is always to discard and reacquire. Memory tip: “Hash mismatch? Trash and fetch—never patch.”
SY0-701 General Security Concepts Practice Question
This SY0-701 practice question tests your understanding of general security concepts. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
C:\Downloads> certutil -hashfile CU-2026-02.msu SHA256
SHA256 hash of CU-2026-02.msu:
9f2c3a1b8d4e0f77c0d2e6b5f0a4b1c8d9e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6
Vendor portal published hash:
9f2c3a1b8d4e0f77c0d2e6b5f0a4b1c8d9e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7
Based on the exhibit, what should the administrator do next?
C:\Downloads> certutil -hashfile CU-2026-02.msu SHA256
SHA256 hash of CU-2026-02.msu:
9f2c3a1b8d4e0f77c0d2e6b5f0a4b1c8d9e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6
Vendor portal published hash:
9f2c3a1b8d4e0f77c0d2e6b5f0a4b1c8d9e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7
A
Install the update because a longer hash means the file is newer.
Why wrong: A longer-looking hash does not mean the file is newer or safer. The published value and the computed value do not match, so the file cannot be trusted for installation. Installing it would ignore the integrity check.
B
Re-download the update from the trusted source and verify the hash again.
A hash mismatch means the local file does not match the vendor-published value. The safest next step is to obtain a fresh copy from a trusted source and compare the hash again. That helps determine whether the original download was corrupted in transit or tampered with before deployment.
C
Rename the file to match the vendor’s naming convention and retry installation.
Why wrong: The filename has no effect on the cryptographic hash. Renaming the file does not resolve the mismatch and does not prove the content is authentic. The administrator must validate the actual bytes, not the label attached to them.
D
Disable SHA-256 verification because patch files often change after download.
Why wrong: Disabling verification would remove the very integrity check designed to catch corruption or tampering. Patch files should not change after a proper download from a trusted vendor source. The mismatch is a warning sign, not a reason to ignore the check.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Re-download the update from the trusted source and verify the hash again.
Option B is correct because if the hash of a downloaded file does not match the vendor-published hash, the file is likely corrupted or tampered with. The administrator should delete the corrupted file, re-download it from the trusted source, and recompute the hash to ensure integrity before installation. This follows the principle of verifying file integrity via cryptographic hashing (e.g., SHA-256) before applying updates.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Install the update because a longer hash means the file is newer.
Why it's wrong here
A longer-looking hash does not mean the file is newer or safer. The published value and the computed value do not match, so the file cannot be trusted for installation. Installing it would ignore the integrity check.
✓
Re-download the update from the trusted source and verify the hash again.
Why this is correct
A hash mismatch means the local file does not match the vendor-published value. The safest next step is to obtain a fresh copy from a trusted source and compare the hash again. That helps determine whether the original download was corrupted in transit or tampered with before deployment.
Related concept
Read the scenario before looking for a memorised answer.
✗
Rename the file to match the vendor’s naming convention and retry installation.
Why it's wrong here
The filename has no effect on the cryptographic hash. Renaming the file does not resolve the mismatch and does not prove the content is authentic. The administrator must validate the actual bytes, not the label attached to them.
✗
Disable SHA-256 verification because patch files often change after download.
Why it's wrong here
Disabling verification would remove the very integrity check designed to catch corruption or tampering. Patch files should not change after a proper download from a trusted vendor source. The mismatch is a warning sign, not a reason to ignore the check.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is confusing hash length or file naming with file integrity, leading candidates to think a longer hash means a newer file or that renaming fixes hash mismatches, when in fact only re-downloading and re-verifying the hash ensures the file is authentic and uncorrupted.
Detailed technical explanation
How to think about this question
SHA-256 produces a fixed 256-bit (32-byte) hash value that acts as a unique fingerprint for the file content. Even a single bit change in the file results in a completely different hash (avalanche effect). In real-world scenarios, hash mismatches can occur due to incomplete downloads, network corruption, or man-in-the-middle attacks; re-downloading from the official source and re-verifying ensures the file matches the vendor's signed checksum.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SY0-701 question in full detail.
General Security Concepts — This question tests General Security Concepts — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Re-download the update from the trusted source and verify the hash again. — Option B is correct because if the hash of a downloaded file does not match the vendor-published hash, the file is likely corrupted or tampered with. The administrator should delete the corrupted file, re-download it from the trusted source, and recompute the hash to ensure integrity before installation. This follows the principle of verifying file integrity via cryptographic hashing (e.g., SHA-256) before applying updates.
What should I do if I get this SY0-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A systems administrator downloads a patch and a SHA-256 checksum file from the vendor. The administrator hashes the patch locally and the values match. What does the matching hash primarily confirm?
medium
✓ A.The file has not been altered since the vendor published the checksum.
B.The file remains confidential during transmission.
C.The vendor's private key was used to encrypt the patch.
D.The patch will definitely install successfully on every system.
Why A: A SHA-256 checksum is a cryptographic hash that acts as a fingerprint for the file. When the locally computed hash matches the vendor-published checksum, it confirms the file's integrity — that the patch has not been modified or corrupted since the vendor generated the checksum. This does not verify confidentiality, authenticity of the signer, or installation success.
Variation 2. A system administrator downloads a vendor patch package and a separate checksum file. After the download completes, the administrator runs a command that produces a SHA-256 value for the package and compares it to the vendor's published value. Which cryptographic primitive is being used for the comparison?
medium
✓ A.Hashing
B.Symmetric encryption
C.Digital signatures
D.Asymmetric encryption
Why A: The administrator is using SHA-256 to compute a fixed-length digest of the downloaded package and comparing it to the vendor's published checksum. This is a classic application of a cryptographic hash function (hashing), which produces a unique, irreversible fingerprint of data. The comparison verifies integrity—ensuring the package has not been altered during transit—but does not provide authentication or non-repudiation.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.