SY0-701 General Security Concepts Practice Question
Exhibit
Backup vault policy: - Backup objects are encrypted with per-job data encryption keys (DEKs). - A key-encryption key (KEK) named vault-kek-v1 wraps the DEKs. - vault-kek-v1 will be rotated to vault-kek-v2 tonight. - Existing backup metadata still points to DEKs wrapped by vault-kek-v1. - Requirement: all backups from the last 18 months must remain restorable after rotation, with no mass re-encryption window.
Based on the exhibit, which action is required to keep the backups restorable after the key-encryption key rotation?
⚠ Common exam trap
Watch out — candidates often assume deleting the old key immediately is a best practice for key hygiene, but they overlook that existing encrypted data depends on the old key for decryption until re-wrapping occurs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rewrap or keep access to the old KEK version until existing DEKs are migrated.
When a key-encryption key (KEK) is rotated, existing data-encryption keys (DEKs) that were wrapped with the old KEK version become unreadable unless the old KEK is retained or the DEKs are re-wrapped with the new KEK. Option B ensures that backups remain restorable by either keeping the old KEK version accessible or migrating DEKs to the new KEK, maintaining the chain of trust for decryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete vault-kek-v1 immediately so only the newest key remains active.
Why it's wrong here
Deleting the old KEK would break access to any DEKs still wrapped by that key. The exhibit states that existing backup metadata still depends on vault-kek-v1. Removing it before migration would make older backups unrecoverable, which directly conflicts with the restore requirement.
- ✓
Rewrap or keep access to the old KEK version until existing DEKs are migrated.
Why this is correct
This is correct because the backups still depend on the old key-encryption key to unwrap their data-encryption keys. During key rotation, the organization must either keep the old KEK available or rewrap the DEKs with the new KEK before retiring the old one. That preserves restore capability without forcing a full mass re-encryption of the backup data.
- ✗
Re-encrypt the entire backup repository with a single shared password.
Why it's wrong here
A shared password is not an appropriate replacement for managed cryptographic keys, and re-encrypting the entire repository would be disruptive. The exhibit uses a proper DEK/KEK model, so the solution should preserve that structure. This option ignores the existing key hierarchy and the need to keep older backups recoverable during rotation.
- ✗
Export vault-kek-v2 into the backup files so each object stores the new key directly.
Why it's wrong here
Storing the new KEK directly in backup files would expose sensitive key material and undermine the whole purpose of key wrapping. Backups should store encrypted data and metadata, not plaintext keys. This would also make key management and rotation much harder, not easier.
Go deeper
Related to this question
Learn chapter
Symmetric vs Asymmetric Encryption
Key term
Key rotation
Key rotation is the process of replacing an old cryptographic key with a new one to maintain security and limit the damage from a potential key compromise.
Key term
Encryption key
An encryption key is a string of random characters used by an algorithm to lock (encrypt) and unlock (decrypt) data, ensuring only authorized parties can read it.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.