The correct answer is to place the private key in an HSM or cloud key vault and issue unique keys per gateway. This directly addresses the biggest cryptographic risk: a shared private key stored in plaintext on an SMB share, which violates key confidentiality and creates a single point of compromise. A Hardware Security Module (HSM) or cloud key vault ensures the private key is never exposed in plaintext, while unique keys per gateway enforce isolation—so compromising one device doesn’t expose the key for all others. On the Security+ SY0-701 exam, this scenario tests your understanding of cryptographic key management and the principle of least privilege, often appearing in performance-based questions where you must identify the weakest link in a TLS deployment. A common trap is to focus on certificate renewal or network segmentation instead of the shared key itself. Memory tip: “One key, one device—HSM keeps it nice.”
SY0-701 General Security Concepts Practice Question
This SY0-701 practice question tests your understanding of general security concepts. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
TLS inventory:
- edge-vpn01 and edge-vpn02 present the same certificate and private key
- private key file stored in a shared SMB folder
- admins copy the key manually during maintenance
- compromise of either gateway would expose the file path to the same share
Based on the exhibit, which improvement best addresses the biggest cryptographic risk?
TLS inventory:
- edge-vpn01 and edge-vpn02 present the same certificate and private key
- private key file stored in a shared SMB folder
- admins copy the key manually during maintenance
- compromise of either gateway would expose the file path to the same share
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
TLS inventory:
- edge-vpn01 and edge-vpn02 present the same certificate and private key
- private key file stored in a shared SMB folder
- admins copy the key manually during maintenance
- compromise of either gateway would expose the file path to the same share
A
Place the private key in an HSM or cloud key vault and issue unique keys or certificates per gateway.
An HSM or vault protects the key from export, and unique keys reduce the impact if one gateway is compromised.
B
Increase the certificate expiration to five years to reduce renewal work.
Why wrong: Longer validity increases the time a weak key can be abused and does not fix the storage problem.
C
Keep copying the same key everywhere so failover is easier to manage.
Why wrong: Reusing the same key across devices expands blast radius and makes compromise of one system more dangerous.
D
Disable certificate validation to avoid user-facing outages.
Why wrong: Disabling validation removes trust checks entirely and would make secure communications much weaker.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the private key in an HSM or cloud key vault and issue unique keys or certificates per gateway.
Option A is correct because the biggest cryptographic risk is the shared private key stored in an SMB share, which violates the principle of least privilege and creates a single point of compromise. Using a Hardware Security Module (HSM) or cloud key vault ensures the private key is never exposed in plaintext, and issuing unique keys per gateway eliminates the risk that compromising one gateway exposes the key for all others. This directly addresses the core issue of key confidentiality and isolation.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Place the private key in an HSM or cloud key vault and issue unique keys or certificates per gateway.
Why this is correct
An HSM or vault protects the key from export, and unique keys reduce the impact if one gateway is compromised.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Increase the certificate expiration to five years to reduce renewal work.
Why it's wrong here
Longer validity increases the time a weak key can be abused and does not fix the storage problem.
✗
Keep copying the same key everywhere so failover is easier to manage.
Why it's wrong here
Reusing the same key across devices expands blast radius and makes compromise of one system more dangerous.
✗
Disable certificate validation to avoid user-facing outages.
Why it's wrong here
Disabling validation removes trust checks entirely and would make secure communications much weaker.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may think certificate expiration or failover convenience are the primary concerns, when the real risk is the shared private key's exposure and lack of isolation, which undermines the entire TLS trust model.
Detailed technical explanation
How to think about this question
In TLS, the private key is the root of trust for the certificate; if shared across devices, an attacker who compromises one device can impersonate any other device using that same key. HSMs and cloud key vaults (e.g., AWS KMS, Azure Key Vault) enforce hardware-level isolation and access control, preventing the key from ever being exported in plaintext. This aligns with NIST SP 800-57 guidance on key management, which mandates unique keys per entity and secure key storage.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A developer is choosing between AES-256 (symmetric) and RSA-2048 (asymmetric) for encrypting a large file that will be sent to a partner. Symmetric encryption is fast but requires key exchange; asymmetric is slower but solves the key distribution problem. A hybrid approach — encrypt the file with AES, encrypt the AES key with RSA — is standard. Questions like this test whether you understand when each approach applies.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SY0-701 question in full detail.
General Security Concepts — This question tests General Security Concepts — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Place the private key in an HSM or cloud key vault and issue unique keys or certificates per gateway. — Option A is correct because the biggest cryptographic risk is the shared private key stored in an SMB share, which violates the principle of least privilege and creates a single point of compromise. Using a Hardware Security Module (HSM) or cloud key vault ensures the private key is never exposed in plaintext, and issuing unique keys per gateway eliminates the risk that compromising one gateway exposes the key for all others. This directly addresses the core issue of key confidentiality and isolation.
What should I do if I get this SY0-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.