SY0-701 General Security Concepts Practice Question
Exhibit
TLS inventory: - edge-vpn01 and edge-vpn02 present the same certificate and private key - private key file stored in a shared SMB folder - admins copy the key manually during maintenance - compromise of either gateway would expose the file path to the same share
Based on the exhibit, which improvement best addresses the biggest cryptographic risk?
TLS inventory: - edge-vpn01 and edge-vpn02 present the same certificate and private key - private key file stored in a shared SMB folder - admins copy the key manually during maintenance - compromise of either gateway would expose the file path to the same share
⚠ Common exam trap
It's easy for candidates to think certificate expiration or failover convenience are the primary concerns, when the real risk is the shared private key's exposure and lack of isolation, which undermines the entire TLS trust model.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the private key in an HSM or cloud key vault and issue unique keys or certificates per gateway.
The biggest cryptographic risk is the shared private key stored in an SMB share, which violates the principle of least privilege and creates a single point of compromise. Using a Hardware Security Module (HSM) or cloud key vault ensures the private key is never exposed in plaintext, and issuing unique keys per gateway eliminates the risk that compromising one gateway exposes the key for all others. This directly addresses the core issue of key confidentiality and isolation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Place the private key in an HSM or cloud key vault and issue unique keys or certificates per gateway.
Why this is correct
Placing the private key in an HSM or cloud key vault ensures the key material never exists in plaintext outside a tamper-resistant boundary, so even a compromised gateway cannot extract it. Issuing unique keys or certificates per gateway additionally limits the blast radius: if one gateway is breached, only its certificate can be revoked and re-issued, while other gateways remain trusted. This directly addresses the root problem of shared static keys and aligns with least-privilege and crypto-agility best practices.
- ✗
Increase the certificate expiration to five years to reduce renewal work.
Why it's wrong here
Extending certificate validity to five years reduces administrative overhead but significantly increases the exposure window if the private key is compromised or a cryptographic algorithm becomes obsolete. It also makes revocation more difficult, because a long-lived certificate that must be revoked is a larger management burden and may remain trusted by clients that do not check revocation lists. This option does nothing to fix the fundamental issue of key storage or the misuse of shared keys across gateways.
- ✗
Keep copying the same key everywhere so failover is easier to manage.
Why it's wrong here
Copying the same private key to every gateway creates a single point of failure: a compromise of any one gateway exposes the identical key, allowing attackers to impersonate all gateways or decrypt any recorded traffic. It also makes key rotation and revocation nearly impossible without disrupting every device simultaneously, and it violates the security principle of compartmentalization. While failover might be simpler, the accompanying security risk far outweighs the operational convenience.
- ✗
Disable certificate validation to avoid user-facing outages.
Why it's wrong here
Disabling certificate validation removes the client's ability to authenticate the gateway or detect a man-in-the-middle, effectively nullifying the confidentiality and integrity guarantees that TLS/SSL are meant to provide. This would expose all traffic to interception and tampering, which is far worse than the short user-facing outage the administrator is trying to avoid. A proper solution would be to fix the certificate chain, deployment, or trust store, not discard the trust mechanism entirely.
Go deeper
Related to this question
Learn chapter
Security Controls
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
SMB
SMB is a network file-sharing protocol that allows applications to read, write, and request services from server programs in a computer network.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.