SY0-701 General Security Concepts Practice Question
Exhibit
Backup job design - Generate a random AES key to encrypt 8 TB of archive data - Encrypt the AES key with the backup server’s public key - Store the encrypted AES key alongside the archive - Secondary site must restore the data if the primary backup server is unavailable - Current design stores the corresponding private key only on the primary server
Based on the exhibit, which key management improvement best preserves recoverability if the primary backup server is lost?
⚠ Common exam trap
Many candidates assume storing the key with the backup data (Option A) is efficient, but they overlook that it destroys recoverability when the server is lost, which is the exact failure scenario the question describes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Keep the private key in an HSM or secure escrow with tested recovery procedures.
Storing the private key in a Hardware Security Module (HSM) or secure escrow ensures it remains available even if the primary backup server is lost. HSMs provide tamper-resistant key storage and support tested recovery procedures, which is critical for decrypting backups and maintaining recoverability. This approach separates the key from the backup data, preventing a single point of failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the private key on the same backup server so recovery is faster.
Why it's wrong here
Putting the private key on the same server creates a single point of failure and weakens key protection. If the server is lost, compromised, or destroyed, the organization may also lose the ability to decrypt the backup key material.
- ✗
Replace AES with hashing so the archive no longer needs a key.
Why it's wrong here
AES is a reversible symmetric encryption algorithm used to protect backup data, whereas hashing (e.g., SHA-256) is a one-way deterministic function. Replacing AES with hashing would make the archive irreversible; you could compute a digest but never recover the original data, so the backup becomes unrecoverable. Additionally, hashing provides integrity, not confidentiality, and it still requires secret inputs (like a pepper) or exposes data to offline attacks, so the premise that it eliminates key management is false.
- ✓
Keep the private key in an HSM or secure escrow with tested recovery procedures.
Why this is correct
The private key must be protected separately from the primary backup server so the encrypted AES key can still be recovered if the server is lost. An HSM or secure escrow improves key protection while preserving recoverability, especially when paired with tested restoration procedures and restricted access controls.
- ✗
Send the private key to backup operators by email so they can restore data quickly.
Why it's wrong here
Email is an inherently insecure transport mechanism that involves multiple relays, server-side storage, and potential eavesdropping. Sending the private key to backup operators via email exposes the key to interception, forwarding, and unauthorized access, and it violates the principle of least privilege by distributing key material to individuals who only need access during specific recovery events. Because the private key controls the decryption of all AES-encrypted backup keys, a single email compromise could result in the loss of confidentiality of the entire backup archive, making this an unacceptable recovery method.
Go deeper
Related to this question
Learn chapter
Security Controls
Key term
Hardware security module
A specialized hardware appliance that securely generates, stores, and manages cryptographic keys in a tamper-resistant environment for enterprise security systems.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.