SY0-701 General Security Concepts Practice Question
A company wants to make sure only approved administrators can view and rotate a shared encryption secret used by several applications. What is the best way to manage that secret?
⚠ Common exam trap
Candidates often think a spreadsheet or source code is acceptable for small teams, but CompTIA emphasizes that any secret shared across applications must be centrally managed with access controls and rotation capabilities to meet security best practices.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a centralized secrets vault or key management system
A centralized secrets vault or key management system (KMS) like HashiCorp Vault or AWS KMS provides role-based access control (RBAC), audit logging, and automatic rotation of secrets. This ensures only approved administrators can view and rotate the shared encryption secret, while applications retrieve it via secure APIs without exposing it in code or files.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store it in a shared spreadsheet
Why it's wrong here
A shared spreadsheet stores secrets as plaintext in a file that lacks fine-grained permissions, making it nearly impossible to restrict access to only approved administrators. Anyone with the file path can copy or share it, and spreadsheet applications typically log no auditable trail of who viewed or modified the data. Key rotation becomes a manual, error-prone process that is easy to skip or botch across multiple copies.
- ✗
Put it directly in application source code
Why it's wrong here
Embedding a secret in application source code exposes it to every developer, test engineer, and CI/CD pipeline with repository read access, and git history permanently retains every past secret even after deletion. Access control is all-or-nothing because code repositories rarely support per-credential authorization, and rotating the key requires modifying, committing, and redeploying the application, which disrupts operations and leaves old secrets in release artifacts and logs.
- ✓
Use a centralized secrets vault or key management system
Why this is correct
A centralized secrets vault or key management system is the best choice because it stores sensitive keys in a controlled place with restricted access, auditing, and rotation support. That makes it easier to limit who can view the secret, track use, and update it safely across multiple applications. It is far more secure than embedding the secret in code or sharing it manually.
- ✗
Email the secret only to trusted administrators
Why it's wrong here
Emailing a secret to trusted administrators creates multiple unencrypted copies stored on mail servers, user clients, and backup systems, with no revocation mechanism if the message is ever resent or the mailbox is compromised. Email protocols such as SMTP lack end-to-end encryption by default, and message-level auditing is limited to headers rather than actual secret access. This approach also provides no centralized rotation workflow, so each recipient independently manages versions of the key, increasing the chance of cross-system drift.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Symmetric vs Asymmetric Encryption
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.