Match each cryptographic primitive to its main purpose.
Drag a concept onto its matching description — or click a concept then click the description.
Producing a fixed-length value used to detect changes.
Using the same secret key to encrypt and decrypt data.
Using a public key and private key pair for encryption or decryption.
Proving who signed something and showing it was not changed.
Creating, storing, rotating, and retiring cryptographic keys safely.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Symmetric encryption: Uses a single shared key for encryption and decryption.
Symmetric encryption is efficient for large data, asymmetric encryption enables key exchange and signatures, hash functions ensure integrity, MACs combine integrity and authenticity, digital signatures add non-repudiation, and KDFs strengthen passwords for key use.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Symmetric encryption: Uses a single shared key for encryption and decryption.
Why this is correct
Symmetric encryption correctly uses one shared secret key for both encryption and decryption. This single key must be securely distributed to all parties, and its efficiency makes it suitable for encrypting large volumes of data. The primary challenge is key management and secure key exchange, as anyone possessing the key can decrypt the ciphertext.
Asymmetric encryption: Uses a single shared key for encryption and decryption.
Why it's wrong here
Asymmetric encryption is incorrectly described here because it employs a mathematically linked public and private key pair, not a single shared key. The public key encrypts, while the private key decrypts, enabling secure communication without pre-shared secrets. This design provides key distribution convenience but is computationally heavier than symmetric encryption.
Hash function: Provides non-repudiation and sender authentication.
Why it's wrong here
Hash functions are one-way mathematical algorithms that produce a fixed-size digest, ensuring data integrity by detecting any modification. They do not provide non-repudiation or sender authentication because they involve no secret key or sender identity. Those security services require a digital signature, which uses asymmetric cryptography to bind the hash to the sender.
MAC: Combines integrity and authentication using a shared secret key.
Why this is correct
A MAC (Message Authentication Code) correctly combines integrity and authenticity by using a shared secret key to generate a fixed-size tag over the message. Any change to the message or wrong key causes the tag verification to fail, proving both tamper-resistance and the holder of the secret key as the source. This is a symmetric-key alternative to digital signatures.
Digital signature: Produces a fixed-size digest for data integrity.
Why it's wrong here
Digital signatures do not merely produce a fixed-size digest; that is the role of a hash function. Instead, a digital signature uses the signer's private key to encrypt a hash of the message, providing non-repudiation, sender authentication, and integrity. Verification uses the corresponding public key, which is a fundamentally asymmetric process.
KDF: Derives keys from passwords to increase security.
Why this is correct
A KDF (Key Derivation Function) correctly strengthens passwords by expanding them into cryptographically strong keys of desired length. It incorporates salting to prevent rainbow table attacks and iterative computation to increase the cost of brute-force attempts. This makes passwords less vulnerable to offline guessing while enabling consistent key generation.
Quick reference
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: May 2, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.