SY0-701 General Security Concepts Practice Question
An administrator needs to send sensitive configuration details to a remote branch office so only the branch manager can read them. Which cryptographic method is most appropriate?
⚠ Common exam trap
Many candidates confuse integrity mechanisms (hashing, checksums) with confidentiality mechanisms (encryption), assuming any cryptographic operation provides secrecy, when only encryption with the intended recipient's key ensures exclusive readability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encrypting the file so only the intended recipient can decrypt it
Encrypting the file with the branch manager's public key ensures that only the manager, possessing the corresponding private key, can decrypt and read the sensitive configuration details. This asymmetric encryption method directly addresses the requirement of confidentiality and targeted recipient access, unlike hashing or simple labeling.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hashing the file before sending it
Why it's wrong here
A cryptographic hash such as SHA-256 is a one-way, deterministic function that produces a fixed-size digest. It is designed to verify integrity—detecting any change to the file—but it cannot be reversed, so the recipient cannot recover the original configuration details from a hash. More importantly, sending only the hash does not prevent an attacker who intercepts the original file from reading it; confidentiality requires encryption, not integrity hashing.
- ✓
Encrypting the file so only the intended recipient can decrypt it
Why this is correct
Encryption protects confidentiality by making the file unreadable to anyone without the correct key. For sensitive configuration details, encryption is the right tool because the recipient can decrypt the file while unauthorized parties cannot read it in transit or at rest.
- ✗
Using a checksum printed in the email subject line
Why it's wrong here
A checksum, such as a CRC-32 or a simple hash, placed in the email subject line only serves to detect accidental modification or corruption. The subject line is visible in transit and on mail servers, so it does not hide the attachment's contents and actually exposes metadata. An attacker who copies the attachment can still read the plaintext configuration; a checksum merely tells the recipient that the data arrived unchanged, not that it arrived secretly.
- ✗
Appending the word confidential to the file name
Why it's wrong here
Renaming the file to include 'confidential' is a security classification label, not a security control. The label neither encrypts the contents nor restricts who can open the file; anyone with access to the email, file share, or attachment can read the sensitive details. Worse, the label can draw attention to the file's value and signal to an attacker which attachment to target.
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
Learn chapter
Hashing Algorithms
Key term
Hashing
Hashing is a one-way mathematical function that converts any input data into a fixed-length string of characters, called a hash or digest, which is used to verify data integrity and store passwords securely.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.