SY0-701 Questions 31-40: General Security Concepts and Cryptography

Correct Answer: B

Explanation: Security+ groups controls by category (technical, managerial, operational, physical) and by type (preventive, deterrent, detective, corrective, compensating, directive). A deterrent control discourages an attacker from trying, which is exactly what warning signs and visible lighting do. A restores systems or fixes problems after an incident. C is an alternative control used when the primary control cannot be implemented. D identifies an incident while or after it happens; the cameras themselves are detective, but the signs are meant to deter.

Reference: CompTIA Security+ SY0-701 exam objectives, 1.1 (security control categories and types)

Correct Answer: D

Explanation: Non-repudiation means the sender cannot deny having sent a message. A digital signature is created with the sender’s private key, which only the sender should hold, and anyone can verify it with the matching public key. That provides proof of origin and also proves the message was not altered. A keeps the service running but proves nothing about who sent what. B hides content, but with a shared key either party could have created the message. C detects accidental changes but does not identify the sender.

Reference: CompTIA Security+ SY0-701 exam objectives, 1.2 (non-repudiation) and 1.4 (digital signatures)

Correct Answer: A

Explanation: In zero trust, the control plane contains the policy engine, which makes the access decision using adaptive identity, threat information, and policy, and the policy administrator, which carries out that decision by setting up or closing the connection. The data plane contains the policy enforcement point, which actually lets traffic through or blocks it, along with the subjects and resources. B ignores where decisions are made. C and D are terms from network devices and cellular networks, not the zero trust model in the Security+ objectives.

Reference: CompTIA Security+ SY0-701 exam objectives, 1.2 (zero trust: control plane and data plane); NIST SP 800-207

Correct Answer: C

Explanation: A honeytoken is fake data, such as a credential, API key, or database record, that has no legitimate use, so any attempt to use it signals an intruder. It is part of deception and disruption technology, along with honeypots, honeynets, and honeyfiles. A is an entire network of decoy systems. B hides data inside other data, such as an image. D replaces sensitive data with a substitute value to protect it, not to detect attackers.

Reference: CompTIA Security+ SY0-701 exam objectives, 1.2 (deception and disruption technology)

Correct Answer: A

Explanation: Change management processes include approval, identified ownership and stakeholders, impact analysis, testing, a backout plan, and a maintenance window, along with updated documentation. Approval and stakeholder communication would have brought in the payment team, impact analysis would have revealed the dependency, a maintenance window would have limited business impact, and a backout plan would have made the change quick to reverse. B, C, and D do not address how changes are planned and controlled.

Reference: CompTIA Security+ SY0-701 exam objectives, 1.3 (change management processes)

Correct Answer: B

Explanation: A salt is a random value added to each password before it is hashed, so identical passwords produce different hashes. That makes precomputed rainbow tables useless, because an attacker would need a separate table for every salt. Key stretching (for example, PBKDF2 or bcrypt) adds many hashing rounds to slow down guessing further. A is wrong because passwords should be hashed, not reversibly encrypted, and encryption does nothing against phishing. C and D are data protection techniques for displaying or storing other data, not for password storage.

Reference: CompTIA Security+ SY0-701 exam objectives, 1.4 (hashing, salting, key stretching)

Correct Answer: D

Explanation: OCSP lets a client ask for the status of one specific certificate and get a signed response, instead of downloading a complete certificate revocation list (CRL). With OCSP stapling, the web server attaches a recent OCSP response to the TLS handshake, which is faster and more private for users. A is what you send to a certificate authority to request a certificate. B covers many subdomains with one certificate. C is trusted only where it has been deliberately installed and says nothing about revocation.

Reference: RFC 6960: Online Certificate Status Protocol (OCSP)

Correct Answer: C

Explanation: A TPM is a chip on the device’s motherboard that securely stores cryptographic keys and supports features such as full-disk encryption and secure boot. Because the keys are tied to that hardware, a drive moved to another computer cannot be unlocked with them. A is a dedicated appliance for managing keys at scale, usually for servers and applications, not built into each laptop. B stores copies of keys for recovery but does not bind them to hardware. D is a distributed ledger, not a key storage device.

Reference: CompTIA Security+ SY0-701 exam objectives, 1.4 (tools: TPM, HSM, key management system, secure enclave)

Correct Answer: A

Explanation: Symmetric algorithms such as AES are fast and suit large amounts of data, but both parties need the same key. Asymmetric cryptography (for example, Diffie-Hellman key exchange or RSA) solves the key distribution problem without a prior shared secret, but it is much slower. Protocols such as TLS combine them: asymmetric methods establish a session key, and symmetric encryption protects the data. B is wrong because asymmetric encryption is much slower. C is wrong because hashing is one-way and cannot be reversed to recover the file. D exposes the key to anyone who intercepts the email.

Reference: CompTIA Security+ SY0-701 exam objectives, 1.4 (symmetric, asymmetric, key exchange)

Correct Answer: D

Explanation: A gap analysis compares the current state of security with a desired state, such as a framework or standard, and identifies the gaps to close. It produces a roadmap rather than a test result. A actively tries to exploit weaknesses. B walks a team through a scenario to practice incident response. C identifies critical business functions and the impact of losing them, which drives recovery objectives.

Reference: CompTIA Security+ SY0-701 exam objectives, 1.2 (gap analysis)