1.4 - Cryptographic solutions
Security+ SY0-701 objective 1.4 is a large, heavily tested topic on applied cryptography. A symmetric block cipher such as AES encrypts large volumes of data fast with one shared key, so it fits bulk or streaming data. Asymmetric cryptography uses a public and private key pair, and its correct use is securely exchanging a session key or signing. To verify a signed document, the recipient decrypts the signature with the sender's public key, proving origin and integrity. A self-signed TLS certificate encrypts traffic but browsers will not trust it because no public CA vouches for it. You should also know hashing for integrity, salting, key stretching, PKI, and certificate authorities. Expect scenario questions that describe a data-protection or trust need and ask which cryptographic tool, key or certificate type is correct.
Bulk/fast encryption, one shared key = symmetric (AES). Exchange a session key or sign = asymmetric (public/private). Verify a signature = sender's PUBLIC key. Self-signed cert = encrypts but untrusted. Integrity = hashing.
Practice questions
1. Which technique verifies integrity by producing a fixed-length fingerprint of data?
- Symmetric encryption (AES)
- Hashing (e.g., SHA-256) (correct answer)
- Steganography in images
- Lossless data compression
A hash (SHA-256) maps any input to a fixed-length digest; any change alters the hash, proving integrity. It's one-way (not reversible like encryption).
2. A mobile app needs digital signatures with small keys and low power on constrained hardware. Which is BEST?
- RSA with 4096-bit keys
- ECDSA (elliptic curve) (correct answer)
- Triple DES encryption
- A CRC32 checksum
ECDSA (elliptic-curve) gives equivalent security to RSA with much smaller keys, so it's efficient on constrained/mobile devices. 3DES is legacy; CRC32 isn't a signature.
3. A public server should let clients verify its certificate status without each contacting the CA directly. Enable:
- A wildcard certificate
- A longer key length
- OCSP stapling (correct answer)
- A self-signed certificate
OCSP stapling has the server fetch and 'staple' a recent signed OCSP response to the TLS handshake, so clients get revocation status without querying the CA themselves — faster and more private.
4. A company runs one web server hosting three DIFFERENT domain names and wants a single certificate for all three. Use a:
- A wildcard certificate
- A SAN (multi-domain) certificate (correct answer)
- A code-signing certificate
- A self-signed certificate
A SAN (Subject Alternative Name) certificate lists multiple distinct domain names in one cert. A wildcard covers subdomains of ONE domain (*.example.com), not several different domains.
5. Before running a downloaded installer, a security-conscious admin verifies the vendor's code signature to confirm:
- The installer is free of any malware
- It is authentic and unmodified (correct answer)
- The download finished without errors
- It was approved by the local antivirus
A valid code signature proves the software came from the named publisher and wasn't tampered with since signing (integrity + authenticity). An invalid/absent signature is a warning sign.
6. Which encryption approach uses one shared secret key for both encryption and decryption?
- Asymmetric encryption
- Symmetric encryption (correct answer)
- Hashing functions
- Digital signatures
Symmetric (AES) uses one shared key — fast, good for bulk data, but key distribution is the challenge. Asymmetric uses a public/private key pair.