Pass Your CompTIA SY0-701 Exam Easy!

A firmware password can limit setup changes but cannot cryptographically attest measured startup state to a verifier. Authentication checks a claimant, but it does not automatically narrow resource privileges or invalidate a different leaked secret. In the reported situation, a device boot policy needs a hardware-backed measurement of the startup state to support trusted attestation. The effective mechanism is “A TPM sealing or attesting measurements tied to platform state”: a trusted platform module can bind cryptographic operations to measured boot evidence.

Disk encryption protects data at rest but does not supply an independent measurement of the boot chain. The evidence is a device boot policy needs a hardware-backed measurement of the startup state to support trusted attestation. Encryption addresses readability of protected data. Authentication, correct permissions and availability must still be enforced separately. By contrast, “A TPM sealing or attesting measurements tied to platform state” operates on the specific concern: a trusted platform module can bind cryptographic operations to measured boot evidence.

An allowlist can reject unauthorized boot components but does not itself provide hardware-attested startup measurements. Cryptographic controls differ by function: encryption conceals information, signatures provide integrity and signer authentication, and key management governs the secrets and trust supporting both. Here the decisive fact is a device boot policy needs a hardware-backed measurement of the startup state to support trusted attestation. “A TPM sealing or attesting measurements tied to platform state” matches that requirement because a trusted platform module can bind cryptographic operations to measured boot evidence.

Publication increases exposure and provides no certificate-status validation. A certificate check is about peer identity, signer trust or revocation. It cannot replace a separate application permission or endpoint control. In the reported situation, its private key was reported compromised yesterday. The effective mechanism is “Check revocation information through supported OCSP or CRL processing”: validity dates alone do not reveal a certificate withdrawn before its scheduled expiry.

Record size does not report whether an issuer revoked the certificate. The evidence is its private key was reported compromised yesterday. Encryption addresses readability of protected data. Authentication, correct permissions and availability must still be enforced separately. By contrast, “Check revocation information through supported OCSP or CRL processing” operates on the specific concern: validity dates alone do not reveal a certificate withdrawn before its scheduled expiry.

A matching name does not prove that the compromised certificate remains trustworthy. Cryptographic controls differ by function: encryption conceals information, signatures provide integrity and signer authentication, and key management governs the secrets and trust supporting both. Here the decisive fact is its private key was reported compromised yesterday. “Check revocation information through supported OCSP or CRL processing” matches that requirement because validity dates alone do not reveal a certificate withdrawn before its scheduled expiry.

Local storage protection cannot establish remote certificate trust. Encryption addresses readability of protected data. Authentication, correct permissions and availability must still be enforced separately. Here the decisive fact is a browser receives a valid-looking leaf certificate issued by an intermediate not anchored to any trusted authority. “Validation of the certificate chain to a trusted root” matches that requirement because a plausible leaf cannot authenticate an endpoint without an acceptable issuer path.

Password storage is independent of certificate-chain verification. The evidence is a browser receives a valid-looking leaf certificate issued by an intermediate not anchored to any trusted authority. Integrity evidence helps detect unauthorized changes only when compared with a trusted reference; it is not a substitute for authorization or confidentiality. By contrast, “Validation of the certificate chain to a trusted root” operates on the specific concern: a plausible leaf cannot authenticate an endpoint without an acceptable issuer path.

A strong cipher does not supply a missing trusted issuer. Cryptographic controls differ by function: encryption conceals information, signatures provide integrity and signer authentication, and key management governs the secrets and trust supporting both. Here the decisive fact is a browser receives a valid-looking leaf certificate issued by an intermediate not anchored to any trusted authority. “Validation of the certificate chain to a trusted root” matches that requirement because a plausible leaf cannot authenticate an endpoint without an acceptable issuer path.

Keeping plaintext directly undermines the one-way password-storage goal. Integrity evidence helps detect unauthorized changes only when compared with a trusted reference; it is not a substitute for authorization or confidentiality. Here the decisive fact is both users chose the same password. “Use distinct cryptographic random salts with a slow password hashing algorithm” matches that requirement because per-user salts randomize identical passwords, while work factors increase guessing cost.

In-transit protection does not change exposed hash values after a database breach. Backups and replicated copies mainly serve recovery and resilience; they do not inherently prevent an attacker from obtaining present access. In the reported situation, both users chose the same password. The effective mechanism is “Use distinct cryptographic random salts with a slow password hashing algorithm”: per-user salts randomize identical passwords, while work factors increase guessing cost.

A fast unsalted digest retains the identical-password comparison and rainbow-table exposure. The evidence is both users chose the same password. Integrity evidence helps detect unauthorized changes only when compared with a trusted reference; it is not a substitute for authorization or confidentiality. By contrast, “Use distinct cryptographic random salts with a slow password hashing algorithm” operates on the specific concern: per-user salts randomize identical passwords, while work factors increase guessing cost.

The private key must remain under the applicant's custody; disclosing it to the CA is unnecessary and defeats key confidentiality. Encryption addresses readability of protected data. Authentication, correct permissions and availability must still be enforced separately. Here the decisive fact is a web administrator keeps a server private key locally and asks a trusted certificate authority to issue a TLS certificate for the server public key. “A certificate signing request containing the public key and identity information, signed using the corresponding private key” matches that requirement because a CSR binds an applicant public key to requested subject attributes and can demonstrate possession of the private key without disclosing the secret.

Ephemeral session keys are negotiated during connections rather than supplied to a CA as a certificate enrollment request. The evidence is a web administrator keeps a server private key locally and asks a trusted certificate authority to issue a TLS certificate for the server public key. Browser and web-origin mechanisms affect one request path; the right diagnosis depends on whether the client or trusted server is performing the sensitive action. By contrast, “A certificate signing request containing the public key and identity information, signed using the corresponding private key” operates on the specific concern: a CSR binds an applicant public key to requested subject attributes and can demonstrate possession of the private key without disclosing the secret.

A CRL communicates revoked issued certificates and does not request creation of a new server certificate. A certificate check is about peer identity, signer trust or revocation. It cannot replace a separate application permission or endpoint control. Here the decisive fact is a web administrator keeps a server private key locally and asks a trusted certificate authority to issue a TLS certificate for the server public key. “A certificate signing request containing the public key and identity information, signed using the corresponding private key” matches that requirement because a CSR binds an applicant public key to requested subject attributes and can demonstrate possession of the private key without disclosing the secret.

Exposing the key defeats confidentiality of the archived data. Backups and replicated copies mainly serve recovery and resilience; they do not inherently prevent an attacker from obtaining present access. Here the decisive fact is must also retrieve records when a former key custodian leaves. “Documented recovery-key escrow under dual control” matches that requirement because approved custodians need a controlled recovery process without depending on a single employee.

Destroying the sole recovery secret makes protected data unrecoverable. The evidence is must also retrieve records when a former key custodian leaves. Backups and replicated copies mainly serve recovery and resilience; they do not inherently prevent an attacker from obtaining present access. By contrast, “Documented recovery-key escrow under dual control” operates on the specific concern: approved custodians need a controlled recovery process without depending on a single employee.

Unrestricted distribution eliminates meaningful custody and accountability. Cryptographic controls differ by function: encryption conceals information, signatures provide integrity and signer authentication, and key management governs the secrets and trust supporting both. Here the decisive fact is must also retrieve records when a former key custodian leaves. “Documented recovery-key escrow under dual control” matches that requirement because approved custodians need a controlled recovery process without depending on a single employee.

Co-locating the map reverses the privacy benefit immediately. Cryptographic controls differ by function: encryption conceals information, signatures provide integrity and signer authentication, and key management governs the secrets and trust supporting both. In the reported situation, must not be able to reconstruct the true identifier. The effective mechanism is “Restrict the token-to-value lookup vault to authorized roles”: keeping the map isolated makes tokens useful without exposing the protected original to all consumers.

Logs become another unrestricted place containing identifiers. The evidence is must not be able to reconstruct the true identifier. Telemetry provides evidence and may trigger a response; it does not automatically deny a transaction or remediate its cause. By contrast, “Restrict the token-to-value lookup vault to authorized roles” operates on the specific concern: keeping the map isolated makes tokens useful without exposing the protected original to all consumers.

Deterministic reversible encoding makes recovery easy without vault authorization. Access entitlements govern which specific operations a principal may perform; granting broad roles can expand the damage of credential compromise. Here the decisive fact is must not be able to reconstruct the true identifier. “Restrict the token-to-value lookup vault to authorized roles” matches that requirement because keeping the map isolated makes tokens useful without exposing the protected original to all consumers.

Certificate pinning concerns peer identity, not local storage size. Capacity controls can improve throughput and resilience, but do not resolve trust, integrity or improper permission boundaries. Here the decisive fact is a client application accepts a self-signed server certificate supplied during an untrusted Wi-Fi session. “Endpoint impersonation despite transport encryption” matches that requirement because an attacker may provide its own certificate and negotiate an encrypted session with the wrong peer.

A local password hash does not establish trust in the presented server key. Integrity evidence helps detect unauthorized changes only when compared with a trusted reference; it is not a substitute for authorization or confidentiality. In the reported situation, a client application accepts a self-signed server certificate supplied during an untrusted Wi-Fi session. The effective mechanism is “Endpoint impersonation despite transport encryption”: an attacker may provide its own certificate and negotiate an encrypted session with the wrong peer.

No physical credential is involved in the TLS server authentication path. Physical mechanisms address passage or impact at a location; they cannot directly repair software validation and network authorization defects. Here the decisive fact is a client application accepts a self-signed server certificate supplied during an untrusted Wi-Fi session. “Endpoint impersonation despite transport encryption” matches that requirement because an attacker may provide its own certificate and negotiate an encrypted session with the wrong peer.

Whole-archive protection may require broad decryption even for narrow queries. Encryption addresses readability of protected data. Authentication, correct permissions and availability must still be enforced separately. In the reported situation, a large encrypted archive has frequent random reads to different records. The effective mechanism is “Record-level encryption with managed field keys”: granular ciphertext boundaries allow controlled retrieval of specific sensitive records.

Access restrictions do not give ciphertext-level separation for individual records. The evidence is a large encrypted archive has frequent random reads to different records. Backups and replicated copies mainly serve recovery and resilience; they do not inherently prevent an attacker from obtaining present access. By contrast, “Record-level encryption with managed field keys” operates on the specific concern: granular ciphertext boundaries allow controlled retrieval of specific sensitive records.

Watermarks cannot provide cryptographic confidentiality of record data. Cryptographic controls differ by function: encryption conceals information, signatures provide integrity and signer authentication, and key management governs the secrets and trust supporting both. Here the decisive fact is a large encrypted archive has frequent random reads to different records. “Record-level encryption with managed field keys” matches that requirement because granular ciphertext boundaries allow controlled retrieval of specific sensitive records.

A salt protects password verification values, not hidden image payloads. Integrity evidence helps detect unauthorized changes only when compared with a trusted reference; it is not a substitute for authorization or confidentiality. Here the decisive fact is an employee wants to prove that an image secretly contains a note without displaying any visible extra text. “Steganography embedding information in innocuous media” matches that requirement because the technique conceals the existence of the hidden content rather than simply encrypting visible text.

Tokenization substitutes identifiers but does not hide a message in the image. Cryptographic controls differ by function: encryption conceals information, signatures provide integrity and signer authentication, and key management governs the secrets and trust supporting both. In the reported situation, an employee wants to prove that an image secretly contains a note without displaying any visible extra text. The effective mechanism is “Steganography embedding information in innocuous media”: the technique conceals the existence of the hidden content rather than simply encrypting visible text.

Revocation concerns a credential's trust status, not covert image content. Encryption addresses readability of protected data. Authentication, correct permissions and availability must still be enforced separately. Here the decisive fact is an employee wants to prove that an image secretly contains a note without displaying any visible extra text. “Steganography embedding information in innocuous media” matches that requirement because the technique conceals the existence of the hidden content rather than simply encrypting visible text.

Continued use perpetuates the same compromise path. Encryption addresses readability of protected data. Authentication, correct permissions and availability must still be enforced separately. In the reported situation, leaves an old compromised key able to decrypt newly generated records. The effective mechanism is “Use a fresh active data-encryption key and prevent new data from using the compromised one”: rotation must change which key protects future content, not merely relabel the original secret.

Further distribution increases exposure instead of separating new ciphertext. The evidence is leaves an old compromised key able to decrypt newly generated records. Cryptographic controls differ by function: encryption conceals information, signatures provide integrity and signer authentication, and key management governs the secrets and trust supporting both. By contrast, “Use a fresh active data-encryption key and prevent new data from using the compromised one” operates on the specific concern: rotation must change which key protects future content, not merely relabel the original secret.

Query wait settings do not restrict compromised-key decryptability. Cryptographic controls differ by function: encryption conceals information, signatures provide integrity and signer authentication, and key management governs the secrets and trust supporting both. Here the decisive fact is leaves an old compromised key able to decrypt newly generated records. “Use a fresh active data-encryption key and prevent new data from using the compromised one” matches that requirement because rotation must change which key protects future content, not merely relabel the original secret.