Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

Key Takeaways Explain This Topic AI

Encryption gives confidentiality; hashing gives integrity; digital signatures give integrity, authentication, and non-repudiation.

Symmetric encryption (AES) is fast for bulk data; asymmetric (RSA/ECC) handles key exchange, signatures, and public-key trust.

PKI binds public keys to identities through certificates, certificate authorities, and a trust chain anchored at a protected root.

Certificate failures map to expiration, name mismatch, untrusted issuer, revocation (CRL/OCSP), or private-key exposure.

Store passwords with a salt and a slow algorithm (bcrypt/Argon2/PBKDF2), never reversible encryption or a bare fast hash.

Last updated: June 2026

Start With the Security Goal

Every crypto question is really asking what property do you need? If the goal is secrecy, think encryption . If the goal is detecting modification, think hashing or digital signatures . If the goal is binding a public key to a name, think certificates and PKI .

• Mechanism Primary purpose Key exam phrase
• Symmetric encryption Confidentiality with one shared secret key fast bulk encryption ( AES-256 )
• Asymmetric encryption Public/private key operations key exchange, encrypt to a public key ( RSA , ECC )
• Hashing Integrity via a one-way digest same input yields the same digest ( SHA-256 )
• Salted password hash Defends stored credentials identical passwords get different stored hashes

Digital signature Integrity + signer authentication + non-repudiation sign with the private key, verify with the public key

Certificate Binds a public key to an identity issued by a CA , has a subject and validity period

Remember the CIA mapping: encryption serves confidentiality , hashing and signatures serve integrity , and signatures add authentication and non-repudiation that a plain hash cannot.

Symmetric vs Asymmetric, and Why Both

Symmetric encryption uses one shared key for both encrypt and decrypt; it is fast, so it protects bulk data (full-disk encryption, database backups, VPN payloads). Its hard problem is getting the key to the other side . Asymmetric encryption uses a key pair : anything encrypted with the public key is decryptable only with the matching private key, and vice versa. It is slow, so real systems combine the two.

• Requirement Best answer direction
• Encrypt a large database backup efficiently Symmetric (AES)
• Safely agree on a session key with a remote website Asymmetric key exchange, then symmetric session encryption
• Verify a downloaded file was not altered Hash comparison
• Prove a package came from the developer unmodified Digital signature
• Bind a web server's public key to a domain Certificate
• Store user passwords Salted, slow password hash
• Make encrypted data instantly unrecoverable Destroy the key (crypto-shredding)

TLS is the canonical hybrid: asymmetric crypto authenticates the server and negotiates a shared secret, then a fast symmetric cipher protects the bulk traffic. That is why "asymmetric for key exchange, symmetric for the data" is a recurring correct answer.

Hashing, Salting, and Password Storage

A hash is a one-way digest: you cannot decrypt it back to the original. Good hashes resist collisions (two inputs, same digest), which is why MD5 and SHA-1 are deprecated and SHA-256 is preferred. For passwords , a plain fast hash is still wrong because attackers precompute rainbow tables .

• Defense What it stops
• Salt (unique random value per password) Rainbow tables and identical-password matching
• Pepper (secret added value, stored separately) Offline cracking if only the database leaks
• Key stretching (bcrypt, Argon2, PBKDF2) Brute force, by making each guess deliberately slow
• Trap Callout: Hashing Is Not Encryption

There is no "decrypt the hash" step. A login system hashes the submitted password with the stored salt and compares digests. If a scenario needs the original data back, hashing is the wrong tool; if it needs proof of integrity , encryption alone is the wrong tool. HMAC adds a secret key to a hash so it also proves the message came from someone holding that key.

PKI, Certificates, and Failure Clues

Public Key Infrastructure (PKI) binds public keys to identities through signed certificates and a chain of trust.

• Component Role
• Certificate Authority (CA) Issues and signs certificates
• Registration Authority (RA) Verifies identity before issuance in some designs
• Certificate ( X.509 ) Holds subject, public key, issuer, validity, SAN , extensions
• Private key Must be protected; its exposure breaks trust for that cert
• CRL / OCSP Revocation checking (list vs real-time query)
• Root CA Offline trust anchor, guarded heavily
• Intermediate CA Issues certs so the root stays offline

• Browser or service clue Likely issue
• Certificate expired yesterday Validity-period problem
• Valid for app.example.com but user visits pay.example.com Name mismatch (subject/SAN)
• Issuer is not trusted Missing or untrusted CA chain
• Private key was exposed Revoke and reissue the certificate
• Certificate was revoked Do not trust even if dates look valid
• Self-signed cert on a public site Trust warning unless explicitly trusted
• Scenario Walkthrough

A team publishes an installer and wants customers to confirm it is unaltered and genuinely theirs. A bare hash detects accidental change, but an attacker can post a new hash beside a tampered file. A digital signature is stronger: the team signs with its private key and customers verify with the public key via a trusted certificate, delivering integrity, authentication, and non-repudiation at once.