Study guide 3: Cryptographic solutions
Domain 1: General Security Concepts · Not started
Main exam topics
Security controls; confidentiality, integrity and availability; authentication and authorization; zero trust; physical security; change management; non-repudiation; encryption, hashing, certificates and digital signatures.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Lesson plan · 90 minutes
By the end of this lesson you will be able to:
- Compare symmetric, asymmetric and hashing algorithms
- Explain how digital signatures and certificates work
- Describe CSR, revocation (CRL/OCSP) and key escrow
- Apply encryption to disks, databases and transport, including PFS and salting
Topic 3A — Algorithms
Symmetric encryption (AES) uses one shared key and is fast for bulk data; the hard part is distributing the key. Asymmetric encryption (RSA, ECC) uses a public/private key pair and solves key exchange but is slower. Longer keys resist brute force. Hashing (SHA-256) produces a fixed digest and is one-way; it proves integrity. A digital signature is a hash encrypted with the sender's private key — anyone with the public key can verify integrity, authentication and non-repudiation.
Topic 3B — Public key infrastructure
A certificate authority signs digital certificates that bind a public key to a subject. Trust chains to a root CA; intermediates issue day-to-day certificates. A server creates a key pair and sends a certificate signing request (CSR) to the CA. Subject Alternative Name lists the valid hostnames; wildcards cover one subdomain level. Compromised certificates are revoked and published via CRL or checked live with OCSP (stapling improves speed). Keys are generated, stored, rotated and destroyed under key management; escrow lets an authorized party recover keys. TPMs, HSMs and secure enclaves protect keys in hardware.
Topic 3C — Cryptographic solutions
Data at rest uses full-disk encryption (BitLocker), file encryption or database encryption (TDE, column-level). Data in transit uses TLS and IPsec. Perfect forward secrecy uses ephemeral keys so stealing a server key later cannot decrypt past sessions. Salting adds random data to each password before hashing to defeat rainbow tables; key stretching (PBKDF2, bcrypt) slows brute force. Blockchain gives a tamper-evident ledger. Obfuscation — steganography, tokenization, data masking — hides data rather than mathematically encrypting it.
Know the difference: Symmetric vs. asymmetric
| Aspect | Symmetric | Asymmetric |
|---|---|---|
| Keys | One shared secret | Public/private pair |
| Speed | Fast, bulk data | Slow, key exchange & signatures |
| Examples | AES, ChaCha20 | RSA, ECC, Diffie-Hellman |
Saved