SY0-701 Question 101
Single answerCryptographicA company is deploying thousands of IoT sensors to remote facilities. The security team needs a cryptographic solution that allows each device to authenticate to the company's management platform over TLS while minimizing CPU usage and battery consumption on the sensors. The solution must also support strong security and practical certificate-based identity management. Which of the following is the BEST choice?
- A
Use RSA 4096-bit certificates for all devices because larger key sizes provide the best performance-to-security balance on constrained hardware
- B
Use elliptic curve cryptography (ECC) certificates because ECC provides strong security with smaller key sizes and lower computational overhead than RSA
- C
Use a pre-shared key (PSK) for all devices because symmetric cryptography is stronger than public key cryptography for device identity
- D
Use SHA-256 hashing instead of certificates because hashing provides device authentication without requiring asymmetric cryptography
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use ECC certificates. In real-world Security+ contexts, candidates are expected to understand not just what cryptographic algorithms do, but where they are most appropriate. For constrained devices such as IoT sensors, ECC is often preferred because it achieves strong security with smaller key sizes than RSA, which reduces CPU usage, memory consumption, storage requirements, and handshake overhead during TLS operations. This directly supports the scenario's goals of efficiency, strong security, and certificate-based identity management. By contrast, RSA 4096-bit increases computational cost, a shared PSK does not provide robust scalable per-device identity, and SHA-256 alone cannot replace certificates or asymmetric authentication. This aligns with common industry guidance and best practices reflected in NIST cryptographic recommendations and standard TLS deployment considerations for resource-constrained systems.
- A. Incorrect.
Incorrect. RSA 4096-bit keys provide strong security, but they are computationally heavier than ECC and are generally a poor fit for constrained IoT devices where CPU, memory, and battery life matter. In this scenario, the requirement is to minimize resource usage while still supporting certificate-based identity management over TLS. Larger RSA keys work against that goal.
- B. Correct.
Correct. ECC is commonly preferred for constrained environments because it provides comparable security to RSA with much smaller key sizes, reducing processing, storage, and bandwidth requirements. This makes ECC well suited for IoT devices that must use certificate-based authentication over TLS while conserving CPU and battery resources.
- C. Incorrect.
Incorrect. A PSK can reduce overhead in some environments, but using one shared key for all devices does not provide strong per-device identity or scalable certificate-based management. If one device is compromised, the shared secret may be exposed, affecting the entire fleet. The scenario specifically calls for practical certificate-based identity management, which PSKs do not satisfy in the same way as unique device certificates.
- D. Incorrect.
Incorrect. SHA-256 is a hashing algorithm used for integrity-related functions, not a standalone mechanism for certificate-based device authentication. Hashing by itself does not establish identity over TLS. Certificates and asymmetric cryptography are used to bind a device identity to a public key, which is what the scenario requires.