SY0-701 Question 34
Single answer1.4 Explain the importance of using appropriate cryptographic solutions.A healthcare company is deploying thousands of IoT medical sensors that send patient telemetry to a cloud analytics platform over untrusted networks. The devices have limited CPU power and battery life, but the company must protect data confidentiality and integrity in transit and support scalable certificate-based authentication. The security architect needs to choose an appropriate cryptographic approach that balances security with device constraints. Which solution is the BEST choice?
- A
Use TLS with ECC-based certificates and ephemeral key exchange suites to reduce computational overhead while maintaining strong security
- B
Use TLS with RSA-4096 certificates on each sensor because larger key sizes always provide the best practical security
- C
Use a pre-shared symmetric key embedded in all sensors to encrypt traffic, since symmetric encryption is faster than asymmetric encryption
- D
Use plaintext telemetry transmission and rely on network segmentation because the sensors operate on a dedicated VLAN
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use TLS with ECC-based certificates and ephemeral key exchange. This aligns with the principle of selecting appropriate cryptographic solutions based on the business and technical environment, not simply choosing the strongest-sounding algorithm. For IoT and other constrained systems, ECC is commonly preferred because it delivers comparable security to RSA with much smaller key sizes and lower processing overhead. TLS provides encryption and integrity protection in transit, while certificates enable scalable authentication. Ephemeral key exchange supports forward secrecy, a widely recommended best practice. This reasoning is consistent with industry guidance such as NIST recommendations on transport security and key management, as well as common best practices for deploying PKI and TLS on resource-constrained devices.
- A. Correct.
Correct. Elliptic Curve Cryptography (ECC) is well suited for constrained devices because it provides strong security with smaller key sizes than RSA, reducing CPU, memory, bandwidth, and power requirements. Using TLS protects confidentiality and integrity in transit, and certificate-based authentication supports scalable identity management. Ephemeral key exchange also supports forward secrecy, limiting the impact if a long-term private key is later compromised. This is an appropriate cryptographic solution because it matches the operational constraints of IoT devices while still meeting security requirements.
- B. Incorrect.
Incorrect. RSA-4096 can provide strong security, but it is typically more computationally expensive than ECC and is often a poor fit for low-power IoT devices. The misconception is that the largest key size is automatically the best option. In practice, Security+ expects candidates to choose cryptography appropriate to the environment. For constrained devices, RSA-4096 may introduce unnecessary performance and battery costs without being the most efficient or practical design choice.
- C. Incorrect.
Incorrect. While symmetric encryption is faster, embedding the same pre-shared key in all sensors creates major key management and security problems. If one device is compromised, the shared key could expose traffic for all devices using that key. This approach also does not provide scalable per-device identity the way certificate-based authentication does. The distractor is plausible because symmetric encryption is efficient, but it is not the best overall cryptographic solution for a large fleet requiring scalable authentication.
- D. Incorrect.
Incorrect. Network segmentation is a useful security control, but it does not replace encryption. Traffic crossing untrusted networks should still be protected against interception and tampering. Plaintext transmission would fail to provide confidentiality or integrity, and VLAN isolation alone is not considered a cryptographic solution. This reflects a common mistake of relying on network architecture instead of implementing proper cryptographic protections.