SY0-701 Question 44
Single answerDigital signaturesA software company distributes monthly updates to customers through its public download portal. After a recent incident in which attackers posted a malicious file with the same name as a legitimate update, the security team wants a control that allows customers to verify the update truly came from the company and was not modified after release. Which solution best meets this requirement?
- A
Publish a SHA-256 hash of the update file on the same download page
- B
Encrypt the update file with the company's private key before publishing it
- C
Digitally sign the update with the company's code-signing certificate and have customers verify the signature with the corresponding public key
- D
Require customers to download the update only over FTP from the company's internal server
Show answer and explanation
Correct answer: C
Explanation
The best answer is to digitally sign the software update with the company's code-signing certificate. Digital signatures are used to provide integrity, authentication, and support non-repudiation. In practice, the publisher computes a hash of the software and signs that hash with its private key. Customers verify the signature using the publisher's public key, usually through a certificate chain issued by a trusted CA. If the file changes, the recalculated hash no longer matches the signed hash, so verification fails. This aligns with standard PKI and code-signing practices described in common vendor documentation such as Microsoft Authenticode guidance, Apple code-signing documentation, and general NIST guidance on digital signatures and PKI. A standalone hash does not authenticate the publisher, and transport controls alone do not replace the need for a verifiable digital signature on the software package itself.
- A. Incorrect.
Publishing a SHA-256 hash can help detect file changes, but by itself it does not prove the file came from the legitimate company. If an attacker can replace the file on the portal, they may also replace the posted hash. A hash alone provides integrity checking, not authenticated origin.
- B. Incorrect.
This reflects a common misunderstanding of digital signatures. Using a private key to transform an entire file for confidentiality is not how software publishers typically protect authenticity, and it would not be practical for public distribution because anyone would need the public key to recover the content. Digital signatures instead sign a hash of the file with the private key, allowing recipients to verify integrity and origin without treating the whole package as encrypted data.
- C. Correct.
A digital signature created with the company's private key and validated with the corresponding public key provides both integrity and authentication of origin. If the file is altered after signing, signature verification fails. If the signature chains to a trusted code-signing certificate, customers can also validate that the signer is the legitimate publisher. This is the standard control for software authenticity.
- D. Incorrect.
FTP does not provide strong assurances of authenticity or integrity, and an internal server would not be an appropriate distribution point for external customers. Even if a more secure transport were used, transport protection alone would not give customers a portable way to verify the file after download. The question specifically requires proof of publisher origin and no modification after release.