easyMultiple ChoiceObjective-mapped
SSCP Practice Question: Deploying a new mobile application that handles…
A company is deploying a new mobile application that handles sensitive customer data. Which practice BEST ensures data confidentiality on the device?
⚠ Common exam trap
ISC2 often tests the distinction between access control (screen lock) and data protection (encryption), leading candidates to choose a strong passcode as the best practice for confidentiality, when encryption with a derived key is the actual requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encrypt all sensitive data stored on the device using a key derived from the user's passcode.
Encrypting sensitive data with a key derived from the user's passcode ensures that even if the device is lost or stolen, the data remains unreadable without the passcode. This approach leverages the user's secret to protect confidentiality at rest, which is a fundamental principle of mobile data protection. Technologies like iOS Data Protection and Android File-Based Encryption use similar key derivation from the lock screen credential to encrypt app-specific data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require a strong screen lock passcode.
Why it's wrong here
Screen lock prevents unauthorized access but does not encrypt data.
- ✗
Disable cloud backups for the app.
Why it's wrong here
Prevents data leakage via backup but does not protect data on device.
- ✓
Encrypt all sensitive data stored on the device using a key derived from the user's passcode.
Why this is correct
Encryption at rest ensures data is unreadable without the key.
- ✗
Use app sandboxing to isolate app data from other apps.
Why it's wrong here
Sandboxing prevents access by other apps but does not encrypt data.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.