SSCP Network and Communications Security Practice Question
A network architect is evaluating a remote access design where users must authenticate with a hardware token and the session must be resistant to replay even if an attacker captures the encrypted traffic. Which protocol property should the architect prioritize?
⚠ Common exam trap
The trap here is equating strong bulk encryption such as AES-256 with replay protection, when replay resistance actually comes from fresh per-session key material and one-time authentication values.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Per-session ephemeral keys established through a Diffie-Hellman exchange.
Replay resistance and forward secrecy depend on fresh, per-session cryptographic material. Ephemeral Diffie-Hellman generates a unique key for each session, so a recorded handshake cannot be replayed against a new session and compromise of one key does not expose others. Static keys and strong bulk encryption alone do not provide these properties, and split tunneling is unrelated to the authentication exchange.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use of a shared static key for all sessions to simplify key management.
Why it's wrong here
A static shared key reused across sessions makes captured traffic more valuable to an attacker because compromise of the key affects every session. It also does not by itself prevent replay of authentication exchanges. Key management simplicity comes at the cost of forward secrecy and replay resistance, which the scenario explicitly requires.
- ✗
Split tunneling so only corporate traffic traverses the encrypted tunnel.
Why it's wrong here
Split tunneling affects routing and performance, not the cryptographic properties of the authentication exchange. It can actually increase risk by exposing the endpoint to untrusted networks while connected. It has no bearing on replay resistance or session key uniqueness, so it does not meet the stated design goal.
- ✓
Per-session ephemeral keys established through a Diffie-Hellman exchange.
Why this is correct
Ephemeral Diffie-Hellman produces a unique session key for each connection, so capturing one session does not reveal past or future keys and replay of old handshake data fails. Combined with the hardware token's one-time values, this provides the forward secrecy and replay resistance the architect needs. This is the property that directly satisfies the requirement.
- ✗
Pre-shared key authentication with AES-256 encryption in tunnel mode.
Why it's wrong here
AES-256 in tunnel mode protects confidentiality but does not guarantee replay resistance if the authentication exchange can be replayed. Pre-shared keys are also static and widely shared, which weakens the identity assurance the hardware token is meant to provide. Strong encryption alone does not address the replay concern in the scenario.
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.