easyMultiple ChoiceObjective-mapped
SSCP Second pre-image resistance Practice Question
A security analyst needs to verify that a downloaded file has not been tampered with. The publisher provides a SHA-256 hash. Which property of the hash function is being relied upon?
⚠ Common exam trap
Candidates often incorrectly choose collision resistance because it is commonly associated with hash functions. However, the specific scenario of verifying a known hash relies on second pre-image resistance, not collision resistance. Collision resistance prevents finding any two inputs with the same hash, but here the attacker is given the hash of the original and must find a different input with that same hash, which is second pre-image resistance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Second pre-image resistance
When relying on a provided hash to verify file integrity, the security analyst is using second pre-image resistance. This property ensures that given a hash value (the original file's hash), it is computationally infeasible to find another input (a tampered file) that produces the same hash. Thus, if the computed hash matches the provided hash, the file is authentic and unchanged. Collision resistance is a stronger property but not directly required here; second pre-image resistance is the exact requirement for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Avalanche effect
Why it's wrong here
The avalanche effect refers to a small change in input causing a drastic change in output. While important for hash functions, it is not the property directly relied upon for integrity verification using a provided hash.
- ✗
Collision resistance
Why it's wrong here
Collision resistance ensures that it is hard to find any two different inputs that hash to the same value. However, in this scenario, the attacker is given the original hash and must find a different file with that hash, which is second pre-image resistance. Collision resistance is a stronger property but not specifically required.
- ✓
Second pre-image resistance
Why this is correct
Second pre-image resistance is correct. Given the provided SHA-256 hash of the original file, the property ensures that an attacker cannot find a different file that produces the same hash, thus verifying integrity.
- ✗
Pre-image resistance
Why it's wrong here
Pre-image resistance ensures that given a hash, it is hard to find any input that produces it. However, in this scenario, the analyst already has the original file's hash and is comparing computed hash to that. Pre-image resistance is about reversing the hash, not about finding a different input with the same hash. Second pre-image resistance is the correct property.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.