SSCP Cryptography Practice Question
A security engineer is designing a key management system for a large enterprise. Which two of the following practices are essential for securing cryptographic keys throughout their lifecycle?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store keys in dedicated hardware security modules (HSMs).
Key storage in hardware security modules (HSMs) and regular key rotation are critical for key security. Storing keys with the data and emailing them violate security best practices. Using a single key for all purposes reduces security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store keys in dedicated hardware security modules (HSMs).
Why this is correct
HSMs provide tamper-resistant storage and protect keys from unauthorized access.
- ✗
Use the same key for encryption, digital signatures, and key exchange.
Why it's wrong here
Using a single key for multiple purposes increases risk; keys should be used only for their intended function.
- ✗
Email keys to authorized users for convenience.
Why it's wrong here
Email is not a secure channel and can be intercepted; keys should never be transmitted in plaintext.
- ✗
Store keys in the same database as encrypted data.
Why it's wrong here
Storing keys alongside encrypted data defeats the purpose of encryption; an attacker who accesses the database can read both.
- ✓
Rotate keys regularly and upon compromise.
Why this is correct
Regular rotation limits the amount of data encrypted with a single key and mitigates damage if a key is compromised.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.