SSCP Systems and Application Security Practice Question
A small accounting firm wants to ensure that if a laptop is lost, the data on its full-disk-encrypted drive cannot be recovered by an attacker who removes the drive and mounts it elsewhere. Which additional control is MOST important to meet this goal?
⚠ Common exam trap
The trap here is assuming that enabling full-disk encryption by itself protects a stolen drive, when the protection depends entirely on how the encryption key is protected.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a strong pre-boot authentication password or PIN that is not stored on the disk.
Encryption at rest only protects a lost device when the key is protected by a secret the attacker does not possess. Requiring pre-boot authentication with a PIN or password ensures the volume master key cannot be unwrapped offline, whereas screen locks, EDR, and backups operate on different threat models and cannot prevent offline decryption of a removed drive.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Install endpoint detection and response software on the laptop.
Why it's wrong here
EDR agents detect malicious behavior on a running endpoint and can isolate it from the network. They do not protect data on a disk that has been physically removed and attached to another system, because the agent does not execute in that context. EDR is complementary but does not address the stated offline attack.
- ✗
Enable a screen saver that locks the console after ten minutes of inactivity.
Why it's wrong here
An inactivity lock protects a running, attended session from a passerby, but it does nothing once the machine is powered off and the disk is removed. The scenario assumes physical possession of the drive, so session-level locking is irrelevant to whether the ciphertext can be decrypted offline.
- ✗
Enforce automatic backup of user documents to a cloud file-sharing service.
Why it's wrong here
Cloud backup improves availability and can help after device loss, but it also spreads copies of the data to additional locations where different controls apply. It does not prevent an attacker from decrypting the original drive, so it fails to meet the requirement and may widen the exposure surface.
- ✓
Configure a strong pre-boot authentication password or PIN that is not stored on the disk.
Why this is correct
Full-disk encryption with a key protector that requires a secret known only to the user means the volume encryption key cannot be unwrapped without that secret. An attacker who extracts the drive still lacks the input needed to decrypt, so pre-boot authentication is the control that converts encryption at rest into meaningful protection for a lost device.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.