easyMultiple ChoiceObjective-mapped
SSCP Practice Question: A small business with 20 employees uses a legacy…
A small business with 20 employees uses a legacy customer relationship management (CRM) application that supports only RC4 encryption for data transmission between the client and server. The company must comply with a new industry regulation that mandates the use of strong encryption (e.g., AES or TLS 1.2+). The IT manager has attempted to upgrade the CRM application, but the vendor has discontinued support and no updates are available. The company cannot afford to replace the CRM immediately, but must achieve compliance within 60 days. The network consists of a single Windows Server 2016 running the CRM server application and 20 Windows 10 workstations. All systems are on a flat internal network. The IT manager proposes several options. Which action is the most appropriate to achieve compliance?
⚠ Common exam trap
Candidates often think a VPN or reverse proxy 'wraps' the weak encryption to achieve compliance, but the regulation requires the application itself to use strong encryption, not just the network tunnel.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Replace the legacy CRM application with a modern web-based CRM that supports TLS 1.2.
Replacing the legacy CRM with a modern web-based CRM that supports TLS 1.2 directly satisfies the regulation's requirement for strong encryption (AES or TLS 1.2+). This is the only option that eliminates the use of RC4 entirely and achieves compliance within the 60-day timeframe, as the company cannot upgrade the unsupported legacy application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Replace the legacy CRM application with a modern web-based CRM that supports TLS 1.2.
Why this is correct
Replacing the application ensures strong encryption is used and achieves compliance.
- ✗
Continue using RC4 and accept the risk, since the network is isolated.
Why it's wrong here
Accepting the risk violates the regulation and is not compliant.
- ✗
Place a reverse proxy in front of the CRM server that terminates TLS and forwards requests to the server using RC4.
Why it's wrong here
The proxy does not protect traffic between the proxy and the server, which remains in RC4.
- ✗
Deploy a VPN tunnel between each workstation and the server to encapsulate the RC4 traffic.
Why it's wrong here
A VPN does not address the vulnerability; RC4 traffic is still used inside the tunnel and could be exposed at the server.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.