SSCP Cryptography Practice Question
A software vendor distributes patches over the internet. Customers must be able to verify that a patch came from the vendor and was not altered in transit. The vendor wants to use a digital signature. Which key should the vendor use to create the signature?
⚠ Common exam trap
The trap here is reversing the roles of public and private keys, or assuming a shared symmetric key can provide non-repudiation for a publicly distributed patch.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The vendor's private key
Digital signatures rely on asymmetric cryptography: the signer uses its private key to sign a hash of the data, and verifiers use the signer's public key to check the signature. Because only the vendor holds its private key, a valid signature proves the patch originated from the vendor and was not altered. Public keys, symmetric keys, and customer keys cannot provide this combination of authenticity and integrity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The vendor's private key
Why this is correct
A digital signature is created by signing a hash of the patch with the signer's private key. Only the vendor possesses this private key, so a successful verification with the corresponding public key proves origin and integrity. This directly satisfies the requirement that customers can confirm the patch came from the vendor and was not modified in transit.
- ✗
The customer's private key
Why it's wrong here
The customer's private key is controlled by the customer, not the vendor, so the vendor cannot use it to sign patches. Even if it could, verification would require the customer's public key, meaning only that customer could validate the patch. This does not allow the broader customer base to verify vendor origin and integrity.
- ✗
A symmetric session key shared with each customer
Why it's wrong here
A shared symmetric key can provide integrity through a MAC, but it cannot provide non-repudiation because both parties know the key. More importantly, the vendor would need a separate secret with every customer, which does not scale for public patch distribution. Digital signatures require asymmetric keys, so a symmetric session key is the wrong tool here.
- ✗
The vendor's public key
Why it's wrong here
The public key is distributed to customers and is used to verify signatures, not to create them. If the vendor signed with its public key, anyone could forge a signature because the public key is not secret. This would destroy both authenticity and non-repudiation, so it cannot meet the requirement.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.