easyMultiple Choice
SSCP Practice Question: Wants to ensure that a software update has not…
An organization wants to ensure that a software update has not been tampered with during download. Which cryptographic technique should be used?
⚠ Common exam trap
Many exam-takers confuse integrity-only mechanisms (hash, MAC) with the combined integrity and authenticity provided by digital signatures, or they mistakenly think encryption (AES) prevents tampering when it only provides confidentiality.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sign the update with the developer's private key
Signing the update with the developer's private key provides both integrity and authenticity. When the user verifies the signature using the developer's public key, they can confirm that the update has not been tampered with and that it originated from the claimed developer. This is the standard approach for ensuring trust in software distribution, as used in code signing certificates (e.g., Authenticode, GPG).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Compute a SHA-256 hash of the update
Why it's wrong here
A SHA-256 hash detects modification only if the expected digest arrives through a separate trusted channel; comparing against a value downloaded alongside the file proves nothing. Hashing is tempting because it is cheap, but it would be correct for verifying integrity when the reference digest is already known securely.
- ✓
Sign the update with the developer's private key
Why this is correct
Signing the update with the developer's private key lets recipients verify it using the corresponding public key. Any modification during download invalidates the signature, and only the private-key holder could have produced it, satisfying the integrity and authenticity requirement the stem describes.
- ✗
Encrypt the update with AES
Why it's wrong here
AES encryption provides confidentiality, not integrity, so it cannot detect whether the downloaded update was altered in transit. Hashing or a digital signature is required for tamper detection. AES is tempting because it protects data, and would be correct when the update's contents must remain secret from unauthorised parties.
- ✗
Append a MAC (Message Authentication Code)
Why it's wrong here
A MAC appended after download cannot verify integrity because an attacker who alters the update can recompute the MAC; a digital signature using the vendor's private key is required. MACs are tempting because they detect tampering, and would be correct when sender and receiver already share a secret key over a trusted channel.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.