easyMultiple ChoiceObjective-mapped
SSCP Practice Question: Wants to ensure that a software update has not…
An organization wants to ensure that a software update has not been tampered with during download. Which cryptographic technique should be used?
⚠ Common exam trap
Many exam-takers confuse integrity-only mechanisms (hash, MAC) with the combined integrity and authenticity provided by digital signatures, or they mistakenly think encryption (AES) prevents tampering when it only provides confidentiality.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sign the update with the developer's private key
Signing the update with the developer's private key provides both integrity and authenticity. When the user verifies the signature using the developer's public key, they can confirm that the update has not been tampered with and that it originated from the claimed developer. This is the standard approach for ensuring trust in software distribution, as used in code signing certificates (e.g., Authenticode, GPG).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Compute a SHA-256 hash of the update
Why it's wrong here
Hashing provides integrity but no authentication of the source.
- ✓
Sign the update with the developer's private key
Why this is correct
A digital signature ensures integrity and authenticates the developer.
- ✗
Encrypt the update with AES
Why it's wrong here
Encryption provides confidentiality, not integrity.
- ✗
Append a MAC (Message Authentication Code)
Why it's wrong here
A MAC requires a shared secret, which may not be feasible for public downloads.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.