SSCP Security Operations and Administration Practice Question
An organization wants to ensure that servers are configured securely before deployment. They plan to use a hardened operating system image and regularly scan for deviations using SCAP. Which concept does this represent?
⚠ Common exam trap
It's easy for candidates to confuse configuration management with patch management, thinking that scanning for deviations always means checking for missing patches, when in fact SCAP scans assess a wide range of configuration settings (e.g., registry keys, file permissions, service states) beyond just patch levels.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configuration management
C is correct because configuration management involves establishing and maintaining consistent baseline configurations for systems, such as using a hardened OS image, and then monitoring for deviations using tools like SCAP (Security Content Automation Protocol). SCAP enables automated vulnerability scanning and compliance checking against defined security baselines, ensuring servers remain in a known secure state before and after deployment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change management
Why it's wrong here
Change management handles changes to systems, not initial secure configuration baselines.
- ✗
Asset management
Why it's wrong here
Asset management tracks inventory, not configuration settings.
- ✓
Configuration management
Why this is correct
Configuration management involves establishing and maintaining baseline configurations and detecting deviations.
- ✗
Patch management
Why it's wrong here
Patch management focuses on applying updates, not secure configuration baselines.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.