SSCP Systems and Application Security Practice Question
During a virtualized environment security assessment, which THREE of the following are considered risks associated with virtual machine snapshots? (Select three.)
⚠ Common exam trap
SSCP often tests the distinction between snapshot-specific risks and broader virtualization risks like VM sprawl or VM escape, causing candidates to select plausible but incorrect options.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Snapshots may contain unpatched vulnerabilities
Option A is correct because a snapshot captures the VM's disk state at a point in time, including the guest OS and installed applications; if that state predates patching, restoring or mounting the snapshot reintroduces unpatched vulnerabilities into the environment. Option B is correct because snapshots preserve the full contents of the virtual disks (and often memory state), so credentials, keys, and other sensitive data that were later deleted or rotated can persist inside snapshot files such as .vmdk delta disks or .avhd files. Option D is correct because rolling back to a snapshot reverts the entire VM state, including security settings, firewall rules, group policies, and patch levels, potentially undoing hardening or remediation performed after the snapshot was taken. Option C is not a snapshot-specific risk; VM sprawl refers to the uncontrolled proliferation of VMs, not snapshot files, and is a lifecycle/governance issue rather than an inherent snapshot risk. Option E is not correct because VM escape exploits hypervisor or virtualization-layer vulnerabilities, not snapshots themselves; snapshots are a data-exposure and rollback concern, not a mechanism for escaping the VM boundary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Snapshots may contain unpatched vulnerabilities
Why this is correct
Snapshots capture the full VM state, including the guest OS and installed software, at the moment of creation. Restoring one reinstates that captured image, so any patches applied afterwards are lost, reintroducing the unpatched vulnerabilities the snapshot preserved. This directly satisfies the stem's requirement that snapshots constitute a risk.
- ✓
Sensitive data may persist in snapshots
Why this is correct
Snapshots capture the full VM disk state at a point in time, so credentials, keys and regulated records written before the snapshot remain recoverable from the snapshot files even after deletion from the live VM, creating a data-persistence exposure.
- ✗
Snapshots cause VM sprawl
Why it's wrong here
VM sprawl arises from uncontrolled provisioning of new virtual machines, not from snapshots themselves; snapshots consume datastore capacity and can restore stale data, but they do not create additional VMs. It is tempting because snapshots are often taken before cloning or deployment, activities that do accompany sprawl.
- ✓
Snapshots can be used to roll back security configurations
Why this is correct
Reverting a virtual machine to an earlier snapshot restores the entire disk state, including firewall rules, patch levels and account settings. Any security hardening applied after the snapshot is silently undone, reopening previously remediated vulnerabilities and weakening the VM's security posture.
- ✗
Snapshots can be used as an attack vector for VM escape
Why it's wrong here
VM escape exploits hypervisor or virtualisation-layer vulnerabilities to break out of the guest; snapshots are stored state files and provide no execution path across that boundary. It is tempting because snapshots capture memory and disk contents, which feels like a plausible foothold, yet the escape mechanism lies in the hypervisor itself.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.