SSCP Security Operations and Administration Practice Question
Which of the following is the primary purpose of a configuration management database (CMDB)?
⚠ Common exam trap
In the SSCP exam, candidates may confuse the CMDB's role as a metadata repository with operational tools like change tracking systems or backup solutions. A CMDB is a vendor-neutral concept that stores configuration item data and relationships to support decision-making.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To provide a centralized repository of configuration items and their relationships
A configuration management database (CMDB) is a centralized repository that stores information about configuration items (CIs) and their relationships. Its primary purpose is to provide a single source of truth for managing IT assets, dependencies, and their interconnections, which is foundational for change management, incident management, and impact analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
To provide a centralized repository of configuration items and their relationships
Why this is correct
A CMDB stores configuration items and the dependencies linking them, giving change and incident teams the impact visibility they need. This centralised record of assets and their relationships is precisely the repository function the question asks for, rather than monitoring, ticketing or licence tracking.
- ✗
To track changes to network devices in real time
Why it's wrong here
A CMDB records configuration items and their relationships as a baseline; real-time device change tracking is network monitoring or syslog tooling. The CMDB is tempting here because it holds device records, but it would be the right choice for impact analysis of a proposed change.
- ✗
To automate the deployment of patches
Why it's wrong here
A CMDB is a repository of configuration items and their relationships, not an execution engine; patch deployment belongs to configuration management or orchestration tooling. The confusion arises because both sit under change management, yet a CMDB would be correct for assessing which services a patch affects.
- ✗
To store backup copies of configuration files
Why it's wrong here
A CMDB holds authoritative attribute and relationship records, not file copies; backup storage is a backup or version-control function. It is tempting because configuration files are configuration items, but a CMDB would be correct for recording which systems depend on a given configuration item.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are key components of a configuration management database (CMDB)? (Select TWO)
medium- A.Password hashes
- B.Change request approvals
- ✓ C.Relationships between configuration items
- D.Incident tickets
- ✓ E.Hardware inventory details such as serial numbers
Why C: Option C is correct because a CMDB's defining feature is storing configuration items (CIs) together with their dependencies and relationships, which enables impact analysis and service mapping. Option E is correct because CIs include hardware assets and their attributes, such as serial numbers, model, and location, which are core inventory data held in the CMDB. Options A, B, and D are not CMDB components: password hashes belong to credential/identity stores such as Active Directory or a secrets vault, change request approvals belong to a change management/workflow system (e.g., ITIL change records), and incident tickets belong to an incident management or ITSM ticketing system, even though these tools may integrate with the CMDB.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.