easyMultiple SelectObjective-mapped
SSCP Practice Question: Which TWO of the following are common weaknesses…
Which TWO of the following are common weaknesses in cryptographic implementations that an SSCP should be aware of? (Select exactly 2.)
⚠ Common exam trap
ISC2 often tests the misconception that 'using strong algorithms' or 'following standards' automatically guarantees security, when in fact implementation flaws like weak randomness or poor key management are the real vulnerabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Weak random number generation
Weak random number generation is a critical flaw because cryptographic keys, nonces, and initialization vectors rely on unpredictability. If an attacker can predict or reproduce the random values (e.g., due to a low-entropy source or a flawed PRNG like a linear congruential generator), they can derive secret keys or break session security. This undermines the entire cryptographic system regardless of the algorithm strength.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Weak random number generation
Why this is correct
Predictable random numbers can lead to key compromise.
- ✓
Improper key storage
Why this is correct
Keys stored insecurely can be stolen.
- ✗
Frequent rekeying
Why it's wrong here
Rekeying is a good practice.
- ✗
Using proven encryption algorithms like AES
Why it's wrong here
Using proven algorithms is a strength, not weakness.
- ✗
Following NIST guidelines
Why it's wrong here
Following guidelines is a strength.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.