ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Using SSH certificate-based authentication with short-lived certificates satisfies the requirement that no persistent credentials remain on laptops, because the private key is generated transiently and discarded after use. Disabling both password and static public-key logins eliminates the risk of stolen or weak credentials being replayed. SSH in protocol 2 already negotiates strong, integrity-protected encryption, so session confidentiality and tamper resistance are preserved. Long-lived personal key pairs still constitute permanent credentials, password authentication is vulnerable to brute-force and credential reuse, and Telnet-even inside an SSL VPN-adds unnecessary complexity while still exposing Telnet's inherent weaknesses. Therefore, limiting access to SSH protocol 2 and using on-demand, CA-signed user certificates with no static credentials offers the strongest security with less day-to-day key management burden.