ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Encrypting the entire server disk with a strong symmetric algorithm such as AES-256 ensures that the proprietary files cannot be read if the physical media is lost or stolen, thus maintaining confidentiality. Housing the encryption key inside a hardware security module (HSM) prevents attackers from retrieving the key even if they gain physical access to the server. Requiring engineers to apply digital signatures with organization-issued certificates each time they save or check in a file provides cryptographic integrity and authenticity, allowing any unauthorized modification to be detected.

Calculating and storing MD5 hashes helps verify integrity, but MD5 is considered cryptographically broken and does not protect confidentiality. Relying only on NTFS (or comparable POSIX) file permissions controls access but offers no protection once the server is physically compromised. Password-protected ZIP archives typically use weaker encryption schemes and introduce workflow friction, making them less suitable for seamless collaboration and strong protection.