Examkin

Question

Difficulty: HardCIA Triad and Non-Repudiation

An enterprise DevOps team implements a security policy requiring all software developers to digitally sign Git commits using their individual GPG private keys prior to merging code into the production repository. The central repository server automatically validates each signature against the developer's registered public key. Which of the following security objectives are directly achieved by enforcing this digital signature mechanism? (Select TWO.)

  1. Non-repudiation, by cryptographically binding the author's identity to the commit so the developer cannot deny authoring the code.Answer
  2. Integrity, by ensuring the commit contents have not been altered or tampered with since the signature was applied.Answer
  3. C
    Confidentiality, by encrypting the source code files in transit to prevent unauthorized third parties from viewing repository commits.
  4. D
    Availability, by protecting the central code repository server against distributed denial-of-service (DDoS) traffic.

Answer

The correct options are non-repudiation (binding author identity to code commits via private keys) and integrity (ensuring code has not been tampered with post-signing).
Digital signatures leverage asymmetric cryptography (signing with a private key and verifying with a public key). This mechanism provides non-repudiation because the signature uniquely identifies the key holder who submitted the code, and integrity because any modification to the source code invalidates the cryptographic signature.

Step-by-Step Solution

1
Analyze the technical control described in the scenario.
The scenario describes using asymmetric GPG keys to sign Git commits, where a private key creates the signature and a public key verifies it.
Understanding the underlying cryptographic mechanism determines which security goals are fulfilled.
2
Evaluate how asymmetric digital signatures map to CIA triad pillars and non-repudiation.
Digital signatures provide integrity (detecting data modification via signed hash) and non-repudiation (proving identity via unshared private key).
Because only the private key owner can generate the signature, the signer cannot claim another party authored the code (non-repudiation). Because a hash of the content is signed, changes alter the hash and fail validation (integrity).
3
Evaluate and eliminate incorrect security objectives.
Confidentiality is not provided because signatures do not encrypt the underlying source code. Availability is not provided because signing does not mitigate server downtime or denial-of-service attacks.
Confidentiality requires data encryption, while availability requires redundant architecture and DDoS mitigations.

Key Concept

Digital signatures built on asymmetric cryptography provide both Integrity and Non-Repudiation, but do not provide Confidentiality or Availability.
Rate this question

Topics

CIA Triad and Non-Repudiation

More questions from this topic