Examkin

Question

Difficulty: MediumCIA Triad and Non-Repudiation

A financial organization is implementing a centralized enterprise API gateway to handle high-value B2B fund transfers with external corporate partners. The security team must ensure that once a corporate partner transmits a payment request, they cannot plausibly claim the request was forged or sent by an unauthorized party. Which of the following technical controls directly support non-repudiation for these payment requests? (Select TWO.)

  1. Requiring senders to digitally sign payment payloads using their organization's private cryptographic keyAnswer
  2. Validating sender digital certificates against a mutually trusted Public Key Infrastructure (PKI) Certificate AuthorityAnswer
  3. C
    Computing a SHA-256 message digest of the incoming transaction payload to verify data integrity upon arrival
  4. D
    Encrypting API requests with AES-256 GCM using a pre-shared key shared between the gateway and the partner

Answer

Non-repudiation for payment transactions is directly supported by requiring senders to digitally sign payment payloads using their asymmetric private key and by validating sender certificates against a trusted Public Key Infrastructure (PKI) Certificate Authority.
Non-repudiation ensures that a sender cannot dispute the authenticity of a message or transaction they originated. This security goal requires combining proof of origin with proof of integrity. Digitally signing payloads with an asymmetric private key guarantees that only the key owner could have signed the request. Validating the sender's identity certificate via a trusted Public Key Infrastructure (PKI) binds that key to a verified identity, completing the non-repudiation chain.

Step-by-Step Solution

1
Identify the core security requirement specified in the scenario.
The requirement calls for preventing a sending organization from denying having originated or authorized a payment request, which defines non-repudiation.
Non-repudiation combines authentication of origin with data integrity to ensure actions cannot be denied.
2
Evaluate mechanisms that provide attribution of identity to a specific sender.
Asymmetric digital signatures created with the sender's private key uniquely identify the sender. PKI certificate validation confirms that the sender's public key maps to a verified organization.
Asymmetric cryptography and PKI trust chains satisfy non-repudiation by linking cryptographically signed content to an verified identity.
3
Distinguish non-repudiation controls from integrity verification and symmetric encryption.
Hashing only proves integrity (data was not altered), not identity. Symmetric encryption uses a shared key known to both receiver and sender, preventing unambiguous proof of who created the message.
Integrity checks and symmetric encryption lack unique origin proof.

Key Concept

Non-Repudiation and Asymmetric Cryptography
Rate this question

Topics

CIA Triad and Non-Repudiation

More questions from this topic