Examkin

Soru

Zorluk: OrtaCIA Triad and Non-Repudiation

A pharmaceutical research organization operates a platform where external laboratories submit clinical trial data files. To meet regulatory requirements, the security team must implement a mechanism ensuring that a submitting laboratory cannot later deny having submitted a specific file. Which of the following mechanisms best provides this non-repudiation capability?

  1. Asymmetric digital signatures generated using the submitting laboratory's private keyCevap
  2. B
    SHA-256 cryptographic hashing applied to each file prior to transmission
  3. C
    Hash-based Message Authentication Codes (HMAC) calculated using a pre-shared symmetric key
  4. D
    Role-based access control (RBAC) configured to restrict storage bucket permissions

Cevap

Asymmetric digital signatures generated using the submitting laboratory's private key
Asymmetric digital signatures provide non-repudiation because they pair a unique private key (known only to the sender) with a public key. Signing a hash of the file with the private key cryptographically binds the sender's identity to the file payload.

Adım Adım Çözüm

1
Identify the core security requirement
The scenario specifically requires non-repudiation, which prevents an entity from denying the authenticity of their signature or transaction.
Regulatory compliance mandates proof of sender origin and file submission.
2
Evaluate cryptographic properties required for non-repudiation
Non-repudiation requires asymmetric cryptography where the signing key is private and unique to the sender.
Symmetric keys or plain hashes cannot uniquely bind a specific entity to a message because symmetric keys are shared and hashes carry no identity metadata.
3
Select the mechanism that guarantees origin authenticity and integrity
Asymmetric digital signatures combine cryptographic hashing with private key signing.
Only the holder of the private key could create the signature, and anyone with the corresponding public key can verify it.

Anahtar Kavram

Non-Repudiation vs. Integrity and Symmetric Authentication
Bu soruyu puanla

Konular

CIA Triad and Non-Repudiation

Bu konudan daha fazla soru