Examkin

Soru

Zorluk: OrtaCIA Triad and Non-Repudiation

An enterprise e-commerce organization requires external suppliers to digitally approve updated procurement contracts. During an audit, a supplier claims that an internal administrator forged an approval entry and that the supplier never authorized the agreement. Which security objective and technical implementation best prevents the supplier from successfully denying their action?

  1. Non-repudiation implemented via asymmetric digital signatures using the supplier's private keyCevap
  2. B
    Integrity implemented via SHA-256 hashing of the contract file before transmission
  3. C
    Confidentiality implemented via AES-256 symmetric key encryption during session storage
  4. D
    Authentication implemented via multi-factor user login logs stored in a central SIEM

Cevap

Non-repudiation implemented via asymmetric digital signatures using the supplier's private key
Non-repudiation ensures that a sender or signatory cannot deny the authenticity of their signature or submission. In asymmetric cryptography, a digital signature is generated using the signer's private key, which is kept secret by the owner. Because no other entity possesses that private key, a valid signature provides undeniable cryptographic proof of authorization and origin.

Adım Adım Çözüm

1
Identify the core security requirement from the scenario
The organization needs to prevent an entity from falsely denying that they performed a specific action (approving a contract).
Preventing denial of origin or authorization is the defining requirement of non-repudiation.
2
Evaluate technical controls that satisfy non-repudiation
Asymmetric cryptography provides non-repudiation because only the private key owner could have generated the signature.
Since the private key is held exclusively by the supplier, a valid digital signature proves the document was signed by them.
3
Distinguish non-repudiation from integrity, confidentiality, and authentication mechanisms
Hashes verify integrity alone, symmetric keys are shared so they lack origin proof, and login logs do not cryptographically sign document contents.
Only digital signatures combine integrity verification with undeniable proof of origin.

Anahtar Kavram

Non-repudiation and Asymmetric Digital Signatures
Bu soruyu puanla

Konular

CIA Triad and Non-Repudiation

Bu konudan daha fazla soru