SY0-701 Question 11
Single answerNon-repudiationA financial services company is moving its contract approval process from paper to a web-based workflow. Management is concerned that an employee might later deny approving a high-value transaction. The security architect must implement a control that provides strong proof of who approved each transaction and detects any post-approval changes to the contract. Which solution BEST meets this requirement?
- A
Require users to log in with usernames and passwords before approving contracts
- B
Encrypt each contract with the recipient's public key before storing it
- C
Apply a digital signature using the approver's private key and validate it with the corresponding public key
- D
Store all approved contracts on a RAID-enabled file server with nightly backups
Show answer and explanation
Correct answer: C
Explanation
Non-repudiation means providing evidence so that a party cannot credibly deny performing an action, such as approving a transaction. In practical Security+ scenarios, the primary technical control associated with non-repudiation is a digital signature. Digital signatures use asymmetric cryptography: the signer uses a private key to sign, and others verify with the corresponding public key. This also provides integrity, because modifications to the signed data invalidate the signature. By contrast, passwords provide authentication but not strong proof against denial, encryption primarily provides confidentiality, and backups/RAID support availability. This aligns with common PKI and digital signature guidance, including NIST documentation on digital signatures and industry best practices for electronic approvals and signed transactions.
- A. Incorrect.
Usernames and passwords provide authentication at login, but by themselves they do not provide strong non-repudiation. A user could claim their password was stolen or shared, and a password-based approval does not inherently provide cryptographic proof that the specific person approved the exact document content.
- B. Incorrect.
Encrypting a contract with the recipient's public key supports confidentiality by ensuring only the intended recipient can decrypt it with their private key. However, confidentiality does not prove who approved the transaction, and encryption alone does not provide non-repudiation of approval.
- C. Correct.
A digital signature created with the approver's private key is the best choice for non-repudiation. The signature binds the approver's identity to the document and also provides integrity checking, because any change to the contract after signing will invalidate the signature. This is the standard mechanism used to provide non-repudiation in electronic transactions when supported by proper key management and certificate validation.
- D. Incorrect.
RAID and backups improve availability and recovery, not non-repudiation. They help preserve data and restore files after failure or corruption, but they do not prove which individual approved a transaction or whether a specific person can later deny taking that action.