SY0-701 Question 12
Single answerNon-repudiationA procurement manager approves high-value purchase orders through a web portal. After a disputed transaction, the manager claims someone else must have submitted the approval from their workstation. The security team needs a control that provides the strongest evidence that the manager, and not just the device, approved the order. Which solution best addresses this requirement?
- A
Require the manager to digitally sign each approval with their private key stored on a smart card
- B
Record the source IP address and timestamp for every approval request in the web server logs
- C
Require the manager to enter a complex password and change it every 60 days
- D
Encrypt the approval session with TLS 1.3 between the browser and the portal
Show answer and explanation
Correct answer: A
Explanation
Non-repudiation is the ability to prove that a specific party performed an action and cannot credibly deny it later. In practice, digital signatures are the primary technical control used to support non-repudiation because they rely on asymmetric cryptography and the signer's private key. This is stronger than evidence tied only to a device, network location, or shared secret. Security+ commonly distinguishes non-repudiation from related concepts such as confidentiality, integrity, and authentication. Best practice is to combine digital signatures with strong key management, unique user identities, protected private-key storage such as smart cards or hardware tokens, and reliable audit logs. NIST guidance on digital identity and public key infrastructure supports the use of cryptographic signatures and protected authenticators when strong proof of user action is required.
- A. Correct.
Correct. A digital signature created with the user's private key provides non-repudiation because it cryptographically binds the approval to the signer. Storing the private key on a smart card strengthens the control by making key use dependent on possession of the card, and often a PIN, instead of relying only on software-based credentials. This gives much stronger evidence that a specific individual approved the transaction.
- B. Incorrect.
Incorrect. IP addresses and timestamps can support auditing and investigation, but they do not provide non-repudiation. A source IP may identify a workstation, VPN exit point, proxy, or shared network path rather than the individual user. Logs are useful corroborating evidence, but by themselves they do not prove who approved the order.
- C. Incorrect.
Incorrect. Strong passwords improve authentication, but they do not provide true non-repudiation. Passwords can be shared, guessed, stolen, reused, or entered by another person at an unlocked workstation. Because multiple parties could potentially know or use the password, the user can still plausibly deny having performed the action.
- D. Incorrect.
Incorrect. TLS protects data in transit by providing confidentiality and integrity for the session, and it can authenticate the server. However, TLS alone does not prove that a specific individual approved the purchase. It secures the connection, not the user's accountability for the transaction.