ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

Non-repudiation requires that the sender alone could have produced the proof that accompanies each request. An asymmetric digital signature created with the customer's private key satisfies this: only the key holder can generate the signature, and anyone with the corresponding public key can verify it, providing enduring proof of origin and integrity. An HMAC does not offer non-repudiation because both parties share the same secret; either could have produced the MAC, so neither can later be uniquely held accountable. Transport-layer encryption with mutual TLS authenticates the session in real time but does not bind the user to the specific message content once the session ends. Simply hashing and storing requests in a log ensures integrity of stored records but lacks any binding to a particular individual, so it does not prevent repudiation.