ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Encrypting the file with the recipient's (vendor's) public key ensures that only the holder of the corresponding private key-the vendor-can decrypt and read the contents, satisfying confidentiality. Adding a digital signature created with the sender's private key binds the sender's identity to the message and enables the vendor to verify authenticity and integrity with the sender's public key. Encrypting with the sender's own private key fails because anyone with the public key could decrypt it. A simple hash provides integrity checking but no confidentiality or authentication. Protecting an AES-encrypted archive by emailing its password separately still exposes the key to interception and provides no strong sender authentication.