CISSP Communication and Network Security Practice Question
A company wants to secure email communications for its employees. They need to ensure message confidentiality and integrity, and also verify the sender's identity. Which protocol uses a hierarchical public key infrastructure (PKI) for email encryption and signing?
⚠ Common exam trap
Many exam-takers confuse PGP's Web of Trust with S/MIME's hierarchical PKI, as both can encrypt and sign emails, but only S/MIME relies on a formal CA hierarchy as described in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
S/MIME
S/MIME (Secure/Multipurpose Internet Mail Extensions) is the correct answer because it is specifically designed to provide email encryption and digital signing using a hierarchical public key infrastructure (PKI) based on X.509 certificates. This allows the company to ensure message confidentiality (via encryption), integrity (via hashing and signing), and sender authentication (via certificate validation against a trusted root CA).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
S/MIME
Why this is correct
S/MIME (Secure/Multipurpose Internet Mail Extensions) is a widely adopted standard for public key encryption and digital signing of MIME data, primarily used for email. It leverages a hierarchical Public Key Infrastructure (PKI) where X.509 certificates, issued by trusted Certificate Authorities (CAs), bind public keys to user identities. This enables end-to-end encryption for confidentiality, digital signatures for integrity and non-repudiation, and sender authentication, making it the most suitable choice for securing corporate email communications.
- ✗
PGP
Why it's wrong here
PGP (Pretty Good Privacy) provides robust cryptographic privacy and authentication for data communication, including email. While effective for individual users, PGP primarily employs a decentralized "web of trust" model, where users explicitly sign each other's public keys to establish trust, rather than relying on a centralized hierarchical Public Key Infrastructure (PKI) with Certificate Authorities. This decentralized trust model can be challenging to manage and scale consistently across an entire enterprise for standardized email security.
- ✗
TLS
Why it's wrong here
TLS (Transport Layer Security) is a cryptographic protocol designed to provide communication security over a computer network. It is primarily used to secure the transport layer for protocols like HTTPS (web traffic) and can secure the connection between email servers (SMTP) or between a client and a server (IMAP/POP3). However, TLS encrypts the *channel* of communication, not the email *content* itself from sender to recipient, meaning the email could be decrypted at intermediate servers unless an end-to-end solution is also employed.
- ✗
SSH
Why it's wrong here
SSH (Secure Shell) is a cryptographic network protocol for operating network services securely over an unsecured network. Its primary purpose is to provide secure remote access to computers, enabling secure command-line execution, remote file transfers, and tunneling. SSH is fundamentally designed for securing interactive shell sessions and file transfers, making it entirely unsuitable and irrelevant for securing the content or transport of email communications between users.
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Components
Key term
Hashing
Hashing is a one-way mathematical function that converts any input data into a fixed-length string of characters, called a hash or digest, which is used to verify data integrity and store passwords securely.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.