CISSP Communication and Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  S/MIME

  Why this is correct

  S/MIME (Secure/Multipurpose Internet Mail Extensions) is a standard for public key encryption and signing of MIME data, commonly used for email. It leverages X.509 certificates issued by a Certificate Authority (CA) to provide confidentiality (encryption), integrity, authentication, and non-repudiation for email messages. S/MIME integrates directly into email clients, allowing users to encrypt the entire email body and attachments, and digitally sign messages to verify sender identity.

• ✗

  SSL/TLS

  Why it's wrong here

  SSL/TLS (Secure Sockets Layer/Transport Layer Security) protocols establish an encrypted tunnel between two communicating endpoints, such as an email client and an email server (e.g., SMTP, POP3, IMAP over TLS). While SSL/TLS protects email in transit from eavesdropping and tampering, it does not provide end-to-end encryption of the email content itself, meaning the email resides unencrypted on mail servers. It secures the *connection*, not the *message payload* from sender to recipient's inbox.

• ✓

  PGP/GPG

  Why this is correct

  PGP (Pretty Good Privacy) and its open-source implementation GPG (GNU Privacy Guard) are cryptographic programs that provide cryptographic privacy and authentication for data communication. They enable end-to-end encryption and digital signing of email messages and files, using a "web of trust" model for key validation rather than relying solely on a hierarchical Certificate Authority. PGP/GPG allows users to encrypt the actual content of an email, ensuring only the intended recipient with the corresponding private key can decrypt and read it.

• ✗

  SSH

  Why it's wrong here

  SSH (Secure Shell) primarily establishes secure, encrypted channels for remote command-line access, file transfers (SFTP), and port forwarding. While it provides secure communication, it does not inherently encrypt or sign the content of email messages themselves, nor is it integrated into standard email client/server protocols for end-to-end email security. Its function is at a different layer and for a different purpose than securing email content.

• ✗

  IPsec

  Why it's wrong here

  IPsec (Internet Protocol Security) is a suite of protocols used to secure IP communications by authenticating and encrypting each IP packet in a data stream. It operates at the network layer (Layer 3) of the OSI model, providing secure communication between hosts, networks, or applications. While IPsec can secure the underlying network traffic that carries email, it does not directly encrypt or sign the email message content itself, nor is it designed for application-layer end-to-end email security.

Go deeper

Related to this question