CISSP Communication and Network Security Practice Question
An organization wants to secure email communications by providing encryption and digital signatures. They require a solution that uses a web of trust model rather than a hierarchical PKI. Which protocol should they implement?
⚠ Common exam trap
Candidates often confuse S/MIME and PGP because both provide email security, but the key differentiator is the trust model—S/MIME uses a hierarchical PKI, while PGP uses a web of trust—and the question explicitly requires the latter.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PGP/GPG
PGP/GPG implements a web of trust model where users sign each other's keys to establish trust, rather than relying on a centralized Certificate Authority (CA). It provides both encryption and digital signatures for email, making it the correct choice for an organization that explicitly wants to avoid hierarchical PKI.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
S/MIME
Why it's wrong here
S/MIME (Secure/Multipurpose Internet Mail Extensions) provides cryptographic security services for electronic messaging, including authentication, integrity, non-repudiation, and confidentiality. It achieves this by using a hierarchical Public Key Infrastructure (PKI) where trusted Certificate Authorities (CAs) issue and manage digital certificates. While S/MIME effectively secures email content, its reliance on a centralized PKI for key validation differs significantly from the decentralized trust model of PGP/GPG.
- ✗
TLS
Why it's wrong here
Transport Layer Security (TLS) is a cryptographic protocol designed to provide secure communication over a computer network. When applied to email, TLS encrypts the *connection* between a mail client and a server (e.g., SMTP, POP3, IMAP over TLS) or between two mail servers (MTA-to-MTA). However, TLS does not provide end-to-end encryption of the email *message content* itself; the message can be decrypted and re-encrypted at intermediate servers, making it vulnerable at those points.
- ✗
SSH
Why it's wrong here
Secure Shell (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network. Its primary applications include remote command-line login, remote command execution, and secure file transfer (SFTP/SCP). SSH is fundamentally designed for securing interactive sessions and data transfers between specific endpoints, not for encrypting or signing email messages or securing the underlying email protocols like SMTP, POP3, or IMAP.
- ✓
PGP/GPG
Why this is correct
PGP (Pretty Good Privacy) and GPG (GNU Privacy Guard) are comprehensive cryptographic programs that provide end-to-end encryption and digital signing for email communications and files. They enable users to encrypt email content on their local machine before sending it, ensuring only the intended recipient with the corresponding private key can decrypt it. PGP/GPG uniquely employs a decentralized "web of trust" model for public key verification, allowing users to establish trust relationships without relying on a central Certificate Authority.
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Components
Key term
Certificate authority
A trusted entity that issues digital certificates to verify the identity of websites, devices, and users in secure online communications.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.