CISSP Practice Question: Drag and drop the steps for implementing a…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Hash the message, then encrypt the hash with the sender's private key, then attach the encrypted hash to the message, then verify by decrypting with the public key and comparing hashes.

  Why this is correct

  This is the correct order because digital signatures require first creating a hash of the message to ensure integrity, then signing the hash with the private key to provide authenticity and non-repudiation, then attaching the signature to the message, and finally the recipient verifying by decrypting the signature with the public key and comparing the resulting hash with a freshly computed hash of the message.

• ✗

  Encrypt the hash with the sender's private key, then hash the message, then attach the encrypted hash to the message, then verify by decrypting with the public key and comparing hashes.

  Why it's wrong here

  This sequence is fundamentally flawed because the digital signature process requires the message's hash to be computed *before* it can be encrypted. Attempting to encrypt a hash that has not yet been generated is a logical impossibility. The hash serves as the direct input to the private key encryption function, making its prior existence an absolute prerequisite for creating the signature.

• ✗

  Hash the message, then attach the encrypted hash to the message, then encrypt the hash with the sender's private key, then verify by decrypting with the public key and comparing hashes.

  Why it's wrong here

  This option incorrectly places the attachment of the signature before its creation. A digital signature is the result of encrypting the message hash with the sender's private key. Attaching an unencrypted hash to the message would fail to provide authenticity or non-repudiation, as it's merely a hash, not a cryptographically signed artifact. The 'encrypted hash' must exist as a complete signature before it can be appended to the message for transmission.

• ✗

  Hash the message, then encrypt the hash with the sender's private key, then verify by decrypting with the public key and comparing hashes, then attach the encrypted hash to the message.

  Why it's wrong here

  This order is incorrect because verification is a distinct step performed by the *recipient* after receiving the message and its attached signature. The sender's process culminates in attaching the encrypted hash to the message, making it ready for transmission. Placing the verification step before attachment implies an impossible scenario where the signature is verified before it has even been fully prepared and associated with the message for delivery.

Go deeper

Related to this question