Skip to content

ACCA Strategic Professional · Strategic Business Leader · IT systems security and control

Orion Retail sends customer order files to a payment processor over the internet. Management wants assurance that only the processor can read the files, even if they are intercepted in transit. Which approach best achieves this?

Encrypting the files with the processor's public key best protects confidentiality, because only the processor's private key can decrypt them. Hashing and signing with Orion's private key give integrity and authenticity but do not hide the content from an interceptor.

  1. AHashing the files before sending
  2. BEncrypting the files with the processor's public key (asymmetric encryption)Correct
  3. CDigitally signing the files with Orion's private key only
  4. DSending the files from a restricted IP address

Explanation

Encrypting with the recipient's public key means only the holder of the matching private key, the processor, can decrypt. Hashing and signing with Orion's private key give integrity and authenticity, but anyone with Orion's public key could read a signed-only file. IP restrictions do not protect intercepted content.

Did you get it right without looking?

One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.

Practise IT systems security and controlFree diagnostic mock

More IT systems security and control questions