Which Characteristic Applies to Digital Signatures in Email?

CISA By islever Editorial Last updated Sep 9, 2026

Short answer

C A digital signature remains authentic and validates message integrity regardless of whether the email payload is encrypted.

Question

Which of the following is a characteristic of a digital signature used for securing email transmissions?

The signed message provides confidentiality and availability protection.
The signature on one message can be transferred to another message.
The signature is authentic whether or not it has been encrypted. Correct Answer
The receiver only needs the public key to decrypt the message and verify the signature.

Key Takeaways

Tests the independent function of digital signatures versus encryption, with the common trap confusing public key verification with message decryption.

Digital signatures ensure email authenticity and integrity using asymmetric cryptography. This page clarifies why option C is correct and debunks common misconceptions about key usage.

Common mistake: Option D is frequently chosen because learners mistakenly assume the sender’s public key decrypts the email, whereas it only verifies the signature.

Expert Analysis

Why the Answer Is Correct

Digital signatures rely on hashing and asymmetric cryptography to authenticate the sender and ensure data integrity. Option C correctly states that this verification process operates independently of message encryption. Whether the email body is encrypted or transmitted in plaintext, the cryptographic hash and the sender’s private key signature remain mathematically bound to the original content. This independence ensures that authenticity checks succeed even when confidentiality measures are disabled.

Why the Other Options Are Wrong

Option A incorrectly claims availability and confidentiality, which are handled by access controls and encryption protocols, not signatures. Option B violates cryptographic principles because signatures are uniquely generated from a message hash and cannot be copied or reused across different emails. Option D confuses key functions; the receiver uses their private key to decrypt the email, while the public key solely validates the signature.

Community Comment Notes

Learners consistently recognized that public keys verify signatures rather than decrypt payloads, aligning with PurpleParrot’s explanation that decryption requires the recipient’s private key. Multiple commenters echoed the CISA Review Manual’s stance that signatures validate authenticity and integrity without mandating encryption. As Cisagroup noted, the mechanism “remains authentic regardless of whether the message itself is encrypted.” This consensus reinforces the exam’s focus on separating cryptographic objectives.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always separate cryptographic goals: signatures handle authentication, integrity, and non-repudiation, while encryption handles confidentiality. When reviewing CISA cryptography questions, map each mechanism to its exact purpose before evaluating options.

Frequently Asked Questions

Why can't the public key decrypt the email?

The sender encrypts the message with the recipient's public key, so only the recipient's private key can decrypt it. Public keys only verify signatures.

Do digital signatures provide confidentiality?

No, signatures only guarantee authenticity, integrity, and non-repudiation. Confidentiality requires separate symmetric or asymmetric encryption of the message body.

More CISA FAQ →

Community Votes

100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

PurpleParrot 👍 3 Answered C

option D is not correct as the public key is used to verify the signature, it is not used to decrypt the message. The sender typically encrypts the message with the recipient's public key, and the recipient uses their private key to decrypt it. i go with option C
46080f2 👍 1 Answered C

The CISA Review Manual (Source 1) clarifies that digital signatures validate authenticity and integrity without requiring message encryption. The Sybex Study Guide (Source 2) corroborates this, highlighting that digital signatures rely on hashing and asymmetric cryptography for verification, independent of message encryption.
Cisagroup 👍 1 Answered C

A digital signature is based on public-key cryptography and remains authentic regardless of whether the message itself is encrypted. Encryption ensures confidentiality, but the digital signature only verifies the message's authenticity and integrity.
blehbleh 👍 1 Answered C

Agreed with PurpleParrot

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All CISA Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISA Practice Test →

← Back to CISA Study Guide