A mayor's office disputes whether an emailed contract approval actually came from the city attorney. Which pair of concepts best addresses proving genuine origin and preventing credible denial of the act?
Select an answer to reveal the explanation.
Short Explanation
Authenticity asks 'was this really from the city attorney?' Nonrepudiation asks 'can that person later shrug and say it was not me?' Together they go beyond basic CIA when email approvals are in dispute. Encryption alone does not answer both questions.
Full Explanation
Authenticity addresses whether a message or actor is genuine; nonrepudiation addresses whether a party can later credibly deny having performed an action. When a mayor's office disputes whether an emailed contract approval actually came from the city attorney, the pair that best covers proving genuine origin and preventing credible denial is authenticity and nonrepudiation. Strong identity binding, signing, and auditable approval workflows support both concerns beyond basic secrecy or uptime.
Confidentiality and least privilege protect secrecy and limit access rights; they do not by themselves prove that a disputed email truly originated from the attorney or prevent denial of the approval act. Availability and job rotation address uptime and fraud-deterrent duty changes, not origin proof for a specific message. Data retention and media sanitization govern how long information is kept and how media is wiped; they are not the primary concepts for disputing email authorship of a contract approval.
Exam caveat: When stems emphasize 'really from X' and 'cannot later deny it,' look past CIA defaults to authenticity and nonrepudiation, often implemented with digital signatures, MFA-backed workflows, and immutable logs.
Operational check: Require digitally signed or workflow-system approvals for contracts, disable informal email-only authorization for high-value acts, retain approval audit trails, and verify attorney identity binding before treating an email as binding municipal consent.