A user wants colleagues to be able to send her encrypted email that only she can read. Which key will her colleagues use to encrypt messages to her?

Asymmetric encryption uses a mathematically related key pair. The public key can be distributed freely, while the private key is kept secret by its owner. To send a confidential message, the sender encrypts with the recipient's public key; only the corresponding private key can decrypt it, so only the intended recipient can read the message. In practice, email systems encrypt the message with a random symmetric key and encrypt that key with the recipient's public key, but the principle is the same. Sharing her private key with colleagues would destroy its secrecy, allowing anyone holding it to read all of her encrypted mail and to impersonate her. Encrypting with the sender's private key produces a digital signature, which proves origin and integrity, but anyone with the sender's public key can reverse it, so it provides no confidentiality. Publishing a shared symmetric key in a directory makes it available to everyone with directory access, which defeats confidentiality entirely. Exam caveat: encrypt with the recipient's public key for confidentiality; sign with the sender's private key for authenticity and non-repudiation. Operational check: confirm the user's certificate containing her public key is published in the directory, that her private key is protected on her device or a smart card, and that colleagues' mail clients select her certificate when encrypting.