Which statement about digitally signing a document is true?

Encrypting the entire document with the private key is not how digital signing works - only the hash is encrypted, not the document itself.

The document is first run through a cryptographic hash function (e.g., SHA-256) to produce a fixed-length digest, and that digest is then encrypted with the sender's private key to form the signature. This approach is efficient because only the small hash is encrypted rather than the full document, and it proves both identity (only the private key owner could sign it) and integrity (any change to the document produces a different hash).

The public key is used by recipients to verify (decrypt) the signature, not to hash or encrypt; hashing and signing are separate independent operations.

Encrypting the document with the public key describes asymmetric encryption for confidentiality, not a digital signature; digital signatures use the private key to sign.