You are designing a mobile chat application. You want to ensure that people cannot spoof chat messages by proving that a message was sent by a specific user. What should you do?

The correct answer is D. Use public key infrastructure (PKI) to encrypt the message client-side using the originating user's. A is not correct because although this would encrypt the message, it does not validate either the client or the server. B is not correct because a malicious actor could spoof the user identifier and destination user C is not correct because SSL only requires the server to have…

Submitted by ngozi_ng· Mar 30, 2026Designing for security and compliance

Question

You are designing a mobile chat application. You want to ensure that people cannot spoof chat messages by proving that a message was sent by a specific user. What should you do?

Options

AEncrypt the message client-side using block-based encryption with a shared key.
BTag messages client-side with the originating user identifier and the destination user.
CUse a trusted certificate authority to enable SSL connectivity between the client application and
DUse public key infrastructure (PKI) to encrypt the message client-side using the originating user's

How the community answered

(64 responses)

A
9% (6)
B
5% (3)
C
2% (1)
D
84% (54)

Explanation

A is not correct because although this would encrypt the message, it does not validate either the client or the server. B is not correct because a malicious actor could spoof the user identifier and destination user C is not correct because SSL only requires the server to have a signed certificate and does not require validating the client. D is correct because PKI requires that both the server and the client have signed certificates, validating both the client and the server.

Topics

#PKI#public key encryption#message authentication#non-repudiation

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-ARCHITECT Practice