2.10 Describe the Impact of Certificates on Security (includes PKI, Public/private Crossing the Network, Asymmetric/symmetric) 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company's internal CA issues a certificate to a web server. Later, the server's private key is suspected of being compromised. The security team revokes the certificate and publishes a CRL. However, some clients are still connecting to the server using the revoked certificate. Which factor most likely explains this?

   • AClients are not configured to check the CRL or OCSP for the certificate.
   • BThe CRL is published but the certificate's serial number is not on it.
   • CThe CRL is not signed by the CA.
   • DThe server is still using the old private key.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A developer is building a mobile app that needs to securely communicate with a backend server. The app will be used by many users, and the developer wants to ensure that the server is authenticated and that the data exchanged is encrypted. The developer is considering using a pre-shared key (PSK) for all users. What is the main security drawback of this approach compared to using certificates?

   • AA PSK cannot encrypt data, only authenticate
   • BA PSK requires a certificate authority to be set up
   • CA PSK is slower than asymmetric encryption
   • DA PSK does not provide server authentication because any client with the key could impersonate the server
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security architect is designing a secure communication system for a large enterprise. The system must support many users and high-volume data transfer. The architect is considering using only asymmetric encryption for all data. What is the primary reason this is not a good design, and what is the recommended alternative?

   • AAsymmetric encryption is slower than symmetric encryption, so use symmetric encryption for bulk data and asymmetric encryption for key exchange
   • BAsymmetric encryption requires too much key management, so use a pre-shared key for all users
   • CAsymmetric encryption cannot provide confidentiality, so use symmetric encryption for all data
   • DAsymmetric encryption is less secure than symmetric encryption, so use only symmetric encryption
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security administrator is configuring a new internal CA. The administrator wants to ensure that if a subordinate CA is compromised, the impact is limited and the root CA key remains secure. Which two practices should be implemented?

   • AStore the root CA private key on a server that is accessible to all users
   • BKeep the root CA offline and use a subordinate CA for daily issuance
   • CUse the root CA to issue all certificates directly and keep it online
   • DUse a single subordinate CA for all purposes and never revoke it
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's security team discovers that a recently departed employee's client certificate is still valid and can be used to authenticate to the corporate VPN. The certificate was issued by the company's internal CA with a validity period of two years. Which action should the security team take to immediately prevent this certificate from being used?

   • ADelete the employee's user account from Active Directory.
   • BAdd the certificate's serial number to the CA's certificate revocation list (CRL) and publish it.
   • CWait for the certificate to expire in two years.
   • DReissue the certificate with a shorter validity period.
   Reveal Solution Discussion Select an answer first