2.10 Describe the Impact of Certificates on Security (includes PKI, Public/private Crossing the Network, Asymmetric/symmetric) 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security analyst is investigating a phishing attack where users were tricked into visiting a fake website that presented a valid-looking certificate. The certificate was issued by a legitimate public CA, but it was for a different domain name. The analyst finds that the users ignored the browser warning. What is the most likely reason the certificate was issued for the wrong domain, and what is the best mitigation?

   • AThe attacker used a self-signed certificate, so the organization should add the CA to the trust store
   • BThe attacker stole the private key of the legitimate website, so the organization should revoke the legitimate certificate
   • CThe browser's trust store was compromised, so the organization should reinstall the operating system
   • DThe CA failed to properly validate domain ownership, so the organization should implement certificate transparency monitoring to detect unauthorized certificates
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst is investigating a man-in-the-middle attack on a corporate web application. The analyst finds that users are seeing a certificate warning in their browsers, but some users proceed anyway. The attacker is presenting a certificate that was issued by a CA that is not in the browsers' trust store. What is the primary security control that failed, allowing the attack to succeed for users who clicked through the warning?

   • AEncryption of the session using a strong cipher suite
   • BUse of a strong private key on the server
   • CCertificate validation against the trusted root CA store
   • DCertificate revocation checking via OCSP
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company is planning to migrate from a public CA to an internal CA for its external-facing web applications. The security team is concerned about the impact on customers. Which consideration is most important to address before the migration?

   • ACustomers' browsers must trust the internal root CA, which is not present in their trust stores.
   • BThe internal CA must be kept online to issue certificates.
   • CThe internal CA must use a longer key length than the public CA.
   • DThe internal CA must support OCSP stapling.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst notices that a server's certificate has been revoked because the private key was compromised. The analyst must ensure that clients do not accept the compromised certificate. Which mechanism should the analyst verify is in place?

   • AClients are configured to check the certificate revocation list (CRL) or use OCSP.
   • BThe server's private key is regenerated on the server.
   • CThe certificate's validity period is shortened to one day.
   • DThe certificate is reissued with the same public key.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security engineer is designing a system where a server must prove its identity to clients without exposing its private key. Which action does the server perform during the TLS handshake to prove possession of the private key?

   • AThe server uses its private key to decrypt a symmetric key sent by the client.
   • BThe server signs a message with its private key, and the client verifies the signature using the server's public key.
   • CThe server sends its private key to the client over a secure channel.
   • DThe server encrypts its certificate with its private key and sends it to the client.
   Reveal Solution Discussion Select an answer first