2.11 Identify the Certificate Components in a Given Scenario 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6expert · medium

   A security analyst is troubleshooting a certificate validation failure for an internal service. The certificate is issued by an intermediate CA, and the root CA is in the client's trust store. The server sends only its leaf certificate during the handshake. The analyst has access to the intermediate certificate file. What is the most efficient way to resolve the issue?

   • AReplace the leaf certificate with a self-signed certificate
   • BInstall the intermediate certificate in the client's trust store
   • CDisable certificate validation on the client
   • DConfigure the server to send the intermediate certificate during the TLS handshake
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is validating a server certificate chain. The root CA certificate is in the client's trust store. The intermediate CA certificate is not in the trust store, but the server sends it during the handshake. What is the result of the validation?

   • AValidation fails because the intermediate certificate must be in the client's trust store.
   • BValidation succeeds because the client can build the chain using the provided intermediate certificate.
   • CValidation fails because the client must download the intermediate certificate from the CA's website.
   • DValidation succeeds only if the intermediate certificate is also self-signed.
   Reveal Solution Discussion Select an answer first
4. 8expert · medium

   A security analyst is investigating a TLS 1.2 connection that failed validation. The server certificate has a valid signature from a trusted root, but the client still rejects it. The analyst checks the certificate and finds that the 'Validity' field shows 'Not Before: 2023-01-01' and 'Not After: 2023-12-31'. The current date is 2024-06-01. What is the most likely reason for the validation failure?

   • AThe certificate's signature is invalid despite being from a trusted root.
   • BThe certificate is expired, so the client rejects it.
   • CThe certificate is not yet valid because the 'Not Before' date is in the future.
   • DThe certificate has been revoked by the CA.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security administrator needs to deploy a certificate to a web server that requires the private key to be stored in a hardware security module (HSM). The certificate is currently in a PKCS#12 file. What is the best way to import the certificate into the HSM?

   • AGenerate a new key pair in the HSM and create a certificate signing request (CSR) to obtain a new certificate.
   • BUse PKCS#7 to import the certificate and private key into the HSM.
   • CImport the PKCS#12 file directly into the HSM, which will extract the private key.
   • DConvert the PKCS#12 file to PEM format and import the private key into the HSM.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is examining a certificate and sees that the 'Issuer' field is 'CN=Example Root CA' and the 'Subject' field is 'CN=Example Intermediate CA'. The analyst also sees a second certificate where the 'Issuer' is 'CN=Example Intermediate CA' and the 'Subject' is 'CN=web.example.com'. What does this structure represent?

   • AA certificate revocation list
   • BA self-signed certificate pair
   • CA cross-signed certificate pair
   • DA certificate chain with a root CA, an intermediate CA, and a leaf certificate
   Reveal Solution Discussion Select an answer first