2.11 Identify the Certificate Components in a Given Scenario 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst needs to provide a third-party vendor with a copy of a public certificate for integration testing. The vendor does not need the private key. Which file format should the analyst provide?

   • APKCS#12 (.pfx)
   • BEncrypted private key (.key)
   • CPKCS#7 (.p7b)
   • DBase64-encoded certificate (.crt or .pem)
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A CyberOps analyst is investigating a certificate validation failure for an internal web application. The certificate's subject is 'CN=web.internal.corp' and the issuer is 'CN=Corp Internal CA'. The browser reports that the certificate is not trusted. The analyst verifies that the certificate is within its validity period and that the hostname matches. What is the most likely cause of the failure?

   • AThe certificate's public key is too short
   • BThe certificate is missing the Server Authentication extended key usage
   • CThe issuer certificate is not in the client's trusted root store
   • DThe certificate was signed with SHA-1
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security administrator receives a file with a .p7b extension from a third-party vendor. The file is intended to be used to trust the vendor's internal CA. What does this file contain?

   • AA private key only, used for signing.
   • BOne or more certificates, but no private keys.
   • CA certificate and its corresponding private key, encrypted with a password.
   • DA certificate signing request (CSR) for the vendor's CA.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A network administrator is configuring a web server to support TLS 1.2. The administrator selects the cipher suite TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. During the TLS handshake, which component of this cipher suite is used to authenticate the server to the client?

   • AAES_128_GCM
   • BECDHE
   • CSHA256
   • DRSA
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is reviewing a TLS 1.3 handshake capture and notices that the ClientHello offers only cipher suites that use ephemeral Diffie-Hellman for key exchange. The analyst wants to ensure that the session keys cannot be recovered even if the server's long-term private key is later compromised. Which property of the negotiated key exchange provides this protection?

   • APerfect forward identity
   • BMutual authentication
   • CCertificate pinning
   • DForward secrecy
   Reveal Solution Discussion Select an answer first