2.11 Identify the Certificate Components in a Given Scenario 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst is troubleshooting a client that fails to establish a TLS 1.2 connection to an internal server. The server presents a certificate issued by an intermediate CA. The client's trust store contains the root CA certificate but not the intermediate CA certificate. The server does not send the intermediate certificate during the handshake. What is the most likely cause of the failure?

   • AThe server certificate has expired, causing the client to reject the connection.
   • BThe client cannot build a valid certificate chain because the intermediate certificate is missing.
   • CThe root CA certificate is not trusted by the client's operating system.
   • DThe client does not support the cipher suite offered by the server.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which X.509 certificate field is used to specify the period during which the certificate is considered valid?

   • ASerial number
   • BSignature algorithm
   • CSubject
   • DValidity
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   When validating a certificate, what is the role of the root CA's self-signed certificate?

   • AIt is used to sign the server's certificate directly
   • BIt provides the server's public key for authentication
   • CIt is used to encrypt the session key during the TLS handshake
   • DIt serves as the trust anchor that is inherently trusted by the client
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In a TLS cipher suite, which component is responsible for establishing a shared secret between the client and server without transmitting the secret itself?

   • AAuthentication algorithm
   • BEncryption algorithm
   • CMAC algorithm
   • DKey exchange algorithm
   Reveal Solution Discussion Select an answer first
6. 30expert · medium

   A security engineer is configuring a TLS 1.2 server that must support clients using both RSA and ECDHE key exchange. The engineer wants to maximize security for clients that support ECDHE while maintaining compatibility for RSA-only clients. Which configuration should be used?

   • AList ECDHE cipher suites first in the server's cipher suite preference, followed by RSA cipher suites.
   • BList RSA cipher suites first to ensure compatibility.
   • CUse a separate port for RSA clients and ECDHE clients.
   • DUse only ECDHE cipher suites and require RSA clients to upgrade.
   Reveal Solution Discussion Select an answer first