2.11 Identify the Certificate Components in a Given Scenario 200-201 Practice Questions (Page 7)

Questions 31–35

1. 31expert · medium

   A security administrator needs to provide a third-party vendor with a certificate chain to install on their load balancer. The vendor requires the chain in a single file that can be imported into a Java keystore. The administrator has the server certificate, intermediate certificate, and root certificate in separate PEM files. What is the best way to provide the chain?

   • ACombine the server certificate, intermediate certificate, and root certificate into a single PEM file in that order.
   • BProvide the certificates as separate files and let the vendor import them individually.
   • CCombine the root certificate, intermediate certificate, and server certificate into a single PEM file in that order.
   • DConvert the certificates to PKCS#7 format and provide the .p7b file.
   Reveal Solution Discussion Select an answer first
2. 32expert · medium

   A security analyst is examining a certificate and sees that the 'Key Usage' extension is set to 'Digital Signature' and 'Key Encipherment'. The certificate is used for a TLS server. Which statement is true?

   • AThe certificate can only be used for signing, not for encryption.
   • BThe certificate cannot be used for ECDHE key exchange because it lacks 'Key Agreement'.
   • CThe certificate can be used for both signing and encrypting keys, which is appropriate for RSA key exchange.
   • DThe certificate is invalid because it has both usages.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security analyst is reviewing a server's TLS configuration and sees that it supports TLS 1.0, TLS 1.1, and TLS 1.2. The analyst wants to recommend a configuration that minimizes security risks while maintaining compatibility with modern clients. Which protocol should be the primary recommendation?

   • ASSL 3.0
   • BTLS 1.0
   • CTLS 1.1
   • DTLS 1.2
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Why is TLS 1.3 considered more secure than earlier TLS versions?

   • AIt requires the use of a hardware security module (HSM) for key storage
   • BIt uses a longer key length for all symmetric encryption
   • CIt removes support for weak and obsolete cryptographic algorithms
   • DIt encrypts the entire handshake, including the ClientHello
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security analyst is reviewing a TLS 1.2 server certificate presented by an internal web application. The analyst notices that the certificate's 'Issuer' field contains the same distinguished name as the 'Subject' field, and the certificate has a 'Basic Constraints' extension with CA:TRUE. The certificate is installed on the web server and is trusted by all client workstations. What does this configuration indicate about the certificate?

   • AThe certificate is a subordinate CA certificate that chains to a public root CA.
   • BThe certificate is self-signed and acts as its own trust anchor in the chain of trust.
   • CThe certificate is a leaf certificate that has been incorrectly marked as a CA, causing validation failures.
   • DThe certificate is a cross-signed certificate issued by an external CA but with a matching subject name.
   Reveal Solution Discussion Select an answer first