2.11 Identify the Certificate Components in a Given Scenario 200-201 Practice Questions (Page 8)

Questions 36–38

1. 36foundation · easy

   Which key exchange method provides forward secrecy by generating a new ephemeral key pair for each session?

   • ADiffie-Hellman (static DH)
   • BRSA key exchange
   • CPre-shared key (PSK)
   • DEphemeral Diffie-Hellman (DHE or ECDHE)
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   During a TLS 1.2 handshake, the client and server agree on a cipher suite such as TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. In this cipher suite, which component is responsible for verifying the identity of the server?

   • AECDHE (key exchange)
   • BRSA (authentication)
   • CSHA256 (MAC)
   • DAES_128_GCM (encryption)
   Reveal Solution Discussion Select an answer first
3. 38expert · hard

   A security analyst is analyzing a TLS 1.2 handshake and sees the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA. The analyst is concerned about forward secrecy. Which action would best mitigate the risk?

   • AUse TLS 1.3, which automatically uses forward secrecy.
   • BKeep the cipher suite but increase the RSA key size to 4096 bits.
   • CReplace the cipher suite with TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256.
   • DDisable session resumption to prevent reuse of session keys.
   Reveal Solution Discussion Select an answer first