1.5 Describe Cryptography Security Components Such as Hashing, Encryption, PKI, SSL, TLS, QUIC, MASQUE, IPsec, NAT-T IPv4 for IPsec, Preshared Key, Certificate-Based Authorization, and Post-Quantum Cryptography 350-701 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary role of a Certificate Authority (CA) in a PKI?

   • ATo store users' private keys.
   • BTo issue and digitally sign digital certificates.
   • CTo provide a shared secret key for all users.
   • DTo encrypt all data transmitted over the network.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A large enterprise is planning a multi-year migration to post-quantum cryptography. The enterprise has a mature PKI with many internal CAs and thousands of issued certificates. The security team must ensure that the migration does not break existing applications while preparing for quantum threats. Which approach best balances security and compatibility?

   • AUse longer key sizes for existing RSA certificates to provide quantum resistance.
   • BImmediately replace all existing certificates with post-quantum certificates.
   • CDeploy hybrid certificates that contain both classical and post-quantum algorithms, and update applications incrementally.
   • DWait until post-quantum algorithms are fully standardized before making any changes.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A small branch office uses an IPsec VPN with a preshared key (PSK) for authentication. The security team wants to reduce the risk of the PSK being compromised while keeping the solution simple for the branch. Which action best addresses the risk?

   • AUse a long, random PSK and rotate it regularly.
   • BStore the PSK in the configuration file in plaintext for easy troubleshooting.
   • CDisable IKE and use only manual keying.
   • DUse the same PSK for all branch offices to simplify management.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company needs to encrypt large files before storing them in a cloud service. The files are shared with multiple recipients, and the company wants to minimize the performance impact of encryption. Which approach should be used?

   • AGenerate a random symmetric key, encrypt the file with it, and encrypt the symmetric key with each recipient's public key.
   • BUse a single symmetric key shared among all recipients.
   • CEncrypt the file with the sender's private key.
   • DEncrypt the file separately with each recipient's public key.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security architect is planning for long-term data confidentiality. The organization stores sensitive documents that must remain confidential for 30 years. The architect is concerned about the future threat of quantum computers breaking current public-key algorithms. Which approach best addresses this concern?

   • ARely on the current PKI and assume quantum computers will not be able to break certificates.
   • BUse hybrid cryptography that combines a post-quantum algorithm with a current algorithm like ECDHE.
   • CUse AES-256 with a longer key schedule.
   • DIncrease the key size of the current RSA keys to 8192 bits.
   Reveal Solution Discussion Select an answer first