A security administrator discovers that a private key corresponding to an intermediate CA certificate has been compromised. The organization wants to ensure that clients immediately stop trusting certificates issued by that intermediate. What is the most appropriate action?

Change the serial number of the intermediate CA certificate

Delete the intermediate CA certificate from all servers

Wait for the intermediate CA certificate to expire naturally

Revoke the intermediate CA certificate and publish its revocation information via CRL or OCSP

A Java application signs data with an RSA private key stored in a PKCS12 keystore. The keystore password is currently hardcoded in the application's configuration file. The security team wants to reduce the risk of key exposure without requiring a hardware security module. Which approach is the most effective?

Encrypt the keystore password with AES and store the encryption key in the same config file

Change the keystore password to a longer, more complex value

Retrieve the keystore password from a secrets management service at runtime

Use a Java KeyStore (JKS) instead of PKCS12

A developer needs to compute a hash of a file to verify its integrity after download. The organization's security policy requires a collision-resistant algorithm. Which JCA call should the developer use?

MessageDigest.getInstance("SHA-1")

MessageDigest.getInstance("SHA-256")

MessageDigest.getInstance("MD5")

A Java application signs JWTs using an RSA private key. The key is currently stored in a plain Java KeyStore (JKS) file on the application server. A security audit requires that the private key never be exposed in memory or on disk in plaintext. Which change is most appropriate?

Encrypt the JKS file with a password and store the password in the application's environment variables.

Move the key to a hardware security module (HSM) and use the HSM provider for signing operations.

Load the JKS file, read the private key into a byte array, and zero out the array after signing.

Use a PKCS#12 keystore instead of JKS.

A Java client is validating a server certificate. The certificate has a valid signature from a trusted CA and is within its validity period, but the client still rejects it. The certificate's subject alternative name (SAN) does not match the requested hostname. What is the most likely reason for the rejection?

The certificate's SAN does not include the requested hostname

The certificate's public key is too short

The certificate chain is incomplete

The certificate has been revoked by the CA

EC-CouncilCertified Application Security Engineer (Java)

Domain 5Objective 2

Hashing, Digital Signatures, and Certificates CASEJAVA Practice Questions (Page 2)

Part of the Secure Coding: Cryptography domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

11concepts

Questions 6–10

6application · medium
A security administrator discovers that a private key corresponding to an intermediate CA certificate has been compromised. The organization wants to ensure that clients immediately stop trusting certificates issued by that intermediate. What is the most appropriate action?
Select an answer first
7expert · hard
A Java application signs data with an RSA private key stored in a PKCS12 keystore. The keystore password is currently hardcoded in the application's configuration file. The security team wants to reduce the risk of key exposure without requiring a hardware security module. Which approach is the most effective?
Select an answer first
8application · easy
A developer needs to compute a hash of a file to verify its integrity after download. The organization's security policy requires a collision-resistant algorithm. Which JCA call should the developer use?
Select an answer first
9expert · hard
A Java application signs JWTs using an RSA private key. The key is currently stored in a plain Java KeyStore (JKS) file on the application server. A security audit requires that the private key never be exposed in memory or on disk in plaintext. Which change is most appropriate?
Select an answer first
10expert · hard
A Java client is validating a server certificate. The certificate has a valid signature from a trusted CA and is within its validity period, but the client still rejects it. The certificate's subject alternative name (SAN) does not match the requested hostname. What is the most likely reason for the rejection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Hashing, Digital Signatures, and Certificates CASEJAVA Practice Questions (Page 2)

Questions 6–10

A security administrator discovers that a private key corresponding to an intermediate CA certificate has been compromised. The organization wants to ensure that clients immediately stop trusting certificates issued by that intermediate. What is the most appropriate action?

A developer needs to compute a hash of a file to verify its integrity after download. The organization's security policy requires a collision-resistant algorithm. Which JCA call should the developer use?

A Java application signs JWTs using an RSA private key. The key is currently stored in a plain Java KeyStore (JKS) file on the application server. A security audit requires that the private key never be exposed in memory or on disk in plaintext. Which change is most appropriate?

Keep studying — Secure Coding: Cryptography