A company is setting up a new internal PKI to issue certificates for its employee VPN clients. The security team wants to ensure that a compromised employee certificate can be rendered invalid before its expiration date. Which PKI component must be configured to support this requirement?

A certificate revocation list (CRL) distribution point and/or an Online Certificate Status Protocol (OCSP) responder.

A certificate signing request (CSR) template with a short validity period.

A hardware security module (HSM) to protect the CA's private key.

A key escrow service that stores the employee's private key.

A .NET application receives a signed message from a business partner. The partner claims the message is authentic and unmodified. The application has the partner's public key certificate. What must the application do to verify the digital signature?

Check the certificate's expiration date only.

Decrypt the signature with the partner's public key and compare the result to the message hash.

Encrypt the message with the partner's public key and compare it to the signature.

Decrypt the message with the partner's private key.

A .NET application validates a client certificate during TLS mutual authentication. The certificate is currently valid (not expired), but the application rejects it. The certificate was issued by an intermediate CA that is not in the application's trust store. What is the most likely reason for the rejection?

The application cannot build a trust chain to a trusted root because the intermediate CA is not trusted.

The certificate's signature algorithm is not supported by the application.

The certificate's subject name does not match the application's expected name.

The client certificate's private key is not accessible to the application.

EC-CouncilCertified Application Security Engineer (.NET)

Domain 5Objective 3

Hashing, Digital Signatures, and Digital Certificates CASENET Practice Questions (Page 1)

Part of the Secure Coding: Cryptography domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

12concepts

12 Concepts in This Objective

Hash Functions
Common Hashing Algorithms
Hashing for Data Integrity
Password Hashing
Digital Signatures Overview
Digital Signature Creation and Verification
Digital Signature Algorithms
Digital Certificates Overview
Certificate Authorities and PKI
Certificate Lifecycle
Certificate Validation
Secure Implementation in .NET

Questions 1–5

1application · medium
A company is setting up a new internal PKI to issue certificates for its employee VPN clients. The security team wants to ensure that a compromised employee certificate can be rendered invalid before its expiration date. Which PKI component must be configured to support this requirement?
Select an answer first
2application · medium
A software vendor distributes a large installer file and wants to provide a hash for integrity verification. The vendor's security team is concerned about collision attacks and wants to use a hash function that is currently recommended for this purpose. Which hash function should the vendor use?
Select an answer first
3application · medium
A .NET application receives a signed message from a business partner. The partner claims the message is authentic and unmodified. The application has the partner's public key certificate. What must the application do to verify the digital signature?
Select an answer first
4application · medium
A .NET application validates a client certificate during TLS mutual authentication. The certificate is currently valid (not expired), but the application rejects it. The certificate was issued by an intermediate CA that is not in the application's trust store. What is the most likely reason for the rejection?
Select an answer first
5foundation · easy
Which security goal is uniquely provided by a digital signature that is not provided by a MAC (message authentication code)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.

Hashing, Digital Signatures, and Digital Certificates CASENET Practice Questions (Page 1)

Questions 1–5

A company is setting up a new internal PKI to issue certificates for its employee VPN clients. The security team wants to ensure that a compromised employee certificate can be rendered invalid before its expiration date. Which PKI component must be configured to support this requirement?

A software vendor distributes a large installer file and wants to provide a hash for integrity verification. The vendor's security team is concerned about collision attacks and wants to use a hash function that is currently recommended for this purpose. Which hash function should the vendor use?

A .NET application receives a signed message from a business partner. The partner claims the message is authentic and unmodified. The application has the partner's public key certificate. What must the application do to verify the digital signature?

Which security goal is uniquely provided by a digital signature that is not provided by a MAC (message authentication code)?

Keep studying — Secure Coding: Cryptography