Two organizations, each with its own hierarchical PKI, need to trust each other's certificates for secure email exchange. They want to establish trust without merging their PKI infrastructures. Which approach should they use?

Disable certificate revocation checking for cross-organization certificates.

Have each organization issue certificates to all users of the other organization.

Use a mesh trust model where every CA cross-certifies with every other CA.

Create a bridge CA that cross-certifies with the root CA of each organization.

A company operates an internal web portal for employees. The IT team wants to deploy TLS certificates for the portal. They plan to issue certificates from an internal CA, but they are concerned about browser trust warnings. Which approach should they take to ensure employees' browsers trust the internal CA without manual installation on each device?

Distribute the internal CA's root certificate to all employee devices via Group Policy and add it to the Trusted Root Certification Authorities store.

Use a public CA to issue the internal portal's certificate, even though the portal is not publicly accessible.

Add the internal CA's certificate to the browser's certificate revocation list (CRL) to establish trust.

Configure the internal CA to issue certificates with a longer validity period so browsers automatically trust them.

A company's web server certificate was revoked due to a private key compromise. The administrator wants to ensure that clients are immediately aware of the revocation. Which method provides the most up-to-date revocation information with minimal delay?

Certificate transparency logs, which record all issued certificates.

The certificate's validity period, which automatically expires the certificate.

OCSP (Online Certificate Status Protocol), which provides real-time revocation status responses.

CRL (Certificate Revocation List), which is published periodically and downloaded by clients.

A security administrator is troubleshooting why some clients are still accepting a revoked certificate. The CA has published the revocation to a CRL, but clients are not checking it. Which configuration is most likely causing this issue?

The certificate's validity period is too long.

The CA's root certificate is not installed on the clients.

Clients are configured to use OCSP, but the CA only publishes a CRL.

The certificate was renewed instead of revoked.

EC-CouncilCertified Ethical Hacker

Domain 9Objective 2

Public Key Infrastructure and Digital Signatures CEH Practice Questions (Page 1)

Part of the Cryptography domain, which makes up ~9% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~9–14 in this domain), expect 2–4 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

12concepts

Questions 1–5

1foundation · easy
Which standard defines the format and fields of most digital certificates used on the internet?
Select an answer first
2application · medium
Two organizations, each with its own hierarchical PKI, need to trust each other's certificates for secure email exchange. They want to establish trust without merging their PKI infrastructures. Which approach should they use?
Select an answer first
3application · medium
A company operates an internal web portal for employees. The IT team wants to deploy TLS certificates for the portal. They plan to issue certificates from an internal CA, but they are concerned about browser trust warnings. Which approach should they take to ensure employees' browsers trust the internal CA without manual installation on each device?
Select an answer first
4application · medium
A company's web server certificate was revoked due to a private key compromise. The administrator wants to ensure that clients are immediately aware of the revocation. Which method provides the most up-to-date revocation information with minimal delay?
Select an answer first
5expert · hard
A security administrator is troubleshooting why some clients are still accepting a revoked certificate. The CA has published the revocation to a CRL, but clients are not checking it. Which configuration is most likely causing this issue?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Public Key Infrastructure and Digital Signatures CEH Practice Questions (Page 1)

Questions 1–5

Which standard defines the format and fields of most digital certificates used on the internet?

Two organizations, each with its own hierarchical PKI, need to trust each other's certificates for secure email exchange. They want to establish trust without merging their PKI infrastructures. Which approach should they use?

A company's web server certificate was revoked due to a private key compromise. The administrator wants to ensure that clients are immediately aware of the revocation. Which method provides the most up-to-date revocation information with minimal delay?

A security administrator is troubleshooting why some clients are still accepting a revoked certificate. The CA has published the revocation to a CRL, but clients are not checking it. Which configuration is most likely causing this issue?

Keep studying — Cryptography