Public Key Infrastructure and Digital Signatures CEH Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In a hierarchical PKI trust model, what is the role of the root CA?

   • AIt is a CA that is not trusted by any other CA
   • BIt is a CA that only issues certificates to end users
   • CIt is a CA that is used only for testing purposes
   • DIt is the top-level CA that issues certificates to subordinate CAs
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A mid-sized company is deploying an internal PKI to issue smart-card certificates to employees for VPN authentication. The security team wants to keep the certificate issuance process efficient while ensuring that only verified employees receive certificates. They plan to use a single enterprise CA and want to delegate the identity-verification step to the HR department. Which configuration should the security team implement?

   • AHave the CA publish a certificate revocation list (CRL) before issuing any certificates.
   • BConfigure the CA to issue certificates directly to all employees without additional verification.
   • CSet up a registration authority (RA) that HR uses to verify employee identity before the CA issues the certificate.
   • DUse an online certificate status protocol (OCSP) responder to validate employee identities in real time.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A law firm sends contracts to clients as PDF files. The firm wants to ensure that clients can verify the document was not altered and that it originated from the firm. Which solution should the firm implement?

   • ASend the PDF over a VPN connection.
   • BDigitally sign the PDF with the firm's private key.
   • CEncrypt the PDF with the client's public key.
   • DAdd a password to the PDF.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A multinational corporation is setting up a PKI for internal applications. They have offices in multiple countries and need to issue certificates to employees and devices. They want to minimize the risk of a single CA compromise affecting the entire organization. Which PKI architecture should they choose?

   • AA mesh PKI where every CA cross-certifies with every other CA.
   • BA single standalone CA that issues all certificates directly.
   • CA bridge CA that connects multiple independent CAs but does not issue certificates itself.
   • DA hierarchical PKI with a single root CA and multiple subordinate CAs for different regions.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following best distinguishes a public CA from a private CA?

   • AA public CA does not use digital signatures, while a private CA does
   • BA public CA uses symmetric encryption, while a private CA uses asymmetric encryption
   • CA public CA is trusted by many organizations, while a private CA is trusted only within a single organization
   • DA public CA issues certificates only to governments, while a private CA issues to businesses
   Reveal Solution Discussion Select an answer first