A security analyst is validating a certificate chain. The server presents a leaf certificate, an intermediate certificate, and a root certificate. The analyst notices that the root certificate is self-signed. Which validation step is most critical for establishing trust in this chain?

Verify that the leaf certificate's public key matches the server's private key.

Ensure that the leaf certificate's validity period has not expired.

Verify that the root certificate is in the client's trusted root store.

Check that the intermediate certificate is not revoked.

A multinational corporation has separate PKI hierarchies for its European and Asian divisions. The divisions need to exchange encrypted emails, but they do not want to merge their PKIs. The security team is evaluating trust models. Which model provides the most efficient trust path while minimizing the number of cross-certifications?

A hierarchical model where one division's root CA becomes the root for both.

A bridge CA that cross-certifies with the root CA of each division.

A mesh trust model where every CA cross-certifies with every other CA.

A direct cross-certification between the two root CAs.

A security analyst is examining a digital certificate presented by a server during a TLS handshake. The analyst needs to determine whether the certificate is currently valid and whether it has been revoked. Which fields or mechanisms should the analyst check?

The certificate's subject name and the server's IP address

The certificate's serial number and the CA's public key

The certificate's signature algorithm and the server's TLS version

The certificate's validity period and the CA's CRL or OCSP responder

In a PKI, which component is often used to offload identity verification from the Certificate Authority?

Online Certificate Status Protocol (OCSP)

Certificate Revocation List (CRL)

EC-CouncilCertified Ethical Hacker

Domain 9Objective 2

Public Key Infrastructure and Digital Signatures CEH Practice Questions (Page 8)

Part of the Cryptography domain, which makes up ~9% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~9–14 in this domain), expect 2–4 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

12concepts

Questions 36–40

36foundation · easy
What property of a hash function ensures that a digital signature can detect any modification to the signed message?
Select an answer first
37expert · hard
A security analyst is validating a certificate chain. The server presents a leaf certificate, an intermediate certificate, and a root certificate. The analyst notices that the root certificate is self-signed. Which validation step is most critical for establishing trust in this chain?
Select an answer first
38expert · hard
A multinational corporation has separate PKI hierarchies for its European and Asian divisions. The divisions need to exchange encrypted emails, but they do not want to merge their PKIs. The security team is evaluating trust models. Which model provides the most efficient trust path while minimizing the number of cross-certifications?
Select an answer first
39application · medium
A security analyst is examining a digital certificate presented by a server during a TLS handshake. The analyst needs to determine whether the certificate is currently valid and whether it has been revoked. Which fields or mechanisms should the analyst check?
Select an answer first
40foundation · easy
In a PKI, which component is often used to offload identity verification from the Certificate Authority?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Public Key Infrastructure and Digital Signatures CEH Practice Questions (Page 8)

Questions 36–40

What property of a hash function ensures that a digital signature can detect any modification to the signed message?

A security analyst is validating a certificate chain. The server presents a leaf certificate, an intermediate certificate, and a root certificate. The analyst notices that the root certificate is self-signed. Which validation step is most critical for establishing trust in this chain?

A security analyst is examining a digital certificate presented by a server during a TLS handshake. The analyst needs to determine whether the certificate is currently valid and whether it has been revoked. Which fields or mechanisms should the analyst check?

In a PKI, which component is often used to offload identity verification from the Certificate Authority?

Keep studying — Cryptography