Digital Signatures and X.509 Certificates ECES Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A security engineer is troubleshooting a TLS handshake failure. The server presents a certificate that is currently valid, the chain is complete, and the root CA is trusted. The client still rejects the certificate. Which of the following is the most likely cause?

   • AThe certificate's public key does not match the server's private key.
   • BThe certificate's serial number is not in the CRL.
   • CThe certificate was issued by a subordinate CA that is not in the client's trust store.
   • DThe certificate's validity period is set to start in the future.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A large enterprise is deciding between CRL and OCSP for checking certificate revocation status. They have many remote clients with intermittent connectivity, and they need to minimize the time clients spend waiting for revocation checks during TLS handshakes. Which approach should they choose?

   • AUse OCSP with a locally deployed responder that supports caching and stapling.
   • BUse a CRL that is updated only once a year to reduce download frequency.
   • CDisable revocation checking entirely to improve performance.
   • DUse a CRL with a long validity period and require clients to download it at every handshake.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which field in an X.509 certificate identifies the entity that owns the public key?

   • AIssuer
   • BSubject
   • CValidity period
   • DSerial number
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   An organization wants to issue certificates to its employees for internal document signing. The organization decides to set up its own root CA and issue certificates directly from that root CA to employees, without any intermediate CAs. What is a characteristic of this trust model?

   • AAll employee certificates are directly signed by the root CA, and clients must trust the root CA to validate them.
   • BClients must verify each employee certificate against a public directory of hashes.
   • CThe root CA's private key is distributed to every employee for signing.
   • DEmployee certificates are self-signed and do not require a CA.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   An organization uses S/MIME to sign emails. A recipient receives a signed email and wants to verify the sender's identity and the email's integrity. What must the recipient have to perform this verification?

   • AThe sender's public key certificate and the ability to validate its chain of trust.
   • BA copy of the email's plaintext before it was signed.
   • CThe sender's password to access their email account.
   • DThe sender's private key to decrypt the signature.
   Reveal Solution Discussion Select an answer first