Digital Signatures and X.509 Certificates ECES Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A software vendor signs a release binary with a private key and publishes the binary along with the signature file. A customer downloads both files and wants to verify that the binary was not tampered with during transit and that it indeed came from the vendor. Which process should the customer perform?

   • AHash the signature file and compare the hash to the binary's hash.
   • BEncrypt the binary with the vendor's public key and compare the result to the signature file.
   • CCompute a hash of the binary, decrypt the signature with the vendor's public key, and compare the decrypted hash to the computed hash.
   • DDecrypt the binary with the vendor's private key and compare it to the signature file.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company's internal CA has issued a certificate to an employee's email-signing key. The employee leaves the company, and the security team wants to ensure that any future verifications of signatures created with that key will fail. What should the security team do?

   • AIssue a new certificate to the same key with a different serial number.
   • BDelete the employee's public key from the CA database.
   • CWait for the certificate to expire naturally.
   • DRevoke the certificate and publish the revocation to the CRL and OCSP responder.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A software vendor signs its release binaries with a code-signing certificate. A customer downloads a signed binary and wants to verify that it was not tampered with and that it was signed by the vendor. Which process should the customer's system perform?

   • AVerify the certificate chain and then trust the binary without checking the signature.
   • BEncrypt the binary with the vendor's public key and check that the ciphertext matches the signature.
   • CDecrypt the signature with the vendor's private key and compare it to the binary's hash.
   • DHash the binary, decrypt the attached signature with the vendor's public key, and compare the results.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of a digital signature?

   • ATo convert the message into a fixed-length hash value
   • BTo encrypt the message so only the intended recipient can read it
   • CTo provide authenticity, integrity, and non-repudiation for a message
   • DTo compress the message for efficient transmission
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company operates a public-facing web service and uses a certificate issued by a public CA. Recently, the CA's root certificate was compromised. The CA has issued a new root and cross-signed certificates. What is the most important action for the company to take to maintain trust for its customers?

   • AWait for the current certificate to expire and then renew under the new root.
   • BRevoke the current certificate and continue using the same key pair with a self-signed certificate.
   • CReplace the current certificate with a new one issued under the new root before the old root is distrusted.
   • DKeep the current certificate and rely on the CA's cross-signing to maintain trust.
   Reveal Solution Discussion Select an answer first