What is the purpose of a Certificate Revocation List (CRL)?

To store the private keys of revoked certificates

To list all certificates issued by a CA

To renew certificates that are about to expire

To list certificates that have been revoked before their expiration date

In the hierarchical trust model used by X.509, what is the trust anchor?

The certificate revocation list

The intermediate CA certificate

A system administrator notices that a server's certificate is about to expire. The administrator wants to replace it with a new certificate without causing downtime for clients. What is the best practice?

Disable certificate validation on the server to avoid the expiration issue.

Reuse the existing private key and simply change the expiration date on the certificate.

Wait until the certificate expires and then install the new one.

Generate a new key pair and submit a Certificate Signing Request (CSR) to the CA well before expiration.

A legal team needs to ensure that a digitally signed contract cannot be repudiated by the signer. The signer claims that their private key was stolen and used without their knowledge. What additional measure can the organization implement to strengthen non-repudiation?

Use a hardware security module (HSM) to store the private key and require multi-factor authentication for signing operations.

Have the signer sign the document multiple times.

Use a longer hash algorithm for the signature.

Encrypt the signed document with the recipient's public key.

A client is validating a server certificate during a TLS handshake. The client has the root CA certificate in its trust store. The server sends its end-entity certificate but not the intermediate CA certificate. What is the most likely result?

The client will ignore the missing intermediate and accept the certificate if the domain name matches.

The client will fail to validate the certificate because it cannot build a complete chain.

The client will validate the certificate by using the root CA's public key directly on the end-entity certificate.

The client will successfully validate the certificate because it has the root CA.

EC-CouncilCertified Encryption Specialist

Domain 4Objective 1

Digital Signatures and X.509 Certificates ECES Practice Questions (Page 5)

Part of the Applications of Cryptography domain, which makes up ~25% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

8concepts

Questions 21–25

21foundation · easy
What is the purpose of a Certificate Revocation List (CRL)?
Select an answer first
22foundation · easy
In the hierarchical trust model used by X.509, what is the trust anchor?
Select an answer first
23application · medium
A system administrator notices that a server's certificate is about to expire. The administrator wants to replace it with a new certificate without causing downtime for clients. What is the best practice?
Select an answer first
24expert · hard
A legal team needs to ensure that a digitally signed contract cannot be repudiated by the signer. The signer claims that their private key was stolen and used without their knowledge. What additional measure can the organization implement to strengthen non-repudiation?
Select an answer first
25application · medium
A client is validating a server certificate during a TLS handshake. The client has the root CA certificate in its trust store. The server sends its end-entity certificate but not the intermediate CA certificate. What is the most likely result?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECES

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECES” is a trademark of its owner, used for identification only.