A security auditor is reviewing a certificate that was issued by a subordinate CA. The auditor wants to confirm that the subordinate CA is authorized to issue certificates for the organization's domain. Which field or extension in the subordinate CA's certificate should the auditor examine?

The Authority Key Identifier extension.

The Subject Key Identifier extension.

The Name Constraints extension.

The Basic Constraints extension, specifically the CA flag.

A developer is implementing a digital signature scheme for a large document. To improve efficiency, the developer hashes the document before signing. What is the primary reason for hashing the document rather than signing the entire document directly?

Hashing produces a fixed-size digest that is faster to sign and still provides integrity and authenticity.

Hashing is required to generate the public key used for verification.

Hashing ensures that the document cannot be modified by anyone, including the signer.

Hashing encrypts the document so that only the intended recipient can read it.

A company is deploying a new internal application that requires mutual TLS (mTLS) between clients and servers. The company wants to ensure that only authorized client devices can connect. Which combination of actions is necessary?

Issue client certificates from an internal CA, configure the server to require and validate client certificates, and ensure the server trusts the internal CA.

Install a public CA certificate on each client and use standard TLS.

Use IP address allowlisting on the server to restrict access.

Use a shared password for all clients and configure the server to accept it.

A company's internal CA issues certificates to servers. The CA administrator wants to reduce the risk of a compromised CA key. Which approach is most effective?

Use an offline root CA and issue certificates through an intermediate CA that is online.

Use self-signed certificates for all servers to avoid CA involvement.

Issue all certificates directly from the root CA and keep the root online.

Use a single online CA for all certificate issuance.

EC-CouncilCertified Encryption Specialist

Domain 4Objective 1

Digital Signatures and X.509 Certificates ECES Practice Questions (Page 7)

Part of the Applications of Cryptography domain, which makes up ~25% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

8concepts

Questions 31–35

31expert · hard
A security auditor is reviewing a certificate that was issued by a subordinate CA. The auditor wants to confirm that the subordinate CA is authorized to issue certificates for the organization's domain. Which field or extension in the subordinate CA's certificate should the auditor examine?
Select an answer first
32foundation · easy
Which application uses digital signatures and X.509 certificates to authenticate the origin and integrity of software?
Select an answer first
33application · medium
A developer is implementing a digital signature scheme for a large document. To improve efficiency, the developer hashes the document before signing. What is the primary reason for hashing the document rather than signing the entire document directly?
Select an answer first
34expert · hard
A company is deploying a new internal application that requires mutual TLS (mTLS) between clients and servers. The company wants to ensure that only authorized client devices can connect. Which combination of actions is necessary?
Select an answer first
35expert · hard
A company's internal CA issues certificates to servers. The CA administrator wants to reduce the risk of a compromised CA key. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECES

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECES” is a trademark of its owner, used for identification only.