Digital Signatures and X.509 Certificates ECES Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A law firm sends a contract as a PDF to a client and wants to ensure the client can verify both the sender's identity and that the document was not altered after signing. The firm also wants to prevent the sender from later denying they signed it. Which mechanism best satisfies all three requirements?

   • AAttach a hash of the PDF to the email and send it from the firm's official email address.
   • BEncrypt the PDF with the client's public key and send it over a secure channel.
   • CUse a shared secret to compute a MAC and send it with the PDF.
   • DDigitally sign the PDF with the firm's private key and provide the corresponding certificate to the client.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security team is troubleshooting a client that fails to validate a server certificate. The certificate is not expired, the chain is complete, and the root CA is in the client's trust store. Which additional check should the team perform?

   • ACheck that the certificate's validity period starts in the future.
   • BEnsure the certificate was issued by a subordinate CA rather than the root CA.
   • CVerify that the certificate's serial number is not on the CA's CRL or reported as revoked via OCSP.
   • DConfirm that the server's private key is encrypted with a strong password.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which property of a digital signature ensures that the signer cannot later deny having signed the message?

   • AAuthorization
   • BConfidentiality
   • CNon-repudiation
   • DAvailability
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A user's browser is validating a website's TLS certificate. The certificate was issued by an intermediate CA, which itself has a certificate issued by a root CA that is trusted by the browser. The browser needs to confirm that the end-entity certificate is trustworthy. What is the correct validation process?

   • ACompare the serial numbers of the end-entity and root certificates to ensure they match.
   • BCheck only the end-entity certificate's validity dates and ignore the intermediate and root certificates.
   • CBuild a chain from the end-entity certificate to the intermediate CA certificate to the root CA certificate, verify each signature, and check the root is in the trust store.
   • DVerify the end-entity certificate's signature using the root CA's public key directly.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   How does a hash function contribute to message integrity in a digital signature?

   • AIt adds a checksum that can be used to recover the original message
   • BIt produces a unique digest that changes if the message is altered
   • CIt encrypts the message so that any alteration makes it unreadable
   • DIt compresses the message so that tampering is visible
   Reveal Solution Discussion Select an answer first