Digital Signatures and X.509 Certificates ECES Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company is designing a PKI for internal applications. They want to minimize the risk of a compromised root CA while still allowing multiple departments to issue certificates. Which structure should they implement?

   • AA root CA with subordinate CAs for each department.
   • BA single root CA that directly issues all end-entity certificates.
   • CA single subordinate CA that issues all certificates, with no root CA.
   • DA peer-to-peer trust model where each department trusts the others' certificates directly.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   What is the first step a verifier performs when verifying a digital signature?

   • AHash the signature to produce a message digest
   • BObtain the signer's public key
   • CDecrypt the signature with the signer's private key
   • DCompare the signature with the original message
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A client is validating a server certificate and receives an OCSP response indicating the certificate is 'good'. However, the certificate's validity period has expired. What should the client do?

   • AReject the certificate because it is expired, regardless of the OCSP response.
   • BAccept the certificate only if the server provides a valid signature.
   • CRequest a new OCSP response from a different responder.
   • DAccept the certificate because OCSP says it is good.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security analyst is reviewing a certificate and notices that the certificate's public key does not match the private key used by the server. The certificate is still within its validity period and was issued by a trusted CA. What is the most likely impact of this mismatch?

   • AThe certificate will still work but will not provide encryption.
   • BThe certificate will be automatically revoked by the CA.
   • CTLS handshakes will fail because the server cannot prove possession of the private key corresponding to the certificate's public key.
   • DThe certificate will be considered valid but with reduced security.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which protocol allows a client to check the revocation status of a certificate in real time?

   • AOCSP (Online Certificate Status Protocol)
   • BDNS (Domain Name System)
   • CTLS (Transport Layer Security)
   • DCRL (Certificate Revocation List)
   Reveal Solution Discussion Select an answer first