A company uses Kerberos for internal authentication and PKI for external-facing TLS. They want to allow employees to use the same smart card to authenticate to both internal Kerberos services and external VPN. What is the most efficient approach?

Issue two separate certificates on the same smart card, one for Kerberos and one for VPN

Use the same certificate on the smart card for both Kerberos PKINIT and VPN TLS authentication

Use PKI for internal Kerberos and Kerberos for external VPN

Use Kerberos tickets for VPN authentication and PKI only for internal services

An organization wants to implement smart card logon for its Windows domain, which uses Kerberos. What must be integrated with Kerberos to allow smart card authentication?

A separate Kerberos realm for each smart card user

An OCSP responder that validates the smart card's certificate at every logon

A RADIUS server that forwards smart card credentials to the KDC

A PKI that issues certificates to users and is trusted by the domain

A client is validating a server certificate that chains to a root CA. The client does not have the root CA's certificate in its trust store. What will happen?

The client will accept the certificate if the intermediate CA is trusted

The client will use OCSP to validate the root CA's trust

The certificate chain will be considered untrusted

The client will automatically download the root CA certificate from the server

A company is setting up an internal PKI to issue certificates for employee smart-card logon. They want to separate the task of verifying employee identity from the task of actually issuing certificates, and they need a central place where clients can download the current CRL. Which PKI components should they deploy?

A certificate repository only, since CRLs can be published without a CA or RA

A single enterprise CA that also performs identity proofing and publishes CRLs to a shared network folder

A root CA and an intermediate CA, with the intermediate CA handling both identity proofing and CRL publication

A registration authority (RA) for identity proofing, a CA for certificate issuance, and a certificate repository for CRL distribution

A web application validates client certificates by checking the certificate chain up to a trusted root. The application currently downloads the full CRL daily. Users report that recently revoked certificates are sometimes accepted for up to 24 hours. Which change would reduce this window?

Cache the CRL locally for a week

Increase the CRL's validity period to reduce download frequency

Switch to OCSP with a short nextUpdate interval

Use a delta CRL that is updated monthly

EC-CouncilCertified Encryption Specialist

Domain 4Objective 2

PKI Infrastructure and Kerberos Authentication ECES Practice Questions (Page 1)

Part of the Applications of Cryptography domain, which makes up ~25% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 3–5 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

7concepts

Questions 1–5

1expert · hard
A company uses Kerberos for internal authentication and PKI for external-facing TLS. They want to allow employees to use the same smart card to authenticate to both internal Kerberos services and external VPN. What is the most efficient approach?
Select an answer first
2application · medium
An organization wants to implement smart card logon for its Windows domain, which uses Kerberos. What must be integrated with Kerberos to allow smart card authentication?
Select an answer first
3application · medium
A client is validating a server certificate that chains to a root CA. The client does not have the root CA's certificate in its trust store. What will happen?
Select an answer first
4application · medium
A company is setting up an internal PKI to issue certificates for employee smart-card logon. They want to separate the task of verifying employee identity from the task of actually issuing certificates, and they need a central place where clients can download the current CRL. Which PKI components should they deploy?
Select an answer first
5application · medium
A web application validates client certificates by checking the certificate chain up to a trusted root. The application currently downloads the full CRL daily. Users report that recently revoked certificates are sometimes accepted for up to 24 hours. Which change would reduce this window?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECES

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECES” is a trademark of its owner, used for identification only.