PKI Infrastructure and Kerberos Authentication ECES Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of the certificate revocation stage in the certificate lifecycle?

   • ATo extend the validity period of a certificate without re-issuance
   • BTo replace the certificate's public key with a new one while keeping the same serial number
   • CTo remove the certificate from the repository permanently
   • DTo invalidate a certificate before its natural expiration when the key is compromised
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In the certificate lifecycle, what is the correct order of the first three stages after a certificate is created?

   • AIssuance, Use, Distribution
   • BIssuance, Distribution, Use
   • CUse, Issuance, Distribution
   • DDistribution, Issuance, Use
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An organization issues client certificates to employees for email signing. A certificate was issued with a validity period of two years, but an employee leaves the company after six months. The security team wants to ensure that the departed employee's certificate can no longer be used for signing. What is the most appropriate action?

   • ARevoke the certificate and publish the revocation to a CRL or OCSP responder
   • BReissue the certificate with a shorter validity period
   • CDelete the certificate from the user's profile in Active Directory
   • DWait for the certificate to expire naturally in 18 months
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   When a client validates a certificate, what does it use to verify that the certificate is not revoked?

   • AThe certificate's digital signature
   • BThe certificate's serial number
   • CThe certificate's validity period
   • DCertificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP)
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A Kerberos ticket contains a session key encrypted with the service's long-term key. What is the primary purpose of this design?

   • ATo prevent the TGS from knowing which service the client is accessing
   • BTo allow the service to decrypt the session key and use it to authenticate the client and protect subsequent communications
   • CTo allow the client to decrypt the ticket and read the session key
   • DTo ensure the ticket can be used only once by including a one-time nonce
   Reveal Solution Discussion Select an answer first