A certificate is about to expire. The administrator wants to ensure uninterrupted service for the relying parties. What is the best practice?

Revoke the certificate just before expiration and reissue it

Wait until the certificate expires and then issue a new one

Extend the certificate's validity period by editing its serial number

Renew the certificate before expiration and deploy the new certificate

A government agency requires strong authentication for remote access to a classified system. They currently use Kerberos for internal authentication. The remote access solution must support smart-card authentication and provide a tamper-evident audit trail of authentication events. Which approach best meets these requirements?

Use password-based Kerberos authentication over a VPN

Use client certificates from a public CA for remote access, without Kerberos

Issue smart-card certificates from an internal PKI and use them for Kerberos smart-card logon, with KDC auditing enabled

Use Kerberos with hardware tokens that generate one-time passwords

A web application validates client certificates during TLS handshakes. The application currently downloads a large CRL from the CA's repository every hour, which causes noticeable latency. The security team wants to reduce latency while still checking revocation status in real time. Which approach should they implement?

Cache the CRL locally for 24 hours and refresh only when a certificate is presented

Use OCSP stapling so the web server provides a time-stamped, signed OCSP response during the TLS handshake

Switch to a delta CRL that contains only recently revoked certificates

Disable revocation checking to eliminate the CRL download

A user reports that they can authenticate to the domain and access some services, but when they try to access a specific application server, they receive a 'KDC_ERR_S_PRINCIPAL_UNKNOWN' error. Other users can access the same server. What is the most likely cause?

The user's password has expired

The application server's clock is out of sync with the KDC

The service principal name (SPN) for the application server is not registered in Active Directory

An administrator notices that a user's certificate was revoked due to a suspected key compromise. The user insists the certificate is still needed and asks to have it un-revoked. What is the correct action?

Change the certificate's serial number and reissue it with the same public key

Issue a new certificate with a new key pair and revoke the old one permanently

Remove the certificate from the CRL and re-add it to the repository

Renew the certificate with the same key pair but a new expiration date

EC-CouncilCertified Encryption Specialist

Domain 4Objective 2

PKI Infrastructure and Kerberos Authentication ECES Practice Questions (Page 4)

Part of the Applications of Cryptography domain, which makes up ~25% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 3–5 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

7concepts

Questions 16–20

16application · medium
A certificate is about to expire. The administrator wants to ensure uninterrupted service for the relying parties. What is the best practice?
Select an answer first
17expert · hard
A government agency requires strong authentication for remote access to a classified system. They currently use Kerberos for internal authentication. The remote access solution must support smart-card authentication and provide a tamper-evident audit trail of authentication events. Which approach best meets these requirements?
Select an answer first
18application · medium
A web application validates client certificates during TLS handshakes. The application currently downloads a large CRL from the CA's repository every hour, which causes noticeable latency. The security team wants to reduce latency while still checking revocation status in real time. Which approach should they implement?
Select an answer first
19expert · hard
A user reports that they can authenticate to the domain and access some services, but when they try to access a specific application server, they receive a 'KDC_ERR_S_PRINCIPAL_UNKNOWN' error. Other users can access the same server. What is the most likely cause?
Select an answer first
20application · medium
An administrator notices that a user's certificate was revoked due to a suspected key compromise. The user insists the certificate is still needed and asks to have it un-revoked. What is the correct action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECES

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECES” is a trademark of its owner, used for identification only.

PKI Infrastructure and Kerberos Authentication ECES Practice Questions (Page 4)

Questions 16–20

A certificate is about to expire. The administrator wants to ensure uninterrupted service for the relying parties. What is the best practice?

A user reports that they can authenticate to the domain and access some services, but when they try to access a specific application server, they receive a 'KDC_ERR_S_PRINCIPAL_UNKNOWN' error. Other users can access the same server. What is the most likely cause?

An administrator notices that a user's certificate was revoked due to a suspected key compromise. The user insists the certificate is still needed and asks to have it un-revoked. What is the correct action?

Keep studying — Applications of Cryptography