A security architect is designing an authentication system for a high-security environment. They need mutual authentication between clients and servers, support for smart-card logon, and the ability to authenticate users across multiple organizations that do not share a common directory. Which combination of technologies best meets these requirements?

Kerberos only, with password-based authentication

Kerberos with cross-realm trusts and smart-card logon using certificates

PKI with a public CA and no internal Kerberos

PKI with client certificates only, using OCSP for revocation

In a Kerberos environment, a service ticket is encrypted with the service's long-term key. What is the primary purpose of this encryption?

To allow the client to decrypt the ticket and verify the service's identity

To ensure the ticket can be used by any service in the realm

To prevent the client from reading or modifying the ticket's contents

To protect the ticket during transmission from the client to the service

A company is setting up an internal PKI for email signing and encryption. They want to minimize the number of certificate authorities (CAs) while ensuring that if the root CA is compromised, they can recover without reissuing every user certificate. Which PKI design should they implement?

Single-tier root CA that issues end-entity certificates directly

Three-tier hierarchy with two online subordinate CAs and an online root

Two-tier hierarchy with an offline root CA and an online issuing CA

Single online root CA with a hardware security module (HSM) protecting its key

A PKI administrator is planning the lifecycle for a new subordinate CA. The CA's certificate will expire in 5 years. The administrator wants to minimize the risk of the CA's private key being compromised while it is stored on an online server. What is the best practice?

Rely on the root CA to revoke the subordinate CA if compromised

Use a shorter certificate validity period for the CA

Keep the CA offline and only bring it online to issue certificates

Use a hardware security module (HSM) to store the CA's private key

What is a Kerberos realm?

A logical boundary that defines the area of authority of a Kerberos KDC

A database of all user passwords in the organization

A physical network segment that contains only Kerberos servers

A type of service ticket that grants access to multiple services

EC-CouncilCertified Encryption Specialist

Domain 4Objective 2

PKI Infrastructure and Kerberos Authentication ECES Practice Questions (Page 5)

Part of the Applications of Cryptography domain, which makes up ~25% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 3–5 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

7concepts

Questions 21–25

21expert · hard
A security architect is designing an authentication system for a high-security environment. They need mutual authentication between clients and servers, support for smart-card logon, and the ability to authenticate users across multiple organizations that do not share a common directory. Which combination of technologies best meets these requirements?
Select an answer first
22application · medium
In a Kerberos environment, a service ticket is encrypted with the service's long-term key. What is the primary purpose of this encryption?
Select an answer first
23application · medium
A company is setting up an internal PKI for email signing and encryption. They want to minimize the number of certificate authorities (CAs) while ensuring that if the root CA is compromised, they can recover without reissuing every user certificate. Which PKI design should they implement?
Select an answer first
24expert · hard
A PKI administrator is planning the lifecycle for a new subordinate CA. The CA's certificate will expire in 5 years. The administrator wants to minimize the risk of the CA's private key being compromised while it is stored on an online server. What is the best practice?
Select an answer first
25foundation · easy
What is a Kerberos realm?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECES

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECES” is a trademark of its owner, used for identification only.