After a client receives a TGT, what does it do to access a specific service?

Return the TGT to the AS for a new TGT

Present the TGT directly to the target service

Use the TGT to encrypt all communication with the service

Present the TGT to the Ticket Granting Service (TGS) to obtain a service ticket

A company is implementing a new authentication system. They need to support both interactive logon and network authentication for services. They also need to support non-repudiation for email and document signing. Which combination of technologies should they use?

Use a single sign-on solution based on passwords only

Kerberos for both network authentication and email signing

Kerberos for network authentication and PKI for email signing and non-repudiation

PKI for both network authentication and email signing

A large enterprise is designing a PKI for a new subsidiary. The security team wants to minimize the impact of a compromised root CA and also reduce the risk of a single point of failure for certificate issuance. They plan to issue certificates to both internal users and external partners. Which PKI architecture best meets these requirements?

An offline root CA that issues certificates to two intermediate CAs: one for internal users and one for external partners

A single online CA that issues all certificates, with the private key stored in a hardware security module (HSM)

Two independent root CAs, each issuing certificates to the same set of users

A single root CA that issues all certificates directly, with the root kept offline

A company is migrating from a legacy password-based Kerberos system to smart card authentication. They want to maintain the ability to revoke access immediately when an employee leaves. Which combination of technologies best supports this requirement?

PKI with OCSP and Kerberos PKINIT

Kerberos with long service ticket lifetimes

Kerberos with short TGT lifetimes only

PKI with CRLs only and Kerberos PKINIT

A company's internal CA is going to be decommissioned. All certificates issued by this CA are still within their validity period. The company wants to ensure that these certificates remain usable until they expire. What should the company do?

Reissue all certificates from a new CA before decommissioning

Keep the CA online until all certificates expire

Revoke all certificates issued by the CA before decommissioning

Publish the CA's certificate and CRL to a publicly accessible repository before decommissioning

EC-CouncilCertified Encryption Specialist

Domain 4Objective 2

PKI Infrastructure and Kerberos Authentication ECES Practice Questions (Page 6)

Part of the Applications of Cryptography domain, which makes up ~25% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 3–5 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

7concepts

Questions 26–30

26foundation · easy
After a client receives a TGT, what does it do to access a specific service?
Select an answer first
27expert · hard
A company is implementing a new authentication system. They need to support both interactive logon and network authentication for services. They also need to support non-repudiation for email and document signing. Which combination of technologies should they use?
Select an answer first
28expert · hard
A large enterprise is designing a PKI for a new subsidiary. The security team wants to minimize the impact of a compromised root CA and also reduce the risk of a single point of failure for certificate issuance. They plan to issue certificates to both internal users and external partners. Which PKI architecture best meets these requirements?
Select an answer first
29expert · hard
A company is migrating from a legacy password-based Kerberos system to smart card authentication. They want to maintain the ability to revoke access immediately when an employee leaves. Which combination of technologies best supports this requirement?
Select an answer first
30application · medium
A company's internal CA is going to be decommissioned. All certificates issued by this CA are still within their validity period. The company wants to ensure that these certificates remain usable until they expire. What should the company do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECES

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECES” is a trademark of its owner, used for identification only.