Public Key Infrastructure (PKI) and Digital Certificates NDE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An organization is implementing a PKI and wants to ensure that the root CA's private key is protected from theft. Which practice is the most effective for safeguarding the root CA private key?

   • AShare the root CA private key among multiple administrators to ensure availability
   • BEncrypt the root CA private key with a password and store it on a networked server
   • CBack up the root CA private key to a cloud storage service for disaster recovery
   • DStore the root CA private key on a hardware security module (HSM) and keep the root CA offline
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security administrator discovers that an employee's private key was exposed in a data breach. The employee's certificate is still valid and used for email signing. What is the most immediate action the administrator should take to prevent further misuse?

   • AWait for the certificate to expire naturally and then issue a new one
   • BRevoke the certificate and publish the revocation to a CRL and OCSP responder
   • CIssue a new certificate with the same public key to avoid re-enrollment
   • DDisable the employee's account but keep the certificate active for archival purposes
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A software vendor signs its releases with a code-signing certificate. A security researcher discovers a vulnerability in the vendor's signing process that could allow an attacker to sign malicious code with the vendor's certificate. The vendor wants to minimize the impact on existing customers while addressing the vulnerability. Which action should the vendor take first?

   • ARevoke the compromised certificate and issue a new one with a new key pair, then re-sign all legitimate releases
   • BKeep the current certificate and add more stringent password protection to the signing process
   • CIssue a new certificate but keep the same key pair to avoid re-signing
   • DWait for the certificate to expire naturally before issuing a new one
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the purpose of a Certificate Revocation List (CRL) published by a CA?

   • ATo advertise the CA's public key
   • BTo list all certificates issued by the CA
   • CTo provide a backup of all private keys
   • DTo list certificates that have been revoked before their expiration date
   Reveal Solution Discussion Select an answer first
6. 25application · easy

   A software vendor wants to distribute a signed update to customers. The vendor uses a code-signing certificate. Which key must the vendor use to create the digital signature, and which key do customers use to verify it?

   • AVendor uses the public key to sign; customers use the vendor's private key to verify
   • BVendor uses the CA's private key to sign; customers use the CA's public key to verify
   • CVendor uses a symmetric key to sign; customers use the same symmetric key to verify
   • DVendor uses the private key to sign; customers use the vendor's public key to verify
   Reveal Solution Discussion Select an answer first