A company's web server certificate was compromised when an attacker gained access to the private key. The security team needs to immediately prevent clients from trusting the certificate while the new certificate is being issued. Which action should the team take first?

Change the certificate's validity period in the CA database

Delete the certificate from the server and restart the web service

Publish the certificate's serial number to the CA's Certificate Revocation List (CRL)

Generate a new key pair and install the new certificate immediately

A financial institution operates a two-tier PKI: an offline root CA and an online issuing CA. The compliance team requires that all certificates be revoked within 24 hours of an employee's termination. The PKI team is concerned about the availability of the revocation checking service. Which solution best balances compliance and availability?

Disable revocation checking to improve performance

Deploy an OCSP responder with a high-availability configuration and integrate it with the HR system for automated revocation

Use a CRL that is published once a week to reduce overhead

Rely on certificate expiration as the only revocation mechanism

A large enterprise is designing a PKI for 50,000 users and 10,000 devices. They require high availability for certificate validation, but they also want to minimize the risk of a compromised root CA. They plan to use an offline root CA and two subordinate CAs. Which additional design choice best balances availability and security?

Use a single subordinate CA to simplify management

Use only CRLs and require clients to download them frequently

Keep the root CA online to issue all certificates directly

Deploy OCSP responders that are highly available and use CRLs as a fallback

An organization's web server certificate is nearing expiration. The administrator wants to replace it without any downtime and ensure that clients do not see a security warning. Which action should the administrator take?

Wait until the certificate expires, then install the new certificate immediately

Generate a new key pair and submit a new CSR to the CA, then install the new certificate before the old one expires

Revoke the old certificate and then issue a new one from the same CA without a new CSR

Reuse the existing private key and simply re-request the same certificate from the CA

EC-CouncilNetwork Defense Essentials

Domain 6Objective 2

Public Key Infrastructure (PKI) and Digital Certificates NDE Practice Questions (Page 7)

Part of the Cryptography, PKI, and Data Security domain, which makes up ~15% of our current practice bank.

44questions here

9free pages

10concepts

Questions 31–35

31application · medium
A company's web server certificate was compromised when an attacker gained access to the private key. The security team needs to immediately prevent clients from trusting the certificate while the new certificate is being issued. Which action should the team take first?
Select an answer first
32expert · hard
A financial institution operates a two-tier PKI: an offline root CA and an online issuing CA. The compliance team requires that all certificates be revoked within 24 hours of an employee's termination. The PKI team is concerned about the availability of the revocation checking service. Which solution best balances compliance and availability?
Select an answer first
33expert · hard
A large enterprise is designing a PKI for 50,000 users and 10,000 devices. They require high availability for certificate validation, but they also want to minimize the risk of a compromised root CA. They plan to use an offline root CA and two subordinate CAs. Which additional design choice best balances availability and security?
Select an answer first
34application · medium
An organization's web server certificate is nearing expiration. The administrator wants to replace it without any downtime and ensure that clients do not see a security warning. Which action should the administrator take?
Select an answer first
35foundation · easy
In a PKI, which entity is responsible for verifying the identity of an individual requesting a digital certificate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “NDE” is a trademark of its owner, used for identification only.

Public Key Infrastructure (PKI) and Digital Certificates NDE Practice Questions (Page 7)

Questions 31–35

A company's web server certificate was compromised when an attacker gained access to the private key. The security team needs to immediately prevent clients from trusting the certificate while the new certificate is being issued. Which action should the team take first?

An organization's web server certificate is nearing expiration. The administrator wants to replace it without any downtime and ensure that clients do not see a security warning. Which action should the administrator take?

In a PKI, which entity is responsible for verifying the identity of an individual requesting a digital certificate?

Keep studying — Cryptography, PKI, and Data Security