A company is planning to issue certificates to external partners. They want to ensure that the identity of each partner is verified according to the company's policy, but they do not want to expose their internal CA to the internet. Which architecture should they use?

Use a public CA to issue certificates to partners and bypass the internal PKI

Deploy an RA in the DMZ that verifies partner identities and forwards requests to an internal CA

Expose the internal CA directly to the internet for partner requests

Have partners generate their own certificates and register them manually

A company is setting up a PKI and wants to separate the identity verification process from the certificate signing process to improve security and scalability. Which architecture should they implement?

Deploy an RA to perform identity checks and a CA to issue certificates

Use a web of trust where users verify each other's identities

Use a single CA that performs both identity verification and certificate issuance

Deploy multiple root CAs that cross-certify each other

What is the primary role of a Certificate Authority (CA) in a PKI?

To monitor network traffic for malicious activity

To encrypt all network traffic within an organization

To issue, validate, and revoke digital certificates

To generate and store all private keys for users

A web application needs to check the revocation status of client certificates in real time during the TLS handshake. The application requires low latency and does not want to download large lists. Which revocation mechanism should the application use?

OCSP (Online Certificate Status Protocol)

CRL (Certificate Revocation List)

EC-CouncilNetwork Defense Essentials

Domain 6Objective 2

Public Key Infrastructure (PKI) and Digital Certificates NDE Practice Questions (Page 8)

Part of the Cryptography, PKI, and Data Security domain, which makes up ~15% of our current practice bank.

44questions here

9free pages

10concepts

Questions 36–40

36expert · hard
A company is planning to issue certificates to external partners. They want to ensure that the identity of each partner is verified according to the company's policy, but they do not want to expose their internal CA to the internet. Which architecture should they use?
Select an answer first
37application · medium
A company is setting up a PKI and wants to separate the identity verification process from the certificate signing process to improve security and scalability. Which architecture should they implement?
Select an answer first
38foundation · easy
What is the primary role of a Certificate Authority (CA) in a PKI?
Select an answer first
39foundation · easy
In a public key cryptosystem, which key is used to encrypt a message that only the intended recipient can decrypt?
Select an answer first
40application · medium
A web application needs to check the revocation status of client certificates in real time during the TLS handshake. The application requires low latency and does not want to download large lists. Which revocation mechanism should the application use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “NDE” is a trademark of its owner, used for identification only.