Cryptography Application GSEC Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which technology is commonly used to secure email messages by encrypting and digitally signing them?

   • ATLS
   • BS/MIME
   • CSSH
   • DIPsec
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An organization operates its own internal certificate authority (CA) to issue certificates for employee email signing. A senior manager's private key is suspected to have been compromised. What is the most appropriate immediate action to protect others who rely on certificates issued to that manager?

   • ARevoke the manager's certificate and publish the revocation information to the CA's CRL or OCSP responder.
   • BChange the manager's email address and issue a new certificate with the new address.
   • CIssue a new certificate to the manager with the same key pair to avoid disruption.
   • DDelete the manager's certificate from the CA database without publishing revocation.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   An organization's web server certificate is about to expire. The administrator plans to replace it with a new certificate from the same public CA. What must the administrator do to ensure clients will trust the new certificate without manual intervention?

   • AInstall the new certificate and its private key on the server, ensuring the certificate chains to a root CA that is already in the clients' trust stores.
   • BUse the same private key as the old certificate to avoid re-issuance.
   • CRevoke the old certificate and install the new one with a different subject name.
   • DAdd the new certificate to the clients' trusted root certificate store manually.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company must store customer passwords in a database. They want to protect the passwords even if the database is compromised. Which approach is the most secure and practical?

   • AUse a digital signature to sign each password and store the signature.
   • BUse a salted, slow hash function like bcrypt or PBKDF2.
   • CEncrypt the passwords with AES-256 using a key stored on the same server.
   • DStore the passwords as SHA-256 hashes without salt.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A software vendor distributes a signed update file. The vendor's public key is widely known. To verify the authenticity and integrity of the update, what should the recipient do?

   • ADecrypt the file with the vendor's public key and compare the result to a known hash.
   • BEncrypt the file with the vendor's public key and send it back to confirm the vendor can decrypt it.
   • CCompute a hash of the file and decrypt the accompanying signature with the vendor's public key, then compare the decrypted hash to the computed hash.
   • DUse the vendor's public key to decrypt the file and then re-encrypt it with a symmetric key.
   Reveal Solution Discussion Select an answer first