Cryptography Concepts for Managers GSLC Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An organization's root CA certificate is about to expire. The security manager must ensure that all internal systems continue to trust certificates issued by the organization. What is the best course of action?

   • AExtend the validity of the existing root CA certificate.
   • BCreate a new root CA and cross-sign the old root with the new one to maintain trust during migration.
   • CReissue all end-entity certificates with the same root.
   • DWait until the root expires and then issue a new one.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security manager is reviewing the key management policy for a system that stores encrypted customer data. The current policy requires keys to be rotated every 90 days. However, the operations team complains that frequent rotation causes downtime because the system must be re-encrypted. The manager must balance security and operational impact. Which approach best addresses this trade-off?

   • AEliminate key rotation and rely on strong key storage.
   • BKeep the 90-day rotation but perform it during maintenance windows to minimize downtime.
   • CImplement a key management system that supports key versioning and transparent re-encryption.
   • DExtend the rotation period to 365 days to reduce operational impact.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the role of a digital signature in providing authentication?

   • AIt encrypts the message so only the intended recipient can read it
   • BIt ensures that the message is delivered to the correct recipient
   • CIt proves the identity of the sender because only the sender's private key could have created the signature
   • DIt verifies that the message has not been altered during transmission
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security manager is designing a system to store audit logs that must be tamper-evident. The logs are generated by multiple servers and must be verified by an external auditor. The manager wants to ensure that any modification to the logs is detectable and that the logs can be attributed to the originating server. What is the best approach?

   • AEncrypt the logs with a shared symmetric key.
   • BStore logs in a database with restricted access.
   • CUse a checksum for each log file and store it in a separate location.
   • DHash each log entry and sign the hash chain with the server's private key.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary threat posed by a birthday attack on a cryptographic hash function?

   • AIt allows an attacker to recover the original plaintext from the hash
   • BIt allows an attacker to decrypt data without knowing the key
   • CIt increases the likelihood of finding two different inputs that produce the same hash (a collision)
   • DIt allows an attacker to impersonate a user by stealing their private key
   Reveal Solution Discussion Select an answer first