What is the primary purpose of the Diffie-Hellman key exchange protocol?

To encrypt data using a public key and decrypt with a private key

To digitally sign a message to prove its origin

To compress data before transmission

To allow two parties to establish a shared secret key over an insecure channel

An administrator needs to decommission a server that stored a private key used for signing software updates. The key must be destroyed so that it cannot be recovered. Which method is most appropriate?

Use the HSM's secure key destruction function, if the key is stored in an HSM

Overwrite the storage area with random data multiple times

Delete the key file and empty the recycle bin

Format the hard drive and reinstall the operating system

A large enterprise has a PKI with multiple subordinate CAs. A subordinate CA's private key is suspected of being compromised. The enterprise needs to minimize the impact on clients while ensuring that certificates issued by that CA are no longer trusted. Which approach should be taken?

Only revoke the individual certificates that are suspected of being compromised

Rotate the subordinate CA's key pair without revoking the CA certificate

Revoke the subordinate CA certificate and add it to the CRL, then reissue certificates from a new CA

Wait for the CA certificate to expire naturally

What is a key advantage of using blockchain technology for decentralized public key infrastructure (PKI)?

It eliminates the need for cryptographic algorithms

It guarantees that private keys are never compromised

It provides a tamper-evident, distributed ledger for storing public key information

It makes all public keys visible to everyone, which is a security feature

What is the purpose of a certificate revocation list (CRL)?

To list all certificates that are currently valid

To store the private keys of all users

To list certificates that have been revoked before their expiration date

To provide a backup of all issued certificates

Systems Security Certified Practitioner

Domain 5Objective 4

5.4 - Understand Public Key Infrastructure (PKI) SSCP Practice Questions (Page 6)

Part of the Cryptography domain, which accounts for 9% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–7 in this domain), expect 1–2 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

11concepts

9%of the exam

Questions 26–30

26foundation · easy
What is the primary purpose of the Diffie-Hellman key exchange protocol?
Select an answer first
27application · medium
An administrator needs to decommission a server that stored a private key used for signing software updates. The key must be destroyed so that it cannot be recovered. Which method is most appropriate?
Select an answer first
28expert · hard
A large enterprise has a PKI with multiple subordinate CAs. A subordinate CA's private key is suspected of being compromised. The enterprise needs to minimize the impact on clients while ensuring that certificates issued by that CA are no longer trusted. Which approach should be taken?
Select an answer first
29foundation · easy
What is a key advantage of using blockchain technology for decentralized public key infrastructure (PKI)?
Select an answer first
30foundation · easy
What is the purpose of a certificate revocation list (CRL)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.