What is the primary security benefit of keeping a root CA offline?

It reduces the risk of the root private key being compromised

It speeds up certificate issuance

It eliminates the need for a CRL

It allows the root CA to issue certificates directly to clients

A company's CA has issued a certificate that is now compromised. The CA uses OCSP for revocation checking. The administrator revokes the certificate and updates the OCSP responder. However, some clients are still accepting the certificate. What is the most likely reason?

The clients are using cached OCSP responses.

The certificate's serial number is incorrect.

The certificate was not added to the CRL.

Which OpenSSL command is used to create a self-signed certificate for a new root CA?

openssl genrsa -out ca.key 4096

openssl ca -selfsign -keyfile ca.key -out ca.crt

openssl x509 -req -signkey ca.key -out ca.crt

openssl req -x509 -newkey rsa:4096 -keyout ca.key -out ca.crt -days 3650

In which scenario is a client certificate typically used?

To verify the server's hostname

To encrypt the server's hard drive

To authenticate a user to a web application

LPIC-3 Security

Domain 1Objective 1

325.1 X.509 Certificates and Public Key Infrastructures (weight: 5) LPIC-3-SECURITY Practice Questions (Page 1)

Part of the Topic 325: Cryptography domain, which makes up ~28% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~10–17 in this domain), expect 3–4 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

12concepts

Questions 1–5

1foundation · easy
What is the primary security benefit of keeping a root CA offline?
Select an answer first
2foundation · easy
In a typical trust chain, which certificate is at the top of the hierarchy and is self-signed?
Select an answer first
3expert · hard
A company's CA has issued a certificate that is now compromised. The CA uses OCSP for revocation checking. The administrator revokes the certificate and updates the OCSP responder. However, some clients are still accepting the certificate. What is the most likely reason?
Select an answer first
4foundation · easy
Which OpenSSL command is used to create a self-signed certificate for a new root CA?
Select an answer first
5foundation · easy
In which scenario is a client certificate typically used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to LPIC-3-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “LPIC-3-SECURITY” is a trademark of its owner, used for identification only.