A company's internal CA issues a certificate to a web server. The server's private key is accidentally exposed in a log file. The security team needs to ensure that clients no longer trust this certificate. Which action should be taken?

Reissue the same certificate with a new serial number.

Revoke the certificate and publish a new CRL.

Delete the certificate from the CA database.

Wait for the certificate to expire naturally.

An administrator is creating a CSR for a new server certificate. The administrator has already generated a private key. What is the next step in the process?

Wait for the CA to generate a key pair for the server.

Install the private key on the server before requesting the certificate.

Submit the private key to the CA for signing.

Create a CSR using the private key and the server's public information.

A small company sets up a private PKI. They create a self-signed root CA and directly issue end-entity certificates from it. A security auditor recommends adding an intermediate CA. What is the primary security benefit of this change?

It allows the root CA key to be kept offline, reducing the risk of compromise.

It reduces the size of the CRL that clients must download.

It eliminates the need for a CRL or OCSP responder.

It makes the certificate chain shorter, improving performance.

What is the purpose of a certificate revocation list (CRL)?

To list all certificates issued by a CA

To list certificates that have been revoked before their expiration

An administrator needs to request a new TLS certificate for a web server. The server will be reachable at both 'www.example.com' and 'example.com'. The administrator generates a private key and creates a CSR. Which of the following must be included in the CSR to ensure the certificate is valid for both hostnames?

Two separate CSRs, one for each hostname.

A wildcard entry in the Subject field, such as '*.example.com'.

A Common Name field set to 'www.example.com' only.

A Subject Alternative Name extension containing both DNS names.

LPIC-3 Security

Domain 1Objective 1

325.1 X.509 Certificates and Public Key Infrastructures (weight: 5) LPIC-3-SECURITY Practice Questions (Page 3)

Part of the Topic 325: Cryptography domain, which makes up ~28% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~10–17 in this domain), expect 3–4 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

12concepts

Questions 11–15

11application · medium
A company's internal CA issues a certificate to a web server. The server's private key is accidentally exposed in a log file. The security team needs to ensure that clients no longer trust this certificate. Which action should be taken?
Select an answer first
12application · easy
An administrator is creating a CSR for a new server certificate. The administrator has already generated a private key. What is the next step in the process?
Select an answer first
13application · medium
A small company sets up a private PKI. They create a self-signed root CA and directly issue end-entity certificates from it. A security auditor recommends adding an intermediate CA. What is the primary security benefit of this change?
Select an answer first
14foundation · easy
What is the purpose of a certificate revocation list (CRL)?
Select an answer first
15application · medium
An administrator needs to request a new TLS certificate for a web server. The server will be reachable at both 'www.example.com' and 'example.com'. The administrator generates a private key and creates a CSR. Which of the following must be included in the CSR to ensure the certificate is valid for both hostnames?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to LPIC-3-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “LPIC-3-SECURITY” is a trademark of its owner, used for identification only.