An organization wants to implement mutual TLS (mTLS) for a service. The server already has a certificate. What must be configured on the client side to complete the setup?

A copy of the server's certificate.

A client certificate and its corresponding private key.

A certificate revocation list (CRL).

A client application is failing to validate a server's certificate. The administrator checks the server's certificate and sees that it was issued by an intermediate CA. The client's trust store contains only the root CA certificate. Which of the following is the most likely cause of the validation failure?

The server is not sending the intermediate CA certificate during the TLS handshake.

The root CA certificate is expired.

The client's trust store is corrupted.

The server's certificate has a weak signature algorithm.

Which command is commonly used to generate a new RSA private key and a certificate signing request in a single step?

openssl genrsa -out server.key 2048

openssl ca -in server.csr -out server.crt

openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr

openssl x509 -req -in server.csr -signkey ca.key -out server.crt

LPIC-3 Security

Domain 1Objective 1

325.1 X.509 Certificates and Public Key Infrastructures (weight: 5) LPIC-3-SECURITY Practice Questions (Page 5)

Part of the Topic 325: Cryptography domain, which makes up ~28% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~10–17 in this domain), expect 3–4 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

12concepts

Questions 21–25

21application · medium
An organization wants to implement mutual TLS (mTLS) for a service. The server already has a certificate. What must be configured on the client side to complete the setup?
Select an answer first
22foundation · easy
Which X.509v3 extension is used to specify additional hostnames or IP addresses for which a certificate is valid?
Select an answer first
23expert · hard
A client application is failing to validate a server's certificate. The administrator checks the server's certificate and sees that it was issued by an intermediate CA. The client's trust store contains only the root CA certificate. Which of the following is the most likely cause of the validation failure?
Select an answer first
24foundation · easy
Which X.509v3 extension indicates that a certificate can be used to sign other certificates?
Select an answer first
25foundation · easy
Which command is commonly used to generate a new RSA private key and a certificate signing request in a single step?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to LPIC-3-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “LPIC-3-SECURITY” is a trademark of its owner, used for identification only.

325.1 X.509 Certificates and Public Key Infrastructures (weight: 5) LPIC-3-SECURITY Practice Questions (Page 5)

Questions 21–25

An organization wants to implement mutual TLS (mTLS) for a service. The server already has a certificate. What must be configured on the client side to complete the setup?

Which X.509v3 extension is used to specify additional hostnames or IP addresses for which a certificate is valid?

Which X.509v3 extension indicates that a certificate can be used to sign other certificates?

Which command is commonly used to generate a new RSA private key and a certificate signing request in a single step?

Keep studying — Topic 325: Cryptography