022.1 Cryptography and Public Key Infrastructure (weight: 3) SECURITY-ESSENTIALS Practice Questions (Page 1)

Questions 1–5

1. 1application · easy

   A system administrator is examining an X.509 certificate for a web server. The administrator wants to confirm which organization the certificate was issued to and which CA signed it. Which two fields in the certificate should the administrator examine?

   • AThe 'Version' field for the certificate holder and the 'Extensions' field for the CA.
   • BThe 'Public Key' field for the certificate holder and the 'Signature Algorithm' field for the CA.
   • CThe 'Subject' field for the certificate holder and the 'Issuer' field for the CA that signed it.
   • DThe 'Serial Number' field for the certificate holder and the 'Validity' field for the CA.
   Reveal Solution Discussion Select an answer first
2. 2application · easy

   A security analyst needs to verify that a downloaded firmware file has not been corrupted or tampered with during the download. The vendor published a SHA-256 hash of the original file on their official website. Which action should the analyst take?

   • ADecrypt the published hash with the vendor's private key to recover the original file.
   • BVerify the file's digital signature by decrypting it with the vendor's public key.
   • CEncrypt the downloaded file with the vendor's public key and compare the ciphertext to the published hash.
   • DCompute the SHA-256 hash of the downloaded file and compare it to the published hash.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In asymmetric encryption, which key is used to decrypt data that was encrypted with the public key?

   • AAny key in the key pair
   • BThe private key
   • CThe public key
   • DA shared secret
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company's web server certificate was revoked because the private key was compromised. A client application that connects to the server is configured to check certificate status. The client does not support OCSP stapling. Which mechanism will the client most likely use to determine that the certificate is no longer valid?

   • ADownload and consult the Certificate Revocation List (CRL) published by the issuing CA.
   • BCompare the certificate's serial number to the list of certificates stored in the local trust store.
   • CContact the certificate subject directly to ask if the key is still valid.
   • DCheck the certificate's validity period and reject it if the expiration date has passed.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a primary weakness of symmetric encryption?

   • AIt cannot provide confidentiality.
   • BIt is computationally slower than asymmetric encryption.
   • CIt requires a secure method to share the same key between parties.
   • DIt uses two different keys for encryption and decryption.
   Reveal Solution Discussion Select an answer first