022.1 Cryptography and Public Key Infrastructure (weight: 3) SECURITY-ESSENTIALS Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A small company needs to encrypt data at rest on a single file server. The administrator is considering AES-256 with a single shared key. The company's security policy requires that if one employee leaves, the data must remain protected and the departing employee must no longer be able to access it. Which additional control is most important to meet this requirement?

   • ASwitch to asymmetric encryption with a public/private key pair for the file server.
   • BUse a longer key, such as AES-512, to make brute-force attacks impractical.
   • CSecurely delete or rotate the shared key and re-encrypt the data with a new key.
   • DStore the key in a hardware security module (HSM) and never export it.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In a hierarchical trust model, what is the top-level entity called?

   • ARegistration Authority
   • BRoot CA
   • CEnd entity
   • DIntermediate CA
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company needs to encrypt a large volume of data (multiple terabytes) being transferred between two data centers over a private link. The data is not highly sensitive but must be protected from casual interception. The security team wants to minimize the performance impact of encryption. Which approach is most appropriate?

   • AUse a hash function such as SHA-256 to encrypt the data.
   • BUse a symmetric algorithm such as AES-256 with a key exchanged securely beforehand.
   • CUse an asymmetric algorithm such as RSA-2048 to encrypt the entire data stream.
   • DUse a digital signature on the data instead of encryption.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary role of a Certificate Authority (CA) in a PKI?

   • ATo store and distribute certificates to users
   • BTo generate and issue digital certificates
   • CTo encrypt data for secure transmission
   • DTo verify the identity of users before certificate issuance
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the purpose of a Certificate Revocation List (CRL)?

   • ATo store the public keys of all users
   • BTo list all certificates issued by a CA
   • CTo provide a backup of private keys
   • DTo list certificates that have been revoked before their expiration date
   Reveal Solution Discussion Select an answer first