022.2 Web Encryption (weight: 2) SECURITY-ESSENTIALS Practice Questions (Page 3)

Questions 11–15

1. 11expert · medium

   A security team is configuring a web server to use TLS. They want to ensure that clients can detect if a certificate is revoked. The server currently uses a certificate from a public CA. Which configuration should they implement?

   • AEnable OCSP stapling on the web server.
   • BConfigure the server to use a different cipher suite.
   • CUse only self-signed certificates to avoid revocation issues.
   • DDisable certificate revocation checks to improve performance.
   Reveal Solution Discussion Select an answer first
2. 12expert · medium

   A security analyst is investigating a possible man-in-the-middle attack. The analyst notices that the browser shows a valid certificate for the website, but the certificate was issued by a CA that is not in the browser's default trust store. What does this indicate?

   • AThe certificate is definitely valid and secure.
   • BThe certificate is revoked.
   • CThe CA may have been added to the trust store by an administrator or malware.
   • DThe website is using a self-signed certificate.
   Reveal Solution Discussion Select an answer first
4. 13expert · medium

   A company's web server certificate is about to expire. The administrator renews the certificate with the same CA, but after installation, some users report that the browser shows a warning about the certificate chain. What is the most likely cause?

   • AThe certificate's private key was changed.
   • BThe intermediate certificate was not installed on the server.
   • CThe certificate was revoked.
   • DThe certificate was issued for a different domain.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which component of a PKI is responsible for publishing certificates so that clients can retrieve them?

   • ARegistration authority
   • BCertificate repository
   • CCertificate revocation list
   • DKey escrow service
   Reveal Solution Discussion Select an answer first
6. 15expert · medium

   A security auditor is reviewing a web server's TLS configuration and finds that it supports the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA. The auditor recommends disabling this suite. Which reason best supports the auditor's recommendation?

   • AIt uses RSA key exchange, which does not provide forward secrecy.
   • BIt uses SHA, which is a broken hash function.
   • CIt uses CBC mode, which is always insecure.
   • DIt uses AES, which is a weak encryption algorithm.
   Reveal Solution Discussion Select an answer first