7.3 Identify and Describe Public Key Infrastructure (PKI) Components CYBERSECURITY-APPRENTICE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security engineer is designing a system where users can encrypt files for each other. They want to ensure that if a user's private key is compromised, the impact is limited to that user's data. What is the most effective design choice?

   • AUse a shared key pair for all users.
   • BUse a unique key pair for each user.
   • CStore all private keys in a central database.
   • DUse a symmetric key for all users.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is setting up a PKI and wants to minimize the risk of compromise of the root CA. They plan to use an intermediate CA for issuing certificates to users. What is the primary benefit of this design?

   • AIt allows certificates to be issued without a trust chain.
   • BIt makes the root CA certificate self-signed.
   • CThe root CA can be kept offline, reducing its exposure to compromise.
   • DIt eliminates the need for a certificate revocation list (CRL).
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company wants to ensure that certificates issued to employees are trusted by all internal applications. They decide to deploy a private CA. What must be done on each client machine to ensure that certificates issued by this CA are trusted?

   • AInstall the employee's private key on each client.
   • BConfigure the client to ignore certificate errors.
   • CInstall the CA's root certificate in the client's trusted root store.
   • DInstall the intermediate CA certificate in the client's personal store.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security auditor is reviewing a system where digital signatures are used to verify software updates. The auditor wants to ensure that a compromised signing key cannot be used to sign malicious updates. What is the most effective control to implement?

   • AUse a symmetric key for signing.
   • BPublish the private key to all users for verification.
   • CUse a hardware security module (HSM) to protect the private key.
   • DRely on the certificate authority to sign all updates.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is implementing a system where users can encrypt files that only a specific recipient can decrypt. They want to use asymmetric cryptography. What should they distribute to users to allow them to encrypt files for the recipient?

   • AThe recipient's private key
   • BThe sender's private key
   • CA symmetric key shared with all users
   • DThe recipient's public key
   Reveal Solution Discussion Select an answer first