Basics

Question 1

What does PKI stand for?

Answer 1

Public Key Infrastructure

Question 2

What is a PKI (Public Key Infrastructure)?

Answer 2

Two key (asymmetric) cryptosystem

Question 3

What are the benefits of PKI?

Answer 3

Integrity

Confidentiality

Authenticity

Non-repudiation -

Question 4

Explain the concept of PKI’s Integrity?

Answer 4

Data doesn’t change in transit. It came from who state it came from.

Question 5

Explain the concept of PKI Confidentiality?

Answer 5

(Digital Encryption) Ensures the designated person is the only one who can view the document.

Question 6

Explain the concept of PKI Authenticity?

Answer 6

Logging on, when you enter your password the local security authority runs a hash on your password (Algorithm is called Digest), a Digest is sent over the network to the server. The server (which knows your password) puts a Hash algorithm on your password and it should be the same digest.

Question 7

Explain the concept or PKI Non-repudiation

Answer 7

A maker of a signed software is not able to repudiate it since the certificate that contains the key pair is on the software.

Question 8

What is a Certificate Authority?

Answer 8

A Certificate Authority binds public keys with respected identities of entities. This binding is done through a process of registration and issuance of certificates.

Question 9

What is the concept of Certificate Enrollment?

Answer 9

Where the public key binding is done through registration and issuance of certificates.

Question 10

What can a private CA do?

Answer 10

Certify Entities such as User accounts, Smart Phone, Router, laptop or a website. It can perform the duties which a CA Infrastructure can do.

Question 11

What is the difference between a Stand Alone CA vs Enterprise CA?

Answer 11

The stand-alone CA

1. Offline
2. No AD DS required
3. All certificates are approved manually.

Enterprise CA

1. Online
2. AD DS required.
3. Certificates can be issued or denied automatically based on a policy.

Question 12

What is a two-tier CA?

Answer 12

1. Root CA (stand-alone CA), after issuing certificates to Issuing CA it goes offline.
2. Issuing CA is Enterprise CA and it’s always online. Auto-enrollment enabled.

Note: This prevents any rogue CA coming into your network since it needs to be certified through the root CA.

Question 13

What is a policy hierarchy?

Answer 13

1. Root CA (stand-alone CA), after issuing certificates to Policy CA it goes offline.
2. Policy CA defines policy at granular level and issues certificates to to Issue CA
3. Issuing CA is Enterprise CA and it’s always online. Auto-enrollment enabled.

Question 14

Can Root CA and Issuing CA be on the same server?

Answer 14

Yes, they can, many companies use this method.

Question 15

What does ADCS stand for?

Answer 15

Active Directory Certificate Services

Question 16

What is the purpose of Active Directory Certificate Services?

Answer 16

AD CS is the “Server Role that allows you to build a public key infrastructure (PKI) and provide public key cryptography, digital certificates, and digital signature capabilities for your organization.”

Basically what this means is rather than going to a third party Certificate Authority (CA) to get PKI certificates and using their hosted services, you can actually handle this in-house.

Question 17

What are the 6 roles in Active Directory Certificate Services?

Answer 17

1. Certificate Authority (CA).
2. Online Responder.
3. Network Device Enrollment Service (NDES).
4. Certificate Enrollment Web Service.
5. Certificate Enrollment Policy Web Service
6. Certification Authority Web Enrollment

Question 18

In ADCS, what is the purpose of Certificate Authority (CA).?

Answer 18

This is the core component which creates certificates for use. These certificates are issued to users or devices or to a subordinate CA.

Question 19

In ADCS, what is the purpose of Online Responder?

Answer 19

This component provides a way for certificates to be checked that is uses a small amount of network traffic.

Question 20

In ADCS, what is the purpose of Network Device Enrollment Service?

Answer 20

This component allows non-domain devices like switches and routers to obtain certificates.

Question 21

In ADCS, what is the purpose of Certificate Enrollment Web Service?

Answer 21

This allows certificates to be obtained using the web.

Question 22

In ADCS, what is the purpose of Certification Authority Web Enrollment

Answer 22

This component provides a web interface which end users can use to obtain certificates.

Question 23

What is a certificate revocation list (or CRL)?

Answer 23

A certificate revocation list (or CRL) is “a list of digital certificates that have been revoked by the issuing certificate authority (CA) before their scheduled expiration date and should no longer be trusted.”