Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Kindle 601 Review > Implementing PKI > Flashcards

Implementing PKI Flashcards

1
Q

What type of certificate does CA have?

A

A CA has a root certificate which it uses to sign keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

If you are going to use a CA internally what type of CA should you use

A

Private CA for internal use only; these certificate will not be accepted outside of your organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

If you want to carry out B2B activity with third-party companies or sell products on the web, what type of CA Sshoukd you use

A

Public CA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Why you should take your CA offline when not in use

A

To prevent it from being compromised specially if you were a military, security or banking organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What type of encryption does PKI use?

A

Assymetric encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Who signs x509 certificate

A

Certificate Authority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What can you use to prevent your CA from being compromised and faudulent certificates from being issued?

A

Certificate pinning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

If two entities wants to set up a cross-certification, what must they set up first

A

Bridge trust model -if two separate PKI entities wants to set up cross-certification, the root CAs would set up a trust model between themselves.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What type of trust model does PGP use

A

Web of trust or network trust model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How can you tell whether your certificate is valid?

A

Certificate Revocation List is used to detemine whether a certificate is valid

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

If the CRL is going slowly what should you implement?

A

OCSP provides faster validation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Explain certificate stapling/OCSP stapling

A

The webserver uses ocsp for faster certificate authentication, by passing CRL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the process of obtaining a new certificate?

A

Submitting certificate signing request to request a new certificate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the purpose of the key escrow

A

Stores and manages private key for third parties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What the purpose of HSM

A

Hardware Security Module is used by the Key escrow to securely store and manage certificate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the purpose of DRA and what does it need to complete its role effectively

A

Data Recovery Agent is to recover data when a user’s private key becomes corrupt. To do this you must obtain a copy of the private key from the key escrow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How can you identify each certificate?

A

By its Object Identifier, which is similar to a serial number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What format PKCS is a private certificate and what file extension does it have

A

A private certificate is in P12 format with a .pfx extension

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What format PKCS is a public certificate and what file extension does it have

A

A public certificate is in P7B format wirh a .cer extension

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What format is PEM certificate

A

Pem certificate is in base64 format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What type of certificate can be used on multiple servers in the same domain

A

A wildcard certificate can be used on multiple server in the same domain

22
Q

What certificate can be used on multiple domain

A

Subject Alternative Name SAN

23
Q

What should you do with your software to verify that it is original and not a fake copy?

A

Code signing, this is similar to a digital signature in that it ensure the integrity of the software

24
Q

What is the purpose of Extended validation of an x509

A

To provide higher level of trust, normally used by financial instituions

25
Q

What type oof cipher is the Caesar Cipher and how does it work if it uses rot 4

A

Caesar cioher is a substitution cipher; an example would be ROT 4 where wach letter would be substituted by a letter four characters along in the alphabeth

26
Q

What is encryption and what are the inputs and outputs called

A

Encryption is when the plain text (input) is taken and turned into ciphertext (output)

27
Q

What type of encryption will be used to encrypt large amounts of data?

A

Symmetric encryption us used to encrypt large amount of data as it uses one key

28
Q

What is the purpose of diffie-Hellman

A

DH is an symmetric technique that creates a secure tunnel. During a VPN connection, it is used during the IKE phase and uses UDP port 500 to create the VPN tunnel

29
Q

What is the first stage in asymmetric encryption

A

Key Exchange. During asymmetric encryption, each entity will give the other entity its public key. The private key is secure and never given away

30
Q

If Carol is encrypting the data to send to bob what key will each of them use

A

Carol uses Bob’s public key to encrypt the data and then Bob will use his private key to decrypt the data. Encryption and decryption are always done by the same key pair.

31
Q

If George enrtpted data for years ago with an old CAC card, can he decrypt the data with his new CAC card

A

No, George must obtain the old private ket to decrypt the data as the encryption was done with a different key pair

32
Q

If Janet is digitally signing an email to send to John to prove that it has not been tampered with in transit, what key will they each use?

A

Janet will digitally sign the email with her private key and john will check the validity with janets public key which he would have received un advance

33
Q

What asymmetric encryption algorithm should you use to encrypt data on a smart phone

A

ECC will be used to encrypt data on a smartphone as it is small and fast and uses DH handshake

34
Q

What should you use to encrypt a military monile telephone

A

AES 256

35
Q

Name two key stretching algorithms

A

Bcrypt and PBKDF2

36
Q

What two thinfs does a digital email signature provide

A

Integrity and Non repudiation

37
Q

Explain how key stretching works

A

Key stretching salts the password being stored to prevent duplicate passwords. It also increases the length of the keys to make things harder for a brute-force attack.

38
Q

What is the difference between stream and block cipher modes and which one will you use to encrypt large blocks of data

A

Stream ciphers encrypt one bit at a time and block ciphers take blocks of data, such as 128-bit modes. You would use a block cipher for large amounts of data.

39
Q

What happens with cipher block chaining if yoy dont have all of the blocks

A

CBC needs all of the blocks of data to decrypt the data; otherwise, it will not work.

40
Q

If you want to ensure the integrity of data, what should you use? Name two algorithm

A

Hashing ensures the integrity of data; two examples include SHA-1 (160 bit) and MD5 (128 bit).

41
Q

If you want to ensure the protection of data what should

A

Encryption is used to protect data so that it cannot be reviewed or accessed.

42
Q

Is a hash one way or two function and is it reversible

A

A hash is one-way and cannot be reversed.

43
Q

What type of a man in the middle attack is SSL 3.0 CBC vulnerable to

A

POODLE is a man-in-the-middle attack on a downgraded SSL 3.0 (CBC).

44
Q

Define Diffie Hellman Ephemeral ans Elliptic Curve Diffie Hellman Ephemeral

A

DHE and ECDHE are both ephemeral keys that are short-lived, one-time keys.

45
Q

What are the strongest and weakest methods of encryption with an L2TP/IPSec VPN tunnel

A

The strongest encryption for an L2TP/IPSec VPN tunnel is AES, and the weakest isDES.

46
Q

What is the name of the key used to ensure the security of communication between a conputer and server or a computer to another computer

A

A session key ensures the security of communications between a computer and a server or a computer and another computer.

47
Q

What should you do to protect a data at rest on the laptop?

A

Full Disk Encryption

48
Q

What should you do to protect data at rest on the tablet or smartphone

A

Full device encryption

49
Q

What should you do to protect data at rest on a backend server

A

Data-at-rest on a backend server is stored on a database. Therefore, to protect it, you would encrypt the database.

50
Q

What should you do to protectdata at rest on a removable device, such as a USB flash drive or an external hard drive

A

You would protect data-at-rest on a USB flash drive or external hard drive via full disk encryption.

Kindle 601 Review (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions