Implementing Public Key Infrastructure (PKI)

Question 1

A software process that authenticates through certificates wants to check to see if a certificate is still valid. What can the process check?

Answer 1

CRL and OSCP

Certificate authorities (CAs) must maintain a certificate revocation list (CRL) of all revoked and suspended certificates, which they can distribute throughout the hierarchy.

Rather than return a whole CRL, an Online Certificate Status Protocol (OCSP) server communicates the status of the requested certificate.

Question 2

A developer wants to create a certificate to show the browser plugin is trusted. What could the developer use?

Answer 2

Code signing

A code signing certificate issued to a software publisher follows some type of identity check and validation process by the certificate authority (CA).

Question 3

A network administrator is searching for an open source network access control (NAC) solution to integrate with the company’s public key infrastructure (PKI) environment. What could the administrator use?

Answer 3

PacketFence

PacketFence is an open source NAC (Network Access Control) solution that can work with Microsoft public key infrastructure (PKI).

Question 4

A website administrator wants a digital certificate that requires more rigorous checks. What could the administrator try to use?

Answer 4

EV

Extended Validation (EV) is subject to a process that requires more rigorous checks on the subject’s legal identity and control over the domain or software the certificate authority (CA) signs.

Question 5

A Windows client administrator is implementing a solution for data in use. What is an example of security protection for data in use?

Answer 5

Software Guard Extensions

Trusted execution environment (TEE) mechanisms, such as Intel Software Guard Extensions, can encrypt data as it exists in memory so that an untrusted process cannot decode the information.

Question 6

A systems manager is in charge of endpoint devices and wants to specify using a trusted CA. What should the systems manager specify?

Answer 6

Trusted providers

Trusted providers involve pre-configured lists of certificate authorities (CAs), and most often found stored within modern browsers or within the configuration of the operating system.