Public Key Infrastructure (PKI)

Question 1

Which of the following answers refers to a hierarchical system for the creation, management, storage, distribution, and revocation of digital certificates?

Web of trust
PKI
IaaS
CA

Answer 1

PKI

Question 2

A type of trusted third party that issues digital certificates used for creating digital signatures and public-private key pairs is known as:

Answer 2

Certificate Authority (CA)

Question 3

Which of the following certificate formats is used to store a binary representation of a digital certificate?

PFX
DER
P7B
PEM

Answer 3

Distinguished encoding rules (DER)

It is a binary encoding for X. 509 certificates and private keys

Question 4

A digital certificate which allows multiple domains to be protected by a single certificate is known as:

Answer 4

Subject Alternative name (SAN) certificate

Question 5

Which digital certificate type allows multiple subdomains to be protected by a single certificate?

Answer 5

Wildcard certificate

Question 6

The term “Certificate chaining” refers to a process of verifying the authenticity of a newly received digital certificate. Such process involves checking all of the certificates in the chain of certificates from a trusted root CA, through any intermediate CAs, down to the certificate issued to the end user. A new certificate can only be trusted if each certificate in that certificate’s chain is properly issued and valid.

Answer 6

True

Question 7

Copies of lost private encryption keys can be retrieved from a key escrow by recovery agents. Recovery agent is an individual with access to key database and permission level allowing him/her to extract keys from escrow.

Answer 7

True

Question 8

A trusted third-party storage solution providing backup source for cryptographic keys is referred to as:

Answer 8

Key escrow

Question 9

Which of the answers listed below refer to examples of PKI trust models?

Single CA model
Hierarchical model (root CA + intermediate CAs)
Mesh model (cross-certifying CAs)
Web of trust model (all CAs act as root CAs)
Client-server mutual authentication model
All of the above

Answer 9

All of the above

Question 10

A security mechanism that allows HTTPS websites to resist impersonation by attackers using fraudulent certificates is called:

Answer 10

HTTP Public key pinning (HPKP)

Question 11

Which of the following allows for checking digital certificate revocation status without contacting Certificate Authority (CA)?

OCSP stapling
Certificate Revocation list (CRL)
Sideloading
Certificate signing request (CSR)

Answer 11

OCSP stapling

Question 12

Which of the answers listed below refers to a method for requesting a digital certificate?

Answer 12

CSR

Question 13

What is the fastest way for validating a digital certificate?

Answer 13

OCSP

Question 14

Which digital certificate formats are commonly used to store private keys?

Answer 14

PFX and P12

Question 15

Which of the answers listed below refers to the most common format in which Certificate Authorities (CA) issue certificates?

Answer 15

PEM