Public Key Infrastructure

You are asked by the senior system administrator to refresh the SSL certificates on the web servers. The process is to generate a certificate signing request (CSR), send it to a third party to be signed, and then apply the return information to the CSR. What is this an example of?

• Pinning

• Borrowed authority

• Third-party trust model

• Stapling

A certificate authority consists of which of the following?

• Hardware and software

• Policies and procedures

• People who manage certificates

• All of the above

Your manager wants you to review the company’s internal PKI system’s CPS for applicability and verification and to ensure that it meets current needs. What are you most likely to focus on?

• Revocations

• Trust level provided to users

• Key entropy

• How the keys are stored

You are preparing an e-mail to send to a colleague at work, and because the message information is sensitive, you decide you should encrypt it. When you attempt to apply the certificate that you have for the colleague, the encryption fails. The certificate was listed as still valid for another year, and the certificate authority is still trusted and working. What happened to this user’s key?

• It was using the wrong algorithm.

• You are querying the incorrect certificate authority

• It was revoked

• The third-party trust model failed.

Which of the following is a requirement for a CRL?

• It must have the e-mail addresses of all the certificate owners. 

• It must contain a list of all expired certificates.

• It must contain information about all the subdomains covered by the CA.

• It must be posted to a public directory.

What does OCSP do?

• It reviews the CRL for the client and provides a status about the certificate being validated.

•  It outlines the details of a certificate authority, including how identities are verified, the steps the CA follows to generate certificates, and why the CA can be trusted.

• It provides for a set of values to be attached to the certificate.

• It provides encryption for digital signatures.

The X.509 standard applies to which of the following?

• SSL providers

• Digital certificates

• Certificate revocation lists

• Public key infrastructure

You are browsing a website when your browser provides you with the following warning message: “There is a problem with this website’s security certificate.” When you examine the certificate, it indicates that the root CA is not trusted. What most likely happened to cause this error?

• The certificate was revoked.

• The certificate does not have enough bit length for the TLS protocol.

• The server’s CSR was not signed by a trusted CA.

• The certificate has expired.

You are issued a certificate from a CA, delivered by e-mail, but the file does not have an extension. The e-mail notes that the root CA, the intermediate CAs, and your certificate are all attached in the file. What format is your certificate likely in?

• DER

• CER

• PEM

• PFX

Why is pinning more important on mobile devices?

• It uses elliptic curve cryptography.

•  It uses less power for pinned certificate requests.

•  It reduces network bandwidth usage by combining multiple CA requests into one.

•  It allows caching of a known good certificate when roaming to low-trust networks.