Information Security Careers and Certifications - Module 4

Module 4 Question: Alarik is explaining to a colleague about digital certificates. Which of the following statements would he use to correctly describe the need for digital certificates? a. It can speed up processing time when using a web browser. b. It can hide the public key so that it cannot be abused. c. It can confirm the true identity of the sender of an encrypted message. d. It can replace digital signatures with a more robust technology. Answers: b Question: What is a technology used to associate a user's identity to a public key and has been digitally signed by a trusted third party? a. digital signature b. digital certificate c. digital codebook d. digital signing repository (DSR) Answers: b Question: Ville has been asked by his supervisor to review the contents of a questionable digital certificate. Which of the following would Ville NOT find in it? a. owner's private key b. serial number of the digital certificate c. name of the issuer d. owner's name or alias Answers: a Question: Who is responsible for verifying the credentials of an applicant for a digital certificate? a. CA b. registration authority c. CSR d. intermediate CSR Answers: b Question: Which of the following is NOT a means by which a person requesting a digital certificate can be authenticated? a. birth certificate b. employee badge c. email d. telephone number Answers: d Question: What is the strongest technology that would assure Alice that Bob is the sender of a message? a. digital signature b. encrypted signature c. digest d. digital certificate Answers: d Question: What is a publicly accessible centralized directory of digital certificates that can be used to view the status of a digital certificate? a. CA b. CR c. CB d. CX Answers: b Question: Ansgar is studying how digital certificates can be used. Which of the following is NOT a use of a digital certificate? a. to encrypt messages for secure email communications b. to encrypt channels to provide secure communication between clients and servers c. to verify the authenticity of the CA d. to verify the identity of clients and servers on the web Answers: c Question: Which of the following performs a real-time lookup of a certificate's status? a. Pinning b. OCSP c. Clipping d. Remote lookup protocol (RLP) Answers: b Question: Which of the following is NOT true about a root digital certificate? a. The next level down is one or more intermediate certificates. b. It is self-signed. c. It is created and verified by a CA. d. It is the endpoint of the chain. Answers: d Question: Tordis has been asked to acquire a digital certificate that will cover all the subdomains of a new site. Which type of certificate would he acquire? a. omnibus digital certificate b. subname digital certificate c. wildcard digital certificate d. NAXX Answers: c Question: Bengt is setting up a new web server that will have several IP addresses. He only wants to acquire a single digital certificate. Which type of certificate will he acquire? a. SAN b. Asterisk digital certificate (ADC) c. Domain digital certificate d. EV Answers: a Question: What is the standard format for digital certificates? a. CN b. RCN c. CER x9 d. X-509 Version 3 Answers: d Question: Which of the following is false about PKI? a. It is the underlying infrastructure that serves as a key management system for controlling public keys, private keys, and digital certificates. b. It is the set of software, hardware, processes, procedures, and policies that are needed to create, manage, distribute, use, store, and revoke digital certificates across large user populations. c. It is digital certificate management at scale. d. It must be used by all enterprises with over 1,000 employees. Answers: d Question: Which is the first step in a key exchange? a. The browser generates a random value ("Pre-master secret"). b. The web server sends a message ("ServerHello") to the client. c. The web browser verifies the server certificate. d. The web browser sends a message ("ClientHello") to the server. Answers: d Question: Dag wants to set up a trust model in which he only will serve as a CA. Which trust model will he choose? a. bridge trust model b. distributed trust model c. hierarchical trust model d. sole trust model Answers: c Question: Einar has been asked to create a new policy that outlines the process in which keys are managed by a third party and the private key is split with each half encrypted. What policy is Einar creating? a. key recovery policy b. key expiration policy c. extended validation policy d. key escrow policy Answers: d Question: Which of the following is the most comprehensive secure communication and transport protocol? a. SSL b. TLS c. IPSec d. HSS Answers: c Question: Gjord has been assigned to design an implementation of IPSec at an old manufacturing plant that has legacy network equipment and many devices. Which implementation will he choose? a. SRSR b. AR Stack c. BITW d. BITS Answers: d Question: Which of the following is NOT a primary characteristic for determining the resiliency of a key to attacks? a. randomness b. key derivation c. cryptoperiod d. key length Answers: b Question: Which of the following most accurately describes the CSR generation process? a. Create keys, sign request issues digital certificate. b. Create keys, sign request issues digital certificate. c. Create keys, sign request issues digital certificate. d. Create keys, sign request issues digital certificate. with public key, send public key to RA, CA with private key, send public key to RA, CA with public key, send private key to RA, CA with private key, send private key to RA, CA Answers: a Question: Answers: Question: Answers: Question: Answers: Question: Answers: Question: Answers: Question: Which of the following is a true statement regarding the indicated block cipher mode? Select two. a. CTR requires the control engine on the sender and receiver to be synchronized. b. Although ECB uses a basic approach, it is still among the most effective block cipher modes. c. GCM computes a MAC to ensure the message was not tampered with during transmission. d. CBC uses the output of a round of encryption as input for the next round. Answers: c, d Question: Which of the following represents valid entities for which digital certificates can be used? Select all that apply. a. b. c. d. e. Word document Software PDF file Email Printer Answers: all of them Question: How is a digital signature different, or similar, to a digital certificate? Select two. a. A digital certificate is more trustworthy than a digital signature. b. In some respects, a digital signature is like a passport or driver's license. c. A digital signature can be used to confirm the sender's identity. d. A digital certificate helps confirm its owner's identity. e. Both are signed by a third party to confirm the sender's authenticity. Answers: a, d Question: What type of information are you most likely to find in a digital signature and/or in a digital certificate? Select two. a. b. c. d. e. f. A A A A A A digital digital digital digital digital digital Answers: a, e certificate contains a digital signature. signature can contain an email address. signature contains a public key. signature contains an expiration date. certificate can contain a postal address. certificate contains a private key. Question: Which of the following is a characteristic that helps determine the strength of a key? Select three. a. b. c. d. e. f. Duration Impermanence Lifecycle Cryptoperiod Key space Randomness Answers: d,e,f Question: PKI is the underlying infrastructure used for controlling which of the following entities? Select two. a. b. c. d. e. Digital certificates Certificate policy Public keys Key storage Bridge trust model Answers: a, c Question: A key was revoked before it expired. Xan takes the revoked key out of the revocation state and reactivates it to extract and decrypt old messages from an email archival system. What is this type of key reactivation called? a. b. c. d. Key recovery Key reestablishment A revoked key cannot be reinstated. Key reinstatement Answers: c Question: Onjolee wants to ensure she can use one digital certificate for www.mysite.com, www.mysite.org, and www.mysite.info. Which of the following best describes the type of digital certificate she should use? a. b. c. d. EV Multisite SAN Wildcard Answers: c Question: As a security compliance specialist, you are asked to produce CP and CPS documents. Which of the following statements most accurately defines these two types of documents? Select three. a. A CP includes information on how end-users register for a digital certificate. b. A CPS is a more technical document than a CP. c. A CP is a set of rules that govern the operation of a PKI. d. A CPS can be referenced in the OID of a digital certificate. e. The CPS provides recommended baseline security requirements for the operation of CAs. f. A CP describes in detail how the CA uses and manages certificates. Answers: b,c,d Question: Which of the following represents attributes, or attribute examples, that an X.509 digital certificate must include? Select three. a. b. c. d. e. f. IP address of end device Encryption keys URL *.mysite.com www.mysite.com Revocation status field Answers: b, d,e Question: IPSec is considered a transparent protocol. Which of the following statements best describes what this means? Select two. a. b. c. d. e. IPSec is natively part of the IPv4 and IPv6 protocol. Programs do not need to be modified to run under IPSec. IPSec advertises its existence to deter malicious actors. Users do not need to be trained on specific security procedures. IPSec can be easily configured to operate on any piece of hardware. Answers: b, d Question: Charlie, a manager, wants to implement TLS because he thinks it is easier to configure. However, Perry recommends using IPSec instead. Which of the following statements could be used to justify implementing one over the other? Select two. a. IPSec authenticates that packets received were sent from the source. b. IPSec supports tunnel mode while TLS supports transport mode to transmit and receive data. c. TLS uses ISAKMP/Oakley to generate keys and authenticate users using digital certificates. d. IPSec manages the keys to ensure they are not intercepted by unauthorized parties. e. TLS uses ESP to ensure that no other parties can view the contents. Answers: a, d Question: Which of the following statements is true relative to the concept of certificate chaining? Select two. a. The endpoint of a chain is a user digital certificate. b. Root digital certificates are self-signed. c. There should not be more than one intermediate CA between the "root" CA and the end of the chain. d. Root CAs validate all digital certificates. Answers: a, b Question: Yandelli is responsible for protecting data in transit. However, the scheme he is attempting to adopt will encapsulate encrypted information with unencrypted information. What is a potential consequence of this behavior? a. The security of the transmitted data will be compromised. b. The scheme is okay but only if data is not transmitted through a public network. c. You cannot transmit encrypted and unencrypted data simultaneously. d. Data will be transmitted securely. Answers: d Question: A digital certificate needs to be added to a CRL. If there is too much delay in adding it to the CRL, what is a potential consequence, if any? a. You will not be able to encrypt or decrypt using the corresponding public key. b. The expiration date will automatically be extended, increasing the potential for abuse. c. You will not be able to encrypt or decrypt using the corresponding private key. d. Security may be compromised. e. There are no consequences because it is inactive. Answers: d Question: You want to open an account with an online bank that is paying five percent interest because other banks are only paying two percent. You open a browser and go to bankofutopi.com but get a little suspicious. What can you do to help determine if this is a trusted site? a. b. c. d. Contact the digital signature authority. Check the digital certificate. Check the digital signature. Contact the certificate authority. Answers: b