Deck 3: Essential Public Key Infrastructure

Question 1

12)If a CA creates a certificate that is signed by its own private key, it is commonly known as a(n) ____.

A) intermediate CA
B) self-signed CA
C) mid-level CA
D) domain CA

Answer 1

B

Question 2

1)The foundation of PKI was established approximately 30 years ago with the invention of private key cryptography.

Answer 2

False

Question 3

7)The core services provided by PKI are ____ , integrity and confidentiality.

A) authentication
B) authorization
C) availability
D) nonrepudiation

Answer 3

A

Question 4

2)The most common method of entity authentication is a prompting for a user ID and password.

Question 5

13)A CA certificate signed by another CA's private key is referred as a(n) ____ .

A) self-signed CA
B) root CA
C) intermediate CA
D) top-level CA

Question 6

20)The ____ phase ensures that the private key and public key certificates created are used correctly and efficiently in the PKI community.

A) registration
B) issued
C) initialization
D) cancellation

Question 7

6)Digital signature provides not only data origin authentication but also data ____.

A) availability
B) entity confidentiality
C) integrity
D) confidentiality

Question 8

3)The fundamental premise of public key cryptography is to provide secure communication between strangers.

Question 9

11)____ is the certification of a document as authentic and true by a public official known as a "notary public."

A) Trusted source
B) Nonrepudiation
C) Authentication
D) Notarization

Question 10

15)A(n) ____ creates key pairs and also implements backup and recovery of private keys.

A) CRL server
B) certificate bank
C) key management server
D) OCSP server

Question 11

14)Any method of publishing a certificate without a network-access protocol can be classified as ____ sharing.

A) in-line
B) real-time
C) mail-based
D) out-of-band

Question 12

9)The technical term "____" refers to communications that occur outside of previously established communications method or channel.

A) real-time
B) in-line
C) in-band
D) out-of-band

Question 13

5)Key and certificate life cycle management must be in place to enable public key cryptography to be used correctly.

Question 14

16)An X.509 v3 certificate ____ extension is a bit string used to indicate the usage supported by the public key of this certificate.

A) certificate policies
B) key usage
C) private key usage period
D) policy mappings

Question 15

10)____ is a service that provides the assurance that an entity remains honest about its actions.

A) Nonrepudiation
B) Availability
C) Integrity
D) Confidence

Question 16

8)____ authentication means that only a single assurance method is used for authentication.

A) Simple
B) Single-factor
C) Entity
D) Data origin

Question 17

18)The ____ is intended for displaying information to a replying party when a certificate is used.

A) URI qualifier
B) CPS pointer
C) user notice qualifier
D) OID statement

Question 18

4)The initial creation of the public and private key pair is usually performed in the certificate authority's system.

Question 19

17)____ is a critical extension only applicable for CA certificates. It is composed of two fields called permitted subtrees and excluded subtrees.

A) Name constraints
B) Policy mappings
C) Policy constraints
D) Basic constraints

Question 20

19)____ is the process in which the identity of an end entity is established and verified.

A) Registration
B) Keying material generation
C) Certificate creation
D) Certificate distribution

Question 21

39)Briefly describe the main characteristics of an authority revocation list.

Question 22

34)What are the four assurance methods? Give examples of each.

Question 23

23)____ is a publishing method in which revocation information is updated and posted for entities in the PKI community to obtain.

A) OCSP
B) CPS
C) PKCS
D) CRL

Question 24

27)____________________ is the assurance that an entity is who it claims to be.

Question 25

35)Alice is sending a message to Bob. How can Alice ensure data integrity?

Question 26

36)What are some of the common tasks of a registration authority?

Question 27

What are the most common approaches to provide PKI client functionalities?

Question 28

38)Briefly explain the certificate expiration task of the key and certificate life cycle management cancellation phase.

Question 29

26)The PKIX Working Group was established in the fall of 1995 under the standard organization ____.

A) ACM
B) ISO
C) IEEE
D) IETF

Question 30

21)The key and certificate life cycle management concludes with the ____ phase.

A) issued
B) registration
C) certification
D) cancellation

Question 31

41)What are the three most common methods for implementing Delta CRL?

Question 32

25)A(n) ____ creates an immediate layer of abstraction for storing revocation information in a more flexible way.

A) partitioned CRL
B) complete CRL
C) redirect CRL
D) indirect CRL

Question 33

22)____ is the most common method of certificate revocation.

A) CRL
B) OCSP
C) ODI
D) CPS

Question 34

29)The _________________________ is the centerpiece and the most critical component of a PKI.

Question 35

28)____________________ is the assurance of data privacy and is usually provided by symmetric cryptography using algorithms such as AES and 3DES.

Question 36

40)What are the steps required to use a CRL DP?

Question 37

31)____________________ occurs between the time of learning that the certificate should be revoked and the time that the revocation information is actually posted for the relying parties.

Question 38

24)CRL distribution point (CRL DP) is also called ____.

A) complete CRL
B) partitioned CRL
C) ARL CRL
D) indirect CRL

Question 39

30)A(n) ____________________ provides a common trusted source for anyone in the PKI community to retrieve certificates.

Question 40

33)What are the general requirements a security infrastructure must satisfy?

Question 42

42)Explain the main characteristics of indirect CRLs.