Deck 6: Public Key Infrastructure

Question 1

A way of backing up cryptographic keys is by

A)Making copies in one location
B)Making multiple copies in multiple locations
C)Key archiving
D)key recovery

Answer 1

C

Question 2

A process that allows for lost keys to be recovered is

A)Key recovery
B)Key escrow
C)Key archiving system
D)Private key protection

Answer 2

A

Question 3

What is a digital certificate?

A)It's a means of establishing the validity of an offer from a person,entity,web site or e-mail.
B)It's a centralized directory wherein registered keys are created and stored.
C)It's a means of establishing your credentials electronically when doing business or other transactions on the Web
D)It's an entity that generates electronic credentials and distributes them upon proving their identity sufficiently.

Answer 3

C

Question 4

What are the different fields within a digital certificate?

A)Version number,subject,public key,issuer,serial number,validity,certificate usage,signature algorithm,and extensions
B)Key encipherment,data encipherment,CRL sign,keycert sign,and nonrepudiation
C)End-entity,CA,cross-certification,and policy certification
D)CA identity,individual or party identification,company,and destination

Question 5

A trust domain is defined as

A)The agreed upon,trusted third party
B)A scenario where one user needs to validate the other's certificate
C)A construct of systems,personnel,applications,protocols,technologies and policies that work together to provide a certain level of protection
D)A scenario in which the certificate's issuer and subject fields hold the same information

Question 6

Which of the following is a critical concept common to all PKIs?

A)Cryptographic hardware is required for PKI construction.
B)The server that centrally stores the keys should not be available.
C)The private key must be computer generated and centrally stored.
D)Private keys must remain private.

Question 7

One of the steps necessary to validate a certificate is to

A)Explore private key protection
B)Know certificate authorizations
C)Calculate a message digest for the certificate
D)Check out different types of public key infrastructures

Question 8

A process of giving keys to a third party so that they can decrypt and read sensitive information is

A)Key recovery
B)Key escrow
C)Key archiving system
D)Private key protection

Question 9

It is easier to implement,back up,and recover keys in a

A)Centralized infrastructure
B)Decentralized infrastructure
C)Hybrid infrastructure
D)Peer-to-peer infrastructure

Question 10

What is a certificate authority?

A)An entity that requires proof of identity from the individual requesting a certificate
B)An entity that generates a digitally signed identification certificate
C)A centralized directory in which the registered certificate is stored
D)An entity that generates electronic credentials

Question 11

How is an outsourced CA different from a public CA?

A)The CA is implemented,maintained,and controlled by the company that implemented it.
B)The CA is already established and being used by many individuals and companies.
C)The CA provides more flexibility for companies.
D)It provides dedicated services,and possibly equipment,to an individual company.

Question 12

Why construct and implement a PKI?

A)To eliminate certificate authorities
B)To provide identification to individuals and ensure availability
C)To provide a higher level of trust than can be obtained through other applications and protocols
D)To enable a centralized directory in which to store the registered certificate and distribute private keys to users requesting them

Question 13

An in-house certificate authority is

A)A CA that is already established and being used by many individuals and companies
B)A certificate authority that is maintained and controlled by the company that implemented it
C)A CA that provides dedicated services,and possibly equipment,to an individual company
D)A CA that provides more flexibility for companies

Question 14

Requiring two individuals to recover a lost key together is called

A)Two-factor authentication
B)Binary recovery
C)Dual control
D)Dual recovery

Question 15

All of the following statements sum up the characteristics and requirements of proper private key use EXCEPT:

A)Make copies of the private key and keep it in several locations for redundancy.
B)The lifetime of the key should correspond with how often it is used and the sensitivity of the data it is protecting.
C)The key should be changed at the end of its lifetime and not used past its allowed lifetime.
D)The key should be properly destroyed at the end of its lifetime.

Question 16

What is a registration authority?

A)An entity that requires proof of identity from the individual requesting a certificate
B)An entity that generates a digitally signed identification certificate
C)A centralized directory in which the registered certificate is stored
D)An entity that generates electronic credentials

Question 17

What is a public key infrastructure?

A)A structure that enables parties to use communications such as e-mail
B)A structure that provides all of the components needed for entities to communicate securely and in a predictable manner
C)A structure that enables secure communications in chat rooms,and when instant messaging and text messaging
D)Is another name for digital signatures

Question 18

The difference between centralized and decentralized infrastructures is

A)The key pairs and certificates do not have a set lifetime in centralized infrastructures.
B)The location where the cryptographic key is generated and stored is different.
C)The network administrator sets up the distribution points in centralized infrastructures.
D)In a decentralized infrastructure,the certificate may have an extended lifetime.

Question 19

What is a certificate repository?

A)A directory that calculates a message digest for the certificate
B)An entity that generates electronic credentials
C)A directory that requires a centralized infrastructure
D)A centralized directory in which the registered certificate is stored

Question 20

All of the following statements sum up the characteristics and requirements of proper private key use EXCEPT:

A)The key should be stored securely.
B)The key should be shared only with others you trust.
C)Authentication should be required before the key can be used.
D)The key should be transported securely.

Question 21

_______________ binds a public key to a known user through a trusted intermediary,typically a certificate authority.

Question 22

A digital certificate binds an individual's identity to a public key.

Question 23

The peer-to-peer trust model is well suited for large environments and avoids complex setups.

Question 24

Which of the following reasons would be appropriate for a certificate suspension rather than revocation?

A)All keys are compromised.
B)Changed affiliation.
C)An extended vacation.
D)The certificate is no longer needed,but no reason exists to suspect that it has been compromised.

Question 25

_______________ is the PKI component that accepts a request for a digital certificate and performs the necessary steps of registering and authenticating the person requesting the certificate.

Question 26

The X.509 standard outlines the necessary fields of a certificate and the possible values that can be in each field.

Question 27

A registration authority is the PKI component that certifies an individual's identity and creates electronic documents indicating that individuals are who they say they are.

Question 28

The term used to describe a centralized directory that can be accessed by a subset of individuals is _______________

Question 29

If the root CA's private key were compromised,what would happen?

A)Subordinate CAs and end users would be unaffected.
B)Subordinate CAs would also be compromised,but users would be unaffected.
C)Subordinate CAs and end users would be affected.
D)Only the root CA would be affected.

Question 30

"Digital certificate" and "private key" are two different terms for the same thing.

Question 31

PKI can be used as a measure to trust individuals we do not know.

Question 32

_______________ is the standard used for creating and formatting certificates.

Question 33

A certificate authority is the PKI component that accepts a request for a digital certificate and performs the necessary steps of registering and authenticating the person requesting the certificate.

Question 34

Once you have properly obtained a digital certificate for a web site,

A)You can be sure of the certificate's validity indefinitely.
B)You can be sure of the certificate's validity until the expiration date.
C)You cannot be sure of the certificate's validity and must check the CRL each time before use.
D)You cannot be sure of the certificate's validity and must check the RA each time before use.

Question 35

When a person loses a laptop that had a private key stored on it,that person should request a revocation of the related certificate.

Question 36

Outsourced CAs are different from Public CAs in what way?

A)Outsourced services can be used by hundreds of companies.
B)Outsourced services provide dedicated services and equipment to individual companies.
C)Outsourced services do not maintain specific servers and infrastructures for individual companies.
D)Outsourced services are different in name only.They are essentially the same thing.

Question 37

PKI does not only refer to registration authorities and certificate authorities.It also refers to certificates (containing keys),certificate revocation lists,and trust models.

Question 38

Certificate expansions allow for further information to be inserted within the certificate to add functionality to a PKI implementation.
Extensions,not expansions.

Question 39

_______________ is a trusted authority that certifies individuals' identities and creates electronic documents indicating that individuals are who they say they are.

Question 40

Which of the following is not one of the three forms of trust models?

A)Hybrid
B)Star
C)Peer-to-peer
D)Hierarchical

Question 41

What are the three types of trust models?

Question 42

A(n)_______________ binds a user's identity to a public key,and contains all the information the receiver needs to be assured of the identity of the public key owner.

Question 43

A(n)_______________ certificate is used when independent CAs establish peer-to-peer trust relationships.

Question 44

The list of serial numbers of certificates that have been revoked is called the _______________.

Question 45

Explain what certificate revocation is and give examples of when it might be necessary.

Question 46

A(n)_______________ is a construct of systems,personnel,applications,protocols,technologies,and policies that work together to provide a certain level of protection.

Question 47

List the steps for validating a certificate

Question 48

_______________ is the process of giving the keys to a third party so that they can decrypt and read sensitive information if the need arises.

Question 49

What are centralized and decentralized infrastructures? Explain why you might choose one over the other.

Question 50

Explain the role of the certificate authority and registration authority.