CompTIA Security+ - Module 4 Quiz

A user retrieves the two halves of a key from two different parties and combines them to create a copy of the key. Which of the following terms best describes the process being used to manage the keys?

a. Key escrow

b. M-of-N control

c. Key bonding

d. Key activation

Key escrow

Key escrow refers to a process in which keys are managed by a third party, such as a trusted certificate authority. In key escrow, the private key is split, and each half is encrypted. The two halves are registered and sent to the third party, which stores each half in a separate location. A user can then retrieve the two halves, combine them, and use this new copy of the private key for decryption.

PKI is the underlying infrastructure used for controlling which of the following entities? Select two.

a. Certificate policy

b. Key storage

c. Bridge trust model

d. Public keys

e. Digital certificates

Public keys

Digital certificates

Public key infrastructure (PKI) is the underlying infrastructure that serves as a key management system for controlling public keys, private keys, and digital certificates.

Yandelli is responsible for protecting data in transit. However, the scheme he is attempting to adopt will encapsulate encrypted information with unencrypted information. What is a potential consequence of this behavior?

a. The security of the transmitted data will be compromised.

b. The scheme is okay but only if data is not transmitted through a public network.

c. You cannot transmit encrypted and unencrypted data simultaneously.

d. Data will be transmitted securely.

Data will be transmitted securely.

Encapsulation is the process of enclosing the encrypted data with an additional header so that the data can be directed to its destination. If the data were to be completely encrypted, including its header, then network routers would not be able to forward the packet to its destination since they do not have the decryption key to view the header. By encapsulating the encrypted information with unencrypted information, the data can be protected and travel across the networks as normal.

Part of your responsibilities include maintaining the root CA as well as the intermediate CAs for a large organization. What should you do to ensure the security of the root CA?

a. Allow local access only from an isolated network.

b. Require two-factor authentication for local and remote access.

c. Ensure all traffic flowing to and from the root CA is encrypted and disable wireless access.

d. Keep it powered down until you need to issue or reissue certificates.

Keep it powered down until you need to issue or reissue certificates.

The consequences of a compromised root certificate authority (CA) are very significant because a breach could likewise taint all its intermediate CAs along with all the digital certificates that they issued. A common method to ensure the security and integrity of a root CA is to keep it in an offline state from the network (offline CA) and even "powered down." It is only brought online when needed for specific and infrequent tasks, typically limited to the issuance or reissuance of certificates authorizing intermediate CAs.

A web server is establishing a secure cryptographic connection in response to a client request. In the process, session keys will be created. Which of the following statements is true regarding session keys?

a. They are symmetric keys used to encrypt and decrypt traffic between a browser and web server.

b. They are asymmetric keys used to encrypt and decrypt traffic between a browser and web server.

c. They are created immediately after the ClientHello message.

d. They are created immediately after the HelloServer message.

They are symmetric keys used to encrypt and decrypt traffic between a browser and web server.

Session keys are symmetric keys used to encrypt and decrypt information exchanged during the session between a browser and a web server and to verify integrity.

Assume a REAL ID can be used for federal identification and a traditional ID cannot. Which of the following, in the form of an analogy, can be used to authenticate the person requesting a digital certificate?

a. A digital certificate authenticated with a digital signature is like a REAL ID.

b. A digital certificate authenticated with a certificate revocation list query is like a REAL ID.

c. A digital certificate authenticated with a birth certificate is like a REAL ID.

d. A digital certificate authenticated with an email address is like a REAL ID.

A digital certificate authenticated with a birth certificate is like a REAL ID.

The authenticity of a person requesting a digital certificate can be confirmed by requiring specific documentation such as a birth certificate.

You want to open an account with an online bank that is paying five percent interest because other banks are only paying two percent. You open a browser and go to bankofutopi.com but get a little suspicious. What can you do to help determine if this is a trusted site?

a. Contact the digital signature authority.

b. Contact the certificate authority.

c. Check the digital certificate.

d. Check the digital signature.

Check the digital certificate.

The bank's web server issues a digital certificate that has been signed by a trusted third party to the web browser. You can check the digital certificate via the browser to ensure the site you are on is authentic.

Which of the following most accurately describes the CSR generation process?

a. Create keys, sign request with public key, send public key to RA, CA issues digital certificate.

b. Create keys, sign request with public key, send private key to RA, CA issues digital certificate.

c. Create keys, sign request with private key, send public key to RA, CA issues digital certificate.

d. Create keys, sign request with private key, send private key to RA, CA issues digital certificate.

Create keys, sign request with public key, send public key to RA, CA issues digital certificate.

The certificate signing request (CSR) generation process allows a user to obtain a digital certificate. First create the public and private keys and provide the requested information. The user electronically signs it by affixing their public key and sending it to a registration authority (RA) responsible for verifying the credentials of the applicant. Once verified, it is transferred to an intermediate certificate authority (CA), which then issues the digital certificates.

A key was revoked before it expired. Xan takes the revoked key out of the revocation state and reactivates it to extract and decrypt old messages from an email archival system. What is this type of key reactivation called?

a. A revoked key cannot be reinstated.

b. Key reinstatement

c. Key reestablishment

d. Key recovery

A revoked key cannot be reinstated.

A key can be revoked prior to its expiration date. However, revoked keys cannot be reinstated; the revocation of a key is permanent. The certificate authority should be immediately notified so they can take additional measures.

Onjolee wants to ensure she can use one digital certificate for www.mysite.com, www.mysite.org, and www.mysite.info. Which of the following best describes the type of digital certificate she should use?

a. EV

b. Wildcard

c. Multisite

d. SAN

SAN

A Subject Alternative Name (SAN) allows different values to be associated with a single certificate. A SAN allows a single digital certificate to specify additional host names to be protected by that one certificate.