Examkin

General Security Concepts

268 questions

All types268Multiple choice139Multiple select58Matching57Ordering14
Question 261Question →

A network security administrator is commissioning a new internal web application server that requires a trusted SSL/TLS certificate signed by the enterprise internal Certificate Authority (CA). Which of the following sequences represents the correct chronological order of steps the administrator must perform to obtain and deploy this certificate?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with generating the private/public key pair locally on the server, followed by creating the Certificate Signing Request (CSR) with identity details, submitting the CSR to the CA for verification and signing, and finally installing the signed certificate along with the intermediate CA trust chain on the server.
The proper PKI enrollment workflow begins by locally generating the asymmetric key pair on the web server to ensure private key protection. Next, a Certificate Signing Request (CSR) containing the public key and identity specifications (like SAN extensions) is created. This CSR is then submitted to the Certificate Authority (CA) for verification and signing. Finally, once signed, the certificate along with the intermediate CA certificates are installed on the server to enable valid TLS connections.

Step-by-Step Solution

1
Generate local key pair
Private key stays secret on the server while the public key is ready for submission
Security best practices dictate that private keys must be generated locally and never transmitted across the network.
2
Formulate the CSR
A CSR file formatted with public key data and Subject Alternative Name (SAN) extensions
The CSR provides the CA with the required server identity attributes and public key to be bound into the certificate.
3
Submit CSR to CA for signing
The CA validates request parameters and generates a signed public certificate
The CA asserts trust by appending its cryptographic signature using its private key.
4
Deploy certificate and intermediate chain
Web server is fully configured for TLS trust and handshakes
Installing both the server certificate and intermediate certificates ensures client browsers can validate the entire trust path to the root CA.

Key Concept

Public Key Infrastructure Certificate Lifecycle and Request Workflow
Question 262Question →

An organization deploys a new RADIUS server to support 802.1X EAP-TLS authentication across corporate laptops. During testing, client devices fail to authenticate, reporting that the RADIUS server's identity cannot be verified. Analysis indicates that while client devices trust the organization's offline Root CA, the RADIUS server is transmitting only its leaf certificate, and clients cannot validate the intermediate issuing CA that signed it. Which of the following configuration changes on the server will resolve the authentication failure?

Show answer & explanation

Answer: Bundle the intermediate issuing CA certificate with the server certificate so the complete trust chain is provided during the TLS handshake.

Answer

The server must be configured to supply the intermediate issuing CA certificate in a bundle with its server certificate to complete the certificate trust chain during the TLS handshake.
Supplying the intermediate issuing CA certificate alongside the server's leaf certificate provides the client with the full certificate chain. This allows the client to build a valid trust path from the server certificate up to the locally trusted Root CA.

Step-by-Step Solution

1
Identify the cause of the TLS certificate validation error on client devices.
Clients fail validation because they receive only the server's leaf certificate without the intermediate CA certificate needed to build a valid path to their trusted Root CA.
PKI trust verification requires a complete path from the leaf certificate through all intermediate CAs to a trusted root stored on the client.
2
Determine the appropriate server-side remediation.
Concatenate or bundle the server's leaf certificate with the intermediate CA certificate(s).
Transmitting the full certificate bundle allows client endpoints to construct and verify the entire certificate chain back to the Root CA.

Key Concept

Certificate Chaining and Trust Path Validation
Estimated Time:1m 30s
Question 263Question →

A systems engineer is implementing security controls for a enterprise API gateway that requires mutual TLS authentication. To optimize client connection speeds, the engineer wants to eliminate third-party real-time lookup latency during certificate revocation verification. Additionally, the engineer must request a new web server certificate following strict Public Key Infrastructure (PKI) enrollment best practices. Which of the following steps should the security engineer take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Enable OCSP stapling on the server to provide clients with time-stamped, CA-signed certificate status responses during the initial handshake.; Generate the key pair locally on the server hardware and send only the public key along with identification details inside the Certificate Signing Request (CSR).

Answer

The engineer should enable OCSP stapling on the server to provide cached revocation status responses during the TLS handshake, and generate the key pair locally to include only the public key in the Certificate Signing Request (CSR).
Enabling OCSP stapling offloads real-time revocation verification from the client to the server, significantly reducing handshake latency while keeping certificate status checks up to date. During certificate issuance, generating key pairs locally and submitting only the public key within the CSR maintains the strict secrecy of the server's private key.

Step-by-Step Solution

1
Evaluate the requirement for optimizing certificate revocation checking performance.
OCSP stapling delegates revocation queries to the server, which caches signed responses from the CA and staples them into the TLS handshake, preventing client lookup delays and privacy leaks.
Direct client OCSP checks cause latency and depend on third-party server availability, which OCSP stapling effectively resolves.
2
Determine correct PKI certificate enrollment and CSR generation steps.
The server generates a public-private key pair locally, retains the private key in secure storage, and embeds the public key and organizational details into the CSR sent to the CA.
Exposing or transmitting private keys during CSR creation compromises key integrity and violates PKI security boundaries.

Key Concept

Public Key Infrastructure (PKI) Certificate Enrollment and OCSP Stapling Mechanics
Estimated Time:1m 30s
Question 264Question →

An enterprise security administrator is deploying a high-traffic public web application server using TLS encryption. To minimize TLS handshake latency and prevent third-party tracking of user browsing habits caused by real-time client queries to an external Certificate Authority (CA), the administrator wants the web server to fetch and cache signed revocation status responses from the CA to append during the TLS handshake. Which of the following solutions should the administrator implement?

Show answer & explanation

Answer: OCSP stapling

Answer

Implementing OCSP stapling satisfies the requirement by allowing the web server to cache a signed status response from the Certificate Authority and present it directly to the client during the TLS handshake.
OCSP stapling delegates the task of obtaining a signed time-stamped certificate status response to the web server itself. The server regularly polls the OCSP responder and appends (staples) the signed response directly to the TLS handshake payload. This eliminates the privacy issue of clients contacting the CA directly and avoids latency overhead during connection establishment.

Step-by-Step Solution

1
Identify the performance and privacy challenge in the scenario
Direct client queries to an Online Certificate Status Protocol (OCSP) responder leak user browsing activity to the CA and add network latency to every TLS connection establishment.
Traditional OCSP checking forces every web client to make an out-of-band request to the CA prior to trusting the server's certificate.
2
Evaluate PKI mechanisms designed to offload revocation checking to the web server
OCSP stapling (Certificate Status Request extension) enables the web server to query the CA's OCSP responder at regular intervals, cache the digitally signed OCSP response, and staple it to the TLS Certificate Status message during the client handshake.
This removes the need for the client to contact the CA directly, safeguarding client privacy and eliminating extra DNS and HTTP request delays.

Key Concept

Online Certificate Status Protocol (OCSP) Stapling
Estimated Time:1m 15s
Question 265Question →

A DevOps engineer is setting up a secure internal web endpoint for a microservice and needs to enroll it into the organization's Public Key Infrastructure (PKI). Which of the following represents the correct sequential order of operational steps required to successfully obtain and deploy an X.509 certificate, from initial key creation to final service binding?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with local private key generation and CSR creation, followed by submitting the CSR to the CA for identity verification, receiving the CA-signed certificate, and concluding with importing the certificate and trust chain onto the web host.
The correct order follows the standard PKI lifecycle: local key generation and CSR creation must occur first, followed by CSR submission to the CA, CA signing/issuance using the CA's private key, and finally server binding with intermediate certificates included to establish the complete chain of trust.

Step-by-Step Solution

1
Generate asymmetric keys locally and form the CSR
A secure local private key is created along with a CSR holding the matching public key and Distinguished Name (DN) properties.
The private key must remain confidential on the server while the public key and identity data are prepared for validation.
2
Submit the CSR to the CA/RA
The CA receives the enrollment request and initiates verification checks.
The Certificate Authority must verify that the requester is authorized to claim the identity specified in the request.
3
CA signing and certificate issuance
An X.509 digital certificate is generated and signed with the CA's private key.
The CA's signature binds the host's public key to its identity, establishing trust for any client that trusts the CA.
4
Server binding and intermediate chain installation
The web service presents a complete certificate path to connecting clients.
Installing the host certificate and intermediate CA bundle ensures clients can validate the full trust path back to the trusted Root CA.

Key Concept

PKI Certificate Enrollment Lifecycle
Question 266Question →

An enterprise systems specialist is configuring an automated build server to sign software packages using a newly established internal Public Key Infrastructure (PKI). Before requesting a digital certificate from the enterprise Certificate Authority (CA), the specialist must prepare a Certificate Signing Request (CSR) on the build server. Which of the following operations occurs on the build server prior to transmitting the CSR to the CA?

Show answer & explanation

Answer: Generating an asymmetric key pair locally and embedding the public key into the request while retaining the private key securely on the server

Answer

Generating an asymmetric key pair locally and embedding the public key into the request while retaining the private key securely on the server
Generating an asymmetric key pair locally and embedding the public key into the CSR is the foundational step in PKI certificate request workflows. The private key remains stored securely on the requesting system and is never transmitted over the network or sent to the Certificate Authority.

Step-by-Step Solution

1
Identify the standard workflow for generating a Certificate Signing Request (CSR) in a Public Key Infrastructure (PKI).
The applicant system initiates asymmetric key generation locally.
The security of asymmetric cryptography depends on the private key remaining strictly under the control of the local host.
2
Determine which component of the asymmetric key pair is submitted to the Certificate Authority (CA).
The public key, along with subject identity information, is encoded into the CSR format.
The CA signs the public key to bind the identity to that specific public key via an issued X.509 certificate.

Key Concept

CSR Generation and Asymmetric Key Lifecycle
Question 267Question →

A security administrator is configuring digital certificates for an enterprise web gateway that host services for multiple subdomains across different domain names. To optimize TLS handshake performance, maintain client privacy, and ensure multi-domain validity, which TWO of the following configurations or steps should the administrator implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Request a digital certificate that includes the Subject Alternative Name (SAN) extension containing all relevant fully qualified domain names.; Enable OCSP stapling on the web gateway so the server appends a time-stamped CA revocation response directly during the TLS handshake.

Answer

The correct configurations are requesting a digital certificate with the Subject Alternative Name (SAN) extension for multi-domain support and enabling OCSP stapling on the gateway to improve performance and client privacy.
The Subject Alternative Name (SAN) extension permits a single X.509 certificate to secure multiple hostnames and subdomains across distinct domain names. Concurrently, OCSP stapling allows the web gateway to periodically fetch a signed OCSP response from the CA and staple it to the TLS handshake, which eliminates client-side OCSP queries, decreases handshake latency, and protects user browsing privacy.

Step-by-Step Solution

1
Identify multi-domain certificate requirements
Determined that the Subject Alternative Name (SAN) extension allows a single X.509 certificate to secure multiple fully qualified domain names.
Traditional single-domain or wildcard certificates may not cover distinct subdomains across separate domain names efficiently.
2
Evaluate revocation checking and handshake optimization mechanisms
Selected OCSP stapling as the optimal method for certificate status checking during TLS setup.
OCSP stapling delegates the revocation lookup to the web gateway, which fetches and caches the signed OCSP response to append to the TLS handshake, avoiding client lookup latency and third-party tracking.

Key Concept

Public Key Infrastructure, Subject Alternative Name (SAN) extensions, and OCSP Stapling
Question 268Question →

An enterprise security administrator notices that after revoking a compromised employee device certificate, internal applications continue to trust the revoked certificate for up to 24 hours until the next scheduled status update file is generated. The administrator needs to update the PKI architecture so authentication services can query the revocation status of individual certificates in real time without forcing mobile clients to download complete revocation files over low-bandwidth cellular connections. Which of the following should the administrator implement to meet these requirements?

Show answer & explanation

Answer: Online Certificate Status Protocol (OCSP)

Answer

Online Certificate Status Protocol (OCSP)
The correct option is Online Certificate Status Protocol (OCSP). OCSP allows services to submit a lightweight request containing a specific certificate's serial number to an OCSP responder and receive an immediate status response (Good, Revoked, or Unknown). This eliminates the time delay associated with scheduled list publications and conserves cellular bandwidth compared to downloading entire lists.

Step-by-Step Solution

1
Analyze the operational limitation in the scenario
The current setup suffers from a 24-hour update latency window and excessive bandwidth consumption due to periodic downloading of entire revocation lists.
Certificate Revocation Lists (CRLs) are published on a timed schedule and contain all revoked certificate serial numbers, making them bandwidth-heavy and delayed.
2
Identify the PKI mechanism designed for low-bandwidth, real-time single certificate status checks
Online Certificate Status Protocol (OCSP) provides real-time verification status (good, revoked, or unknown) for a specific certificate query.
OCSP sends lightweight requests and responses for individual certificate serial numbers rather than transferring complete lists.

Key Concept

Certificate Revocation and Real-time Status Validation (OCSP vs CRL)
PreviousPage 14 / 14
General Security Concepts Practice Questions — CompTIA Security+ — Page 14 | Examkin