CASP+ Cryptography and PKI

Question 1

An organization wants to ensure that digital signatures on contracts remain legally valid even if the signing algorithm is later deprecated. Which mechanism BEST addresses this?

Accepted Answer

Trusted timestamping combined with long-term validation (LTV) signatures

Answer

LTV signatures embed the certificate chain and revocation data at signing time, and a trusted timestamp proves the signature existed before algorithm deprecation.

Question 2

Which cryptographic algorithm provides BOTH confidentiality and data authentication in a single operation?

Accepted Answer

AES-GCM (Galois/Counter Mode)

Answer

AES-GCM is an authenticated encryption mode that simultaneously provides confidentiality via CTR mode and integrity/authentication via the GHASH function.

Question 3

A PKI administrator needs to revoke a certificate immediately due to a key compromise. Which mechanism provides the FASTEST revocation propagation?

Accepted Answer

OCSP stapling with short-validity responses

Answer

OCSP stapling embeds a recent, CA-signed revocation response directly in the TLS handshake, providing near-real-time revocation status without client round-trips.

Question 4

Which key exchange protocol provides perfect forward secrecy (PFS)?

Accepted Answer

Ephemeral Diffie-Hellman (DHE) or ECDHE

Answer

Ephemeral DH/ECDHE generates a new key pair for each session, so past session keys cannot be derived even if the server's long-term private key is later compromised.

Question 5

An enterprise is designing a PKI hierarchy. Which structure BEST protects the root CA while maintaining operational flexibility?

Accepted Answer

An offline root CA with online intermediate/issuing CAs

Answer

An offline root CA is never exposed to network attack; intermediate CAs handle day-to-day issuance, and if an intermediate is compromised only that subtree needs replacement.

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ Cryptography and PKI