Practice Test Geeks(CCP) Certified Cybersecurity Professional Practice Test
← All CCP Flashcard Decks

TLS, PKI & Encryption Standards Flashcards

7 cards from real CCP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 TLS, PKI & Encryption Standards flashcards as text

  1. Which TLS extension allows a client to request a server to include a stapled OCSP response during the handshake?

    Answer: Status Request (OCSP Stapling)

    The TLS 'status_request' extension (RFC 6066) enables OCSP stapling, where the server attaches a cached OCSP response to reduce client-side revocation lookups.

  2. In a PKI hierarchy, what is the primary purpose of an intermediate CA rather than issuing end-entity certificates directly from the root CA?

    Answer: To protect the root CA private key by keeping it offline

    Intermediate CAs allow the root CA to remain offline (air-gapped), so if an intermediate CA is compromised, only that CA's certificates need revocation, not the entire trust hierarchy.

  3. Which cipher suite component in TLS 1.2 provides forward secrecy?

    Answer: Ephemeral Diffie-Hellman (DHE or ECDHE)

    Ephemeral Diffie-Hellman key exchange generates a new key pair per session, so compromising the server's long-term key cannot decrypt previously captured traffic.

  4. What does Certificate Transparency (CT) primarily protect against?

    Answer: Misissued or fraudulent certificates that CAs issue without domain owner knowledge

    CT requires CAs to log all issued certificates to public append-only logs, enabling domain owners and monitors to detect unauthorized or misissued certificates quickly.

  5. An attacker intercepts a TLS 1.3 handshake. Which of the following attacks is TLS 1.3 specifically designed to eliminate compared to TLS 1.2?

    Answer: Downgrade attacks using legacy cipher suites

    TLS 1.3 removed all weak and legacy cipher suites and handshake options, eliminating downgrade attack vectors like POODLE, BEAST, and DROWN that exploited TLS 1.2 fallback modes.

  6. Which X.509 certificate field is used to specify permitted and excluded DNS name subtrees in a CA certificate to constrain which domains it may issue certificates for?

    Answer: Name Constraints

    The Name Constraints extension (critical) restricts the namespaces within which an intermediate CA may issue certificates, preventing it from signing certificates for unauthorized domains.

  7. When a TLS session is resumed using a pre-shared key (PSK) in TLS 1.3, what security property is potentially weakened?

    Answer: Forward secrecy for the resumed session

    PSK-only resumption reuses keying material from a prior session, so compromising that PSK can expose the resumed session's traffic, weakening forward secrecy.