Practice Test Geeks(CCP) Certified Cybersecurity Professional Practice Test
← All CCP Flashcard Decks

TLS, PKI & Encryption Standards Flashcards

7 cards from real CCP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 TLS, PKI & Encryption Standards flashcards as text

  1. A developer embeds a certificate's public key hash in an application to prevent MITM attacks even if a rogue CA signs a fraudulent certificate. This technique is called:

    Answer: Certificate pinning

    Certificate pinning (or public key pinning) hardcodes expected certificate or public key hashes, so the application rejects TLS connections presenting certificates not matching the pinned values.

  2. Which asymmetric algorithm is used in ECDSA certificates, and what advantage does it offer over RSA at equivalent security levels?

    Answer: Elliptic Curve; smaller key sizes with equivalent strength

    ECDSA uses elliptic curve cryptography, providing equivalent security to RSA with dramatically smaller keys (e.g., 256-bit EC ≈ 3072-bit RSA), reducing bandwidth and computational overhead.

  3. In PKI, what is a Certificate Revocation List (CRL) Distribution Point (CDP)?

    Answer: A URL embedded in certificates indicating where to download the issuing CA's CRL

    The CDP extension in an X.509 certificate contains URLs pointing to the issuing CA's current CRL, allowing relying parties to check whether the certificate has been revoked.

  4. What property does Authenticated Encryption with Associated Data (AEAD), such as AES-GCM, provide that AES-CBC with a separate HMAC does not inherently guarantee when implemented naively?

    Answer: Atomic confidentiality and integrity without MAC-then-encrypt order vulnerabilities

    AEAD algorithms like AES-GCM combine encryption and authentication in a single operation, eliminating MAC-then-encrypt ordering bugs (e.g., Lucky13) that plague separate AES-CBC + HMAC implementations.

  5. A PKI administrator needs to revoke a subordinate CA certificate. Which revocation method is most appropriate for CAs (versus end-entity certificates)?

    Answer: OneCRL or similar browser vendor emergency revocation list

    CA certificate revocation requires browser vendor intervention via mechanisms like Mozilla's OneCRL or Chrome's CRLSets, because standard CRL/OCSP checks are often skipped for CA certs by browsers.

  6. During a TLS 1.2 handshake, which message does the server send to prove possession of the private key corresponding to its certificate when using ephemeral cipher suites?

    Answer: ServerKeyExchange signed with the server's private key

    In TLS 1.2 with DHE/ECDHE, the ServerKeyExchange message contains the ephemeral public key signed with the server's certificate private key, proving the server owns the key in the certificate.

  7. Which NIST standard defines the requirements for cryptographic modules, including key management and physical security, commonly referenced in US federal compliance?

    Answer: FIPS 140-3

    FIPS 140-3 (successor to FIPS 140-2) specifies security requirements for cryptographic modules used by US federal agencies, covering four security levels from basic to the highest physical security.