CCP TLS, PKI & Encryption Standards 2

Question 1

Which TLS extension allows a client to request a server to include a stapled OCSP response during the handshake?

Accepted Answer

Status Request (OCSP Stapling)

Answer

The TLS 'status_request' extension (RFC 6066) enables OCSP stapling, where the server attaches a cached OCSP response to reduce client-side revocation lookups.

Question 2

In a PKI hierarchy, what is the primary purpose of an intermediate CA rather than issuing end-entity certificates directly from the root CA?

Accepted Answer

To protect the root CA private key by keeping it offline

Answer

Intermediate CAs allow the root CA to remain offline (air-gapped), so if an intermediate CA is compromised, only that CA's certificates need revocation, not the entire trust hierarchy.

Question 3

Which cipher suite component in TLS 1.2 provides forward secrecy?

Accepted Answer

Ephemeral Diffie-Hellman (DHE or ECDHE)

Answer

Ephemeral Diffie-Hellman key exchange generates a new key pair per session, so compromising the server's long-term key cannot decrypt previously captured traffic.

Question 4

What does Certificate Transparency (CT) primarily protect against?

Accepted Answer

Misissued or fraudulent certificates that CAs issue without domain owner knowledge

Answer

CT requires CAs to log all issued certificates to public append-only logs, enabling domain owners and monitors to detect unauthorized or misissued certificates quickly.

Question 5

An attacker intercepts a TLS 1.3 handshake. Which of the following attacks is TLS 1.3 specifically designed to eliminate compared to TLS 1.2?

Accepted Answer

Downgrade attacks using legacy cipher suites

Answer

TLS 1.3 removed all weak and legacy cipher suites and handshake options, eliminating downgrade attack vectors like POODLE, BEAST, and DROWN that exploited TLS 1.2 fallback modes.

(CCP) Certified Cybersecurity Professional Practice Test

(CCP) Certified Cybersecurity Professional Practice Test

CCP TLS, PKI & Encryption Standards 2