CCP TLS, PKI & Encryption Standards 3

Question 1

A developer embeds a certificate's public key hash in an application to prevent MITM attacks even if a rogue CA signs a fraudulent certificate. This technique is called:

Accepted Answer

Certificate pinning

Answer

Certificate pinning (or public key pinning) hardcodes expected certificate or public key hashes, so the application rejects TLS connections presenting certificates not matching the pinned values.

Question 2

Which asymmetric algorithm is used in ECDSA certificates, and what advantage does it offer over RSA at equivalent security levels?

Accepted Answer

Elliptic Curve; smaller key sizes with equivalent strength

Answer

ECDSA uses elliptic curve cryptography, providing equivalent security to RSA with dramatically smaller keys (e.g., 256-bit EC ≈ 3072-bit RSA), reducing bandwidth and computational overhead.

Question 3

In PKI, what is a Certificate Revocation List (CRL) Distribution Point (CDP)?

Accepted Answer

A URL embedded in certificates indicating where to download the issuing CA's CRL

Answer

The CDP extension in an X.509 certificate contains URLs pointing to the issuing CA's current CRL, allowing relying parties to check whether the certificate has been revoked.

Question 4

What property does Authenticated Encryption with Associated Data (AEAD), such as AES-GCM, provide that AES-CBC with a separate HMAC does not inherently guarantee when implemented naively?

Accepted Answer

Atomic confidentiality and integrity without MAC-then-encrypt order vulnerabilities

Answer

AEAD algorithms like AES-GCM combine encryption and authentication in a single operation, eliminating MAC-then-encrypt ordering bugs (e.g., Lucky13) that plague separate AES-CBC + HMAC implementations.

Question 5

A PKI administrator needs to revoke a subordinate CA certificate. Which revocation method is most appropriate for CAs (versus end-entity certificates)?

Accepted Answer

OneCRL or similar browser vendor emergency revocation list

Answer

CA certificate revocation requires browser vendor intervention via mechanisms like Mozilla's OneCRL or Chrome's CRLSets, because standard CRL/OCSP checks are often skipped for CA certs by browsers.

(CCP) Certified Cybersecurity Professional Practice Test

(CCP) Certified Cybersecurity Professional Practice Test

CCP TLS, PKI & Encryption Standards 3