CDN SSL/TLS & Certificate Management 3

Question 1

What is the function of Certificate Transparency (CT) logs in the context of CDN certificate management?

Accepted Answer

They provide a public, auditable record of all issued certificates

Answer

CT logs are append-only public ledgers that record every certificate issued by a CA, allowing domain owners and browsers to detect unauthorized certificates.

Question 2

Which protocol is ACME (Automatic Certificate Management Environment) most commonly associated with?

Accepted Answer

Let's Encrypt certificate issuance automation

Answer

ACME is the protocol developed alongside Let's Encrypt to automate DV certificate issuance, renewal, and revocation.

Question 3

A CDN notices that the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA is still negotiated by some clients. What is the primary concern?

Accepted Answer

It lacks forward secrecy because RSA key exchange is used

Answer

RSA key exchange does not provide forward secrecy; if the server's private key is later compromised, all past recorded sessions can be decrypted.

Question 4

What does HSTS (HTTP Strict Transport Security) instruct a browser to do?

Accepted Answer

Always connect to the domain over HTTPS, even if the user types HTTP

Answer

HSTS tells the browser to reject plain HTTP connections and always use HTTPS for the specified domain and duration.

Question 5

When a CDN performs SSL bridging (re-encryption) to the origin, what is the key security requirement?

Accepted Answer

The CDN must validate the origin's certificate to prevent MITM between edge and origin

Answer

Without validating the origin's certificate, the CDN-to-origin connection is vulnerable to man-in-the-middle attacks even though the client-to-CDN leg is secure.

(CDN) Content Delivery Network Certification Practice Test

(CDN) Content Delivery Network Certification Practice Test

CDN SSL/TLS & Certificate Management 3