Practice Test GeeksCASP+ - CompTIA Advanced Security Practitioner Practice Test
← All CASP+ Flashcard Decks

Cryptography and PKI Flashcards

6 cards from real CASP+ practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 6 Cryptography and PKI flashcards as text

  1. An organization wants to ensure that digital signatures on contracts remain legally valid even if the signing algorithm is later deprecated. Which mechanism BEST addresses this?

    Answer: Trusted timestamping combined with long-term validation (LTV) signatures

    LTV signatures embed the certificate chain and revocation data at signing time, and a trusted timestamp proves the signature existed before algorithm deprecation.

  2. Which cryptographic algorithm provides BOTH confidentiality and data authentication in a single operation?

    Answer: AES-GCM (Galois/Counter Mode)

    AES-GCM is an authenticated encryption mode that simultaneously provides confidentiality via CTR mode and integrity/authentication via the GHASH function.

  3. A PKI administrator needs to revoke a certificate immediately due to a key compromise. Which mechanism provides the FASTEST revocation propagation?

    Answer: OCSP stapling with short-validity responses

    OCSP stapling embeds a recent, CA-signed revocation response directly in the TLS handshake, providing near-real-time revocation status without client round-trips.

  4. Which key exchange protocol provides perfect forward secrecy (PFS)?

    Answer: Ephemeral Diffie-Hellman (DHE) or ECDHE

    Ephemeral DH/ECDHE generates a new key pair for each session, so past session keys cannot be derived even if the server's long-term private key is later compromised.

  5. An enterprise is designing a PKI hierarchy. Which structure BEST protects the root CA while maintaining operational flexibility?

    Answer: An offline root CA with online intermediate/issuing CAs

    An offline root CA is never exposed to network attack; intermediate CAs handle day-to-day issuance, and if an intermediate is compromised only that subtree needs replacement.

  6. Which elliptic curve is RECOMMENDED by NIST for use in US federal systems at the 128-bit security level?

    Answer: P-256 (secp256r1)

    NIST P-256 is the FIPS-approved curve at the 128-bit security level, recommended in NIST SP 800-186 for federal cryptographic applications.

How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

  1. comptia.org — Score release, renewal, retake fee, retake policy, score validity, eligibility, exam format, passing score, time limit, fees · verified Oct 2026