SSCA Cryptography & PKI 3

Question 1

What is the purpose of a Hardware Security Module (HSM) in a cryptographic infrastructure?

Accepted Answer

To securely generate, store, and manage cryptographic keys in tamper-resistant hardware

Answer

To speed up network packet inspection for encrypted traffic

Answer

To replace software-based TLS implementations on web servers

Answer

To distribute CRLs to relying parties on behalf of the CA

Question 2

Which concept describes the practice of keeping a copy of an encryption key with a trusted third party so it can be recovered if lost?

Accepted Answer

Key escrow

Answer

Key rotation

Answer

Key derivation

Answer

Key wrapping

Question 3

During a TLS 1.3 handshake, which step establishes the shared session key?

Accepted Answer

Both parties use an ephemeral Diffie-Hellman exchange to derive a shared secret

Answer

The server sends its certificate and the client encrypts a pre-master secret with the server's public key

Answer

The client sends a symmetric key encrypted with the server's RSA public key

Answer

A pre-shared key (PSK) is manually configured on both endpoints

Question 4

What does a Message Authentication Code (MAC) provide that a simple hash function does not?

Accepted Answer

Both integrity and data origin authentication using a shared secret key

Answer

Faster computation on large data sets

Answer

Public-key-based non-repudiation for the sender

Answer

Encryption of the message payload alongside integrity verification

Question 5

Which cipher suite component provides forward secrecy by ensuring that past session keys cannot be recovered even if the server's long-term private key is compromised?

Accepted Answer

Ephemeral ECDHE key exchange

Answer

AES-256-GCM for symmetric encryption

Answer

SHA-384 for message authentication

Answer

RSA for server authentication

Question 6

An organization wants to ensure email authenticity and prevent repudiation. Which technology should be implemented?

Accepted Answer

S/MIME digital signatures using sender's private key

Answer

TLS encryption on the mail transfer agent

Answer

DKIM for mail server authentication only

Answer

PGP symmetric encryption with a passphrase

Question 7

What is the purpose of certificate pinning in application security?

Accepted Answer

Hardcoding expected certificate or public key values in the application to reject unexpected certificates

Answer

Preventing a certificate from expiring by automatically renewing it

Answer

Pinning a certificate to a specific CA to prevent cross-CA issuance

Answer

Locking the certificate's key usage fields so they cannot be changed after issuance