SSCP Cryptography & PKI 4 — Questions and Answers
Question 1: What does OCSP stand for, and what is its primary function in PKI?
- Online Certificate Status Protocol — checking real-time certificate validity (Correct answer)
- Offline Certificate Signing Process — batch-signing certificates
- Outbound Certificate Security Policy — filtering CA traffic
- Optional Certificate Storage Protocol — caching CRLs
Correct answer: Online Certificate Status Protocol — checking real-time certificate validity
OCSP (Online Certificate Status Protocol) allows clients to query a responder in real time to check whether a specific certificate has been revoked.
Question 2: Which property of a cryptographic hash function ensures that finding two different inputs with the same hash output is computationally infeasible?
- Preimage resistance
- Second preimage resistance
- Collision resistance (Correct answer)
- Avalanche effect
Correct answer: Collision resistance
Collision resistance means it is computationally infeasible to find any two distinct inputs that produce the same hash digest.
Question 3: A company wants to use encryption that provides both confidentiality and data origin authentication in a single operation. Which mode should they choose?
- AES-ECB
- AES-CBC with HMAC separately
- AES-GCM (Galois/Counter Mode) (Correct answer)
- 3DES-CBC
Correct answer: AES-GCM (Galois/Counter Mode)
AES-GCM is an authenticated encryption mode that simultaneously provides confidentiality via CTR and authentication via GHASH in one pass.
Question 4: What is the concept of 'perfect forward secrecy' (PFS) in key exchange protocols?
- Session keys are derived from the long-term private key
- Compromise of the long-term key does not expose past session keys (Correct answer)
- All session keys are stored encrypted with the CA's public key
- Keys are refreshed every 60 seconds automatically
Correct answer: Compromise of the long-term key does not expose past session keys
PFS ensures that ephemeral session keys are negotiated independently so that exposing the long-term private key cannot decrypt previously recorded sessions.
Question 5: Which X.509 certificate extension restricts a CA certificate from issuing certificates to a depth greater than a specified number?
- KeyUsage
- ExtendedKeyUsage
- BasicConstraints (pathLenConstraint) (Correct answer)
- SubjectAlternativeName
Correct answer: BasicConstraints (pathLenConstraint)
The BasicConstraints extension with a pathLenConstraint value limits how many subordinate CAs can be chained below the issuing CA.
Question 6: When verifying a digital signature, what key does the verifier use?
- The signer's private key
- The verifier's private key
- The signer's public key (Correct answer)
- A shared symmetric key
Correct answer: The signer's public key
The verifier uses the signer's public key to decrypt the signature and confirm it matches the message digest.
Question 7: Which of the following is a stream cipher?
- AES
- 3DES
- RC4 (Correct answer)
- Blowfish
Correct answer: RC4
RC4 is a stream cipher that generates a keystream XORed with plaintext one byte at a time, unlike block ciphers that process fixed-size chunks.
SSCP Cryptography & PKI 4
What does OCSP stand for, and what is its primary function in PKI?