SSCP Cryptography & PKI 4

Question 1

What does OCSP stand for, and what is its primary function in PKI?

Accepted Answer

Online Certificate Status Protocol — checking real-time certificate validity

Answer

OCSP (Online Certificate Status Protocol) allows clients to query a responder in real time to check whether a specific certificate has been revoked.

Question 2

Which property of a cryptographic hash function ensures that finding two different inputs with the same hash output is computationally infeasible?

Accepted Answer

Collision resistance

Answer

Collision resistance means it is computationally infeasible to find any two distinct inputs that produce the same hash digest.

Question 3

A company wants to use encryption that provides both confidentiality and data origin authentication in a single operation. Which mode should they choose?

Accepted Answer

AES-GCM (Galois/Counter Mode)

Answer

AES-GCM is an authenticated encryption mode that simultaneously provides confidentiality via CTR and authentication via GHASH in one pass.

Question 4

What is the concept of 'perfect forward secrecy' (PFS) in key exchange protocols?

Accepted Answer

Compromise of the long-term key does not expose past session keys

Answer

PFS ensures that ephemeral session keys are negotiated independently so that exposing the long-term private key cannot decrypt previously recorded sessions.

Question 5

Which X.509 certificate extension restricts a CA certificate from issuing certificates to a depth greater than a specified number?

Accepted Answer

BasicConstraints (pathLenConstraint)

Answer

The BasicConstraints extension with a pathLenConstraint value limits how many subordinate CAs can be chained below the issuing CA.

(SSCP) Systems Security Certified Practitioner Exam Practice Test

(SSCP) Systems Security Certified Practitioner Exam Practice Test

SSCP Cryptography & PKI 4