Free Practice Quiz Question List

6 Certificates and Public Key Infrastructure Online Quiz Questions

Use this free practice quiz with 20 questions to review 6 Certificates and Public Key Infrastructure, test your knowledge, and prepare for your next test or exam.

20 questions

Written response

1 point

An organization uses people, policies, procedures, and technology to create, issue, manage, validate, and revoke certificates and keys. What is this framework called?

Choose one

1 point

A browser receives a website certificate during an HTTPS connection. Which component establishes the keys used to protect that connection?

A
The certificate authority encrypts the connection using its signing key.
B
The TLS protocol establishes keys to protect the connection.
C
The registration authority encrypts the connection after checking the website’s identity.
D
The certificate itself encrypts all data sent between the browser and website.

Choose one

1 point

A registration authority checks an applicant’s identity for a certificate request. Under the described PKI process, who remains responsible for issuing the certificate?

A
The RA issues the certificate, while the CA only delivers it.
B
The applicant issues the certificate after the RA checks the identity.
C
The RA may check identity on the CA’s behalf, but the CA remains responsible for issuance.
D
The RA and CA are both prohibited from checking identity or control of the named resource.

Choose one

1 point

A certificate’s signature verifies and its validity period has not ended. What should a verifier check to determine whether the certificate is appropriate for the application’s intended use?

A
Check key usage and extended key usage fields.
B
Check only whether the issuer’s name is present.
C
Accept it for any purpose if its signature verifies.
D
Check whether the subject’s private key is included in the certificate.

Written response

1 point

A verifier wants to query certificate status online rather than obtain a published list of revoked certificates. What protocol can it use?

True or false

1 point

A certificate can still be within its validity period and nevertheless have been revoked.

A
True
B
False

Choose one

1 point

A browser requests shop.example, and the certificate chains to a trusted root and is valid for the connection’s time and purpose. What identity check must still succeed for HTTPS?

A
The issuer’s name must match the requested host name.
B
The certificate’s public key must contain the requested host name.
C
The requested host name must match the certificate’s applicable subject alternative name.
D
The requested host name must match the root CA’s subject.

Choose one

1 point

A verifier searches among available certificates for a route that could connect a target certificate to an accepted trust anchor. Which task is it performing?

A
Path validation, because it finds possible connecting certificates; path discovery, because it checks validity periods.
B
Path discovery, because it finds certificates that may connect the target to a trust anchor.
C
Revocation checking, because it searches for a chain; path discovery, because it checks intended use.
D
Trust-anchor selection, because it verifies each signature along the path.

True or false

1 point

A certificate is a trust anchor for a verifier simply because it is self-signed.

A
True
B
False

Choose one

1 point

An organization wants to reduce routine use of its root CA’s private key and limit the impact of a possible compromise of an issuing CA. How does using an intermediate CA help?

A
It makes every certificate issued by the organization trusted without validation.
B
It removes the need to protect the root CA’s private key.
C
It guarantees that the root CA can never be compromised.
D
It allows routine certificate issuance without using the root CA’s private key, and a compromised intermediate can be addressed without necessarily replacing the root.

Choose one

1 point

A verifier checks a certificate’s signature successfully but encounters a critical extension it does not understand. What should it do?

A
Accept it because the issuer’s signature verifies.
B
Reject it because a critical extension the verifier does not understand cannot be ignored.
C
Accept it if the certificate has not expired.
D
Accept it if the certificate identifies the expected organization.

Choose one

1 point

A proposed certificate path has valid signatures, but a CA certificate in the path is not authorized to issue certificates of the target’s kind. Which decision follows the stated validation requirements?

A
Accept the certificate because the CA’s signature verifies.
B
Accept it if the certificate’s subject is recognized.
C
Reject it because the issuing CA is not authorized to issue certificates of this kind.
D
Accept it if the certificate contains a public key.

Choose all

1 point

Based on the material’s description of a certificate signature, select all claims that a verifier can check from that signature.

A
The signed record has not been altered since it was signed.
B
The subject is inherently trustworthy.
C
The record was issued by the named issuer, as checked using the issuer’s public key.
D
A connection using the certificate is necessarily encrypted.

Choose all

1 point

A verifier is evaluating a proposed certification path. Select all checks that the material identifies as relevant to whether the path satisfies validation requirements.

A
Whether CA certificates in the path are authorized to issue certificates.
B
Whether the subject’s website is honest.
C
Whether certificate constraints and policies are respected.
D
Whether every critical extension is understood.

True or false

1 point

A certificate is signed by a CA. This alone guarantees that the certificate’s subject operates a secure system.

A
True
B
False

Written response

1 point

In an X.509 certificate, what field identifies the entity or name to which the certificate relates?

Written response

1 point

To check a certificate’s signature, what key does the verifier use?

Open ended

1 point

A company is deciding whether to use a private organizational PKI or obtain publicly trusted TLS certificates. Compare the policy frameworks the material describes for these two settings.

Fill in the blank

1 point

An applicant creates a key pair and submits a certificate request containing the requested identity and the . The corresponding private key is kept protected.

Fill in the blank

1 point

A certificate policy requires an applicant to demonstrate authority over a named resource. The enrollment check must establish the applicant's of that resource.