Enterprise PKI Deployment & Design Quiz

1. Which algorithm is currently recommended for RSA key generation in enterprise PKI deployments?

1024-bit RSA

2048-bit RSA or greater

512-bit RSA

DES encryption

2. Which security principle requires that CA private keys be protected by multi-person control and separation of duties?

Principle of least privilege

Defense in depth

Dual control and split knowledge

Certificate transparency

3. In PKI deployment, what is the 'validation authority' responsible for?

Issuing certificates

Verifying domain ownership and applicant identity before certificate issuance

Revoking all expired certificates

Encrypting private keys

4. What role does an Online Certificate Status Protocol (OCSP) responder play in PKI?

Issues new certificates

Provides real-time certificate revocation status without downloading entire CRLs

Encrypts all communications

Manages user passwords

5. Which cryptographic hash algorithm is standard for modern PKI certificate signatures?

MD5

SHA-1

SHA-256 or stronger

CRC32

6. In enterprise PKI, what is the significance of certificate transparency (CT) logs?

They encrypt all certificate data

They provide public, auditable records of issued certificates to detect unauthorized issuance

They replace the need for CAs

They eliminate certificate validation

7. Which X.509 extension restricts a certificate's use to specific purposes?

Subject Alternative Name

Key Usage

Extended Key Usage

Authority Information Access

8. What does the 'key escrow' practice in PKI entail?

Deleting old certificates

Storing copies of private keys with a trusted third party for recovery

Publishing all public keys

Revoking certificates immediately upon issuance

9. In a three-tier PKI hierarchy, which tier is kept offline for maximum security?

Intermediate CA

End-entity CA

Root CA

Registration Authority

10. What is the purpose of certificate pinning in PKI security?

To store certificates in a database

To prevent man-in-the-middle attacks by binding specific certificates or public keys to a host

To increase certificate validity periods

To eliminate the need for CAs

11. Which entity in a PKI hierarchy is responsible for issuing and revoking digital certificates?

Root Certificate Authority

Intermediate Certificate Authority

Registration Authority

Certificate Revocation Authority

12. In enterprise PKI, what does a certificate extension provide?

Additional time before certificate expiration

Metadata defining certificate usage, constraints, and capabilities

Automatic renewal notifications

Encryption of the certificate payload

13. What is the primary advantage of using an intermediate CA instead of signing end-entity certificates directly with the root CA?

It reduces certificate cost

It allows root CA key to remain offline, improving security

It eliminates the need for CRLs

It increases certificate validity periods

14. Which attribute is typically included in a digital certificate's subject field?

Password hash

Common Name (CN), Organization (O), Country (C)

Encryption algorithms only

Administrator credentials

15. In PKI, what does the 'chain of trust' establish?

A hierarchical relationship validating certificate authenticity from root to end-entity

A list of all revoked certificates

Encryption strength between endpoints

User permissions in an Active Directory domain

16. Which key management practice is essential to prevent unauthorized certificate issuance in PKI?

Publishing all private keys online

Hardware security module (HSM) protection of CA private keys

Storing keys in plaintext databases

Sharing root CA keys among multiple admins

17. What is the standard validity period for an intermediate CA certificate in enterprise PKI?

1 year

5–10 years

20–30 years

Indefinite until revoked

18. Which protocol is most commonly used for real-time certificate status verification in modern PKI deployments?

LDAP

OCSP

DNS

NTP

19. In an enterprise PKI, what role does the Registration Authority (RA) perform?

Issues all digital certificates directly

Verifies user identity and forwards certificate requests to the CA

Manages the root certificate exclusively

Revokes expired certificates automatically

20. What is the primary purpose of a Certificate Revocation List (CRL) in PKI?

Store all issued certificates

Identify certificates that are no longer valid before expiration

Encrypt sensitive data

Authenticate end-users only

Infrastructure Expert Designing Enterprise PKI Deployment Quiz