PKI Quiz: CA, CRL & OCSP Decoded

1. Which statement best describes certificate pinning in PKI?

Storing a copy of a certificate's public key locally for validation

Revoking all certificates issued by a CA

Encrypting the certificate with a PIN

Publishing the CA's private key

2. Which PKI component validates that a certificate was issued by a trusted CA?

Certificate chain verification

CRL update mechanism

OCSP responder cache

Key escrow system

3. OCSP responders must be highly available to avoid service disruption. True or False?

True

False

Submit

5. Which revocation method is more suitable for environments with intermittent network connectivity?

OCSP (online checking)

CRL (downloaded periodically)

Certificate pinning

Manual revocation notification

Submit

7. What is the primary benefit of using a hierarchical PKI structure with multiple CAs?

Reduces administrative burden and improves scalability

Encrypts all data automatically

Eliminates the need for certificate revocation

Increases the speed of certificate issuance

8. CRL contains the serial number of revoked certificates and the reason for revocation. True or False?

True

False

9. A self-signed certificate is typically used for which PKI role?

End-entity certificates for users

Root Certificate Authority

Intermediate CA certificates

Server SSL/TLS certificates

Submit

11. What is the primary role of a Certificate Authority (CA) in Public Key Infrastructure?

Issue and sign digital certificates to verify identity

Encrypt all network traffic automatically

Manage firewall rules

Store all private keys in a central database

Submit

13. What is a disadvantage of using CRL compared to OCSP?

CRL requires constant network connectivity

CRL downloads can be large and outdated

CRL cannot verify identity

CRL does not support encryption

14. CRL files grow larger over time as more certificates are revoked. True or False?

True

False

Submit

16. Which PKI component is responsible for distributing CRLs to clients?

Root Certificate Authority

Intermediate Certificate Authority

CRL Distribution Point (CDP)

OCSP Responder

17. What does OCSP stand for?

Online Certificate Status Protocol

Offline Certificate Signing Process

Online Cryptography and Security Protocol

Organizational Certificate System Platform

18. A root CA is typically kept offline in a secure vault to prevent compromise. True or False?

True

False

Submit

20. Which document lists certificates that have been revoked before their expiration date?

Certificate Signing Request (CSR)

Certificate Revocation List (CRL)

Online Certificate Status Protocol (OCSP)

Certificate Authority Authorization (CAA)

PKI Quiz: CA, CRL & OCSP Decoded

1. Which statement best describes certificate pinning in PKI?

2.

What first name or nickname would you like us to use?

2. Which PKI component validates that a certificate was issued by a trusted CA?

3. OCSP responders must be highly available to avoid service disruption. True or False?

4. A certificate issued with a validity period of 10 years may have its CRL updated ____ to remove expired entries.

5. Which revocation method is more suitable for environments with intermittent network connectivity?

6. An OCSP response is signed by the ____ to provide authenticity.

7. What is the primary benefit of using a hierarchical PKI structure with multiple CAs?

8. CRL contains the serial number of revoked certificates and the reason for revocation. True or False?

9. A self-signed certificate is typically used for which PKI role?

10. OCSP stapling improves performance by having the ____ provide the OCSP response.

11. What is the primary role of a Certificate Authority (CA) in Public Key Infrastructure?

12. An intermediate CA is signed by the ____ CA and signs end-entity certificates.

13. What is a disadvantage of using CRL compared to OCSP?

14. CRL files grow larger over time as more certificates are revoked. True or False?

15. An OCSP ____ is a server that responds to client queries about certificate revocation status.

16. Which PKI component is responsible for distributing CRLs to clients?

17. What does OCSP stand for?

18. A root CA is typically kept offline in a secure vault to prevent compromise. True or False?

19. OCSP is preferred over CRL in many modern systems because it provides ____.

20. Which document lists certificates that have been revoked before their expiration date?