I85PREP
⌘ K
eMAPT study materials
eMAPT study resources

eMAPT practice questions

One question at a time. Build your eMAPT understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1PKI / TLS / applied cryptography

In a TLS 1.3 handshake, which key exchange mechanism is used to establish the shared secret that protects application data?

  1. Ephemeral Diffie-Hellman over an elliptic curve group Correct answer.
  2. RSA key transport with the server's long-term certificate key
  3. Static RSA key exchange negotiated in the ServerHello
  4. Password-authenticated key exchange with the client certificate

Explanation

TLS 1.3 removed static RSA key transport and requires forward-secret key agreement, typically ephemeral Diffie-Hellman (ECDHE) over a named group. The server's certificate signs the handshake transcript rather than encrypting a premaster secret.

Question 2PKI / TLS / applied cryptography

A certificate has the key usage bit keyCertSign cleared but basicConstraints CA:TRUE. What is the consequence when a relying party validates a chain through it?

  1. The certificate can only be used for TLS server authentication
  2. The certificate is treated as a self-signed trust anchor
  3. The certificate cannot be used to sign subordinate certificates in a validating path Correct answer.
  4. The certificate may sign end-entity certificates because basicConstraints takes precedence

Explanation

Key usage restricts the cryptographic operations a key may perform, and keyCertSign is required for a CA certificate that signs other certificates. basicConstraints marks CA capability but does not override the key usage restriction, so path validation fails.

Question 3PKI / TLS / applied cryptography

Which property does certificate pinning in a mobile application primarily provide beyond normal CA-based validation?

  1. Confidentiality of the application's local database
  2. Resistance to fraudulent certificates issued by a compromised or coerced CA Correct answer.
  3. Protection against downgrade to TLS 1.0 on the server side
  4. Guaranteed revocation checking without network access

Explanation

Pinning ties trust to a specific key or certificate rather than to the entire set of trusted CAs, so a mis-issued certificate from a compromised CA will not be accepted. It addresses trust anchor breadth, not data-at-rest or protocol downgrade.

Question 4PKI / TLS / applied cryptography

An application validates a server certificate by checking the signature chain but skips hostname verification. Which attack does this most directly enable?

  1. Forgery of the server's certificate signature
  2. A replay of a previously captured session ticket
  3. Recovery of the server's ephemeral private key
  4. A man-in-the-middle using any other validly issued certificate Correct answer.

Explanation

Without hostname verification, any certificate chaining to a trusted CA is accepted regardless of the name it asserts, so an attacker holding an unrelated valid certificate can impersonate the server. The chain itself remains cryptographically sound.

Question 5PKI / TLS / applied cryptography

What is the role of the Authority Key Identifier extension in an X.509 certificate?

  1. It identifies the public key of the CA that signed the certificate Correct answer.
  2. It names the CRL distribution point for the issuing CA
  3. It records the certificate's permitted key usage bits
  4. It specifies the DNS names the certificate is valid for

Explanation

The Authority Key Identifier carries a hash or key identifier of the issuer's public key, helping a validator select the correct issuer certificate when several exist. Subject Key Identifier plays the complementary role on the CA side.

Question 6PKI / TLS / applied cryptography

A TLS server is configured with a certificate chain that omits the intermediate CA certificate. Which failure will a client most commonly observe?

  1. A warning that the leaf certificate has expired
  2. A failure caused by an unsupported cipher suite
  3. A handshake failure because the chain cannot be built to a trusted root Correct answer.
  4. A successful handshake because clients fetch missing intermediates automatically

Explanation

The server must send the intermediate certificates so the client can construct a path from the leaf to a trusted root. If an intermediate is missing, path building typically fails and the handshake aborts.

Question 7PKI / TLS / applied cryptography

Which statement correctly describes the difference between a digital signature and a message authentication code (MAC)?

  1. A MAC provides non-repudiation while a signature does not
  2. A MAC uses asymmetric keys and a signature uses symmetric keys
  3. A signature can be verified by anyone with the public key, while a MAC requires the shared secret Correct answer.
  4. A signature guarantees confidentiality of the message

Explanation

A digital signature is verified with a public key and provides non-repudiation because only the private key holder could have produced it. A MAC uses a shared symmetric key, so any holder of that key could have computed it.

Question 8PKI / TLS / applied cryptography

In a certificate, the Subject Alternative Name extension contains an IP address and a DNS name. How should a client validating a connection to that DNS name treat the subject CN field?

  1. The CN is ignored for hostname matching when SAN is present Correct answer.
  2. The CN is used only when the SAN holds an IP address
  3. The CN overrides the SAN if they conflict
  4. The CN must also match or validation fails

Explanation

Modern validation rules, reflected in RFC 6125 and CA/Browser Forum requirements, require hostname matching against Subject Alternative Name entries. When SAN is present, the CN is not consulted for identity matching.

Question 9PKI / TLS / applied cryptography

What does OCSP stapling change about revocation checking in TLS?

  1. It removes the need for any revocation information
  2. It encrypts the client's revocation query to the CA
  3. It replaces CRLs with a permanent whitelist of valid certificates
  4. It lets the server present a CA-signed, time-stamped revocation response during the handshake Correct answer.

Explanation

With stapling, the server obtains a signed OCSP response and sends it to the client, avoiding a separate client query to the CA. The response is signed and time-limited, so it still conveys revocation status.

Question 10PKI / TLS / applied cryptography

A developer wants to store user passwords so that offline brute-force attacks remain expensive even if the database leaks. Which approach is appropriate?

  1. A memory-hard password hashing function with a unique per-user salt Correct answer.
  2. AES encryption of the password with a key stored in the database
  3. HMAC-SHA1 keyed with a global application secret
  4. SHA-256 of the password with no salt

Explanation

Password hashing functions such as Argon2, scrypt, or bcrypt with per-user salts raise the cost of offline guessing and prevent precomputation and cross-user correlation. Fast general-purpose hashes are unsuitable for password storage.

Question 11PKI / TLS / applied cryptography

Which mode of operation provides authenticated encryption suitable for protecting TLS records?

  1. RSA-OAEP
  2. AES-ECB
  3. AES-GCM Correct answer.
  4. AES-CBC with PKCS#7 padding

Explanation

AES-GCM is an AEAD mode that provides both confidentiality and integrity, which is why TLS 1.3 uses only AEAD ciphers. CBC without a MAC is vulnerable to padding oracle attacks, and ECB leaks structure.

Question 12PKI / TLS / applied cryptography

A signature scheme is described as having strong existential unforgeability under chosen-message attack. What does this guarantee?

  1. An attacker cannot produce a new valid signature on any message, even one already signed Correct answer.
  2. Verification requires no public key distribution
  3. An attacker cannot recover the private key from signatures
  4. Signatures remain valid after the key is revoked

Explanation

Existential unforgeability means no adversary can output a valid signature on any message not previously signed by the legitimate holder, even with access to a signing oracle. It is a property of the signature scheme, not of key management or distribution.

Question 13PKI / TLS / applied cryptography

What is the primary purpose of a Certificate Revocation List distribution point extension?

  1. To tell validators where to obtain revocation lists for the certificate Correct answer.
  2. To specify the algorithms used to sign the certificate
  3. To list the certificate's permitted extended key usages
  4. To bind the certificate to a specific TLS cipher suite

Explanation

The CRL Distribution Points extension contains URIs from which validators can download the CRL that would list the certificate if revoked. It is a location hint, not a statement of status.

Question 14PKI / TLS / applied cryptography

An attacker captures a TLS 1.2 session that used RSA key exchange and later obtains the server's long-term private key. What can the attacker do?

  1. Nothing, because the session keys were deleted
  2. Decrypt the recorded session because the premaster secret was protected with that key Correct answer.
  3. Recover the client's private key from the handshake
  4. Only forge new certificates for the server's domain

Explanation

With static RSA key exchange the client encrypts the premaster secret to the server's long-term key, so possession of that key later allows decryption of recorded sessions. This lack of forward secrecy is why TLS 1.3 removed RSA key transport.

Question 15PKI / TLS / applied cryptography

Which of the following best describes the trust model used by a public web PKI browser trust store?

  1. Trust flows from a set of root CAs whose certificates are distributed with the platform Correct answer.
  2. Trust is established by DNS TXT records published by each domain
  3. Clients verify servers using a shared symmetric key distributed at install time
  4. Every server certificate is signed directly by the browser vendor

Explanation

Browsers and operating systems ship a trust store of root CA certificates, and any certificate chaining to one of those roots is trusted subject to policy constraints. This breadth is why mis-issuance and pinning are relevant concerns.

Question 16PKI / TLS / applied cryptography

A CA issues a certificate with the nameConstraints extension permitting only the DNS subtree example.com. What happens when a subordinate CA under it issues a certificate for evil.test?

  1. The certificate is valid if the subordinate CA has a longer validity period
  2. The constraint is ignored unless the client supports it optionally
  3. The certificate violates the constraint and should be rejected by validators Correct answer.
  4. The certificate is valid because name constraints apply only to leaf certificates

Explanation

Name constraints restrict the namespace a CA may certify throughout the subtree beneath it, including certificates issued by subordinate CAs. A validator enforcing the constraint rejects any certificate outside the permitted subtree.

Question 17PKI / TLS / applied cryptography

Which TLS 1.3 feature prevents an active attacker from forcing negotiation of an older protocol version?

  1. The use of RSA key transport
  2. The downgrade sentinel value embedded in the ServerHello random field Correct answer.
  3. The session ticket lifetime
  4. The optional use of compression

Explanation

TLS 1.3 servers place a special sentinel value in the last bytes of the ServerHello random when negotiating TLS 1.2 or below, allowing clients to detect an active downgrade attempt. Version negotiation itself is also protected by the transcript hash.

Question 18PKI / TLS / applied cryptography

What distinguishes a wildcard certificate for *.example.com from a certificate listing specific hostnames?

  1. The wildcard covers exactly one label in place of the asterisk and not deeper subdomains Correct answer.
  2. The wildcard requires an EV validation level
  3. The wildcard covers any depth of subdomain beneath example.com
  4. The wildcard is valid only for the bare domain example.com

Explanation

Per RFC 6125 matching rules, a wildcard such as *.example.com matches a single leftmost label, so a.example.com matches but a.b.example.com does not. Deeper names require additional SAN entries.

Question 19PKI / TLS / applied cryptography

A mobile app embeds a hardcoded AES key used to encrypt local files. Which weakness is most significant?

  1. The key cannot be rotated without reinstalling the app
  2. AES is unsuitable for file encryption
  3. The ciphertext will be larger than the plaintext
  4. The key can be extracted from the app package and used to decrypt any user's files Correct answer.

Explanation

A key embedded in an application binary is recoverable by anyone who obtains the package, so it provides no confidentiality against an attacker with the app. Per-device keys derived from hardware-backed storage avoid this shared-secret exposure.

Question 20PKI / TLS / applied cryptography

In PKCS#7/CMS signed data, what does the signer's certificate collection allow a verifier to do?

  1. Guarantee the content was not read in transit
  2. Decrypt the signed content without a key
  3. Re-encrypt the content for additional recipients
  4. Build and validate the signer's certificate path to a trust anchor Correct answer.

Explanation

CMS SignedData may include the signer's certificate and supporting certificates, letting the verifier construct a path to a trusted root and validate the signature. It does not provide confidentiality.

Question 21PKI / TLS / applied cryptography

Why is using a unique initialization vector important with AES-CBC?

  1. The IV must be kept secret to preserve confidentiality
  2. Reusing an IV with the same key leaks whether plaintext blocks are identical across messages Correct answer.
  3. A unique IV removes the need for padding
  4. The IV determines the key length used by the cipher

Explanation

In CBC, identical IVs and keys cause identical first blocks to produce identical ciphertext, revealing equality of plaintext prefixes. The IV must be unpredictable and unique per message but need not be secret.

Question 22PKI / TLS / applied cryptography

Which statement about the chain of trust in code signing on mobile platforms is accurate?

  1. The application verifies its own signature at every launch
  2. Code signing provides runtime memory protection
  3. The platform verifies the signature against an embedded trust anchor for the signing authority Correct answer.
  4. A self-signed certificate is always accepted for code signing

Explanation

Platforms validate code signatures against a trust anchor they control, ensuring only authorized signers can distribute installable code. Self-signed certificates are not trusted unless explicitly provisioned.

Question 23PKI / TLS / applied cryptography

An attacker presents a certificate whose signature algorithm field says sha256WithRSA but whose signature bytes validate under a different, weaker algorithm due to parser disagreement. What class of vulnerability is this?

  1. Algorithm confusion or signature algorithm substitution Correct answer.
  2. Downgrade to SSLv3
  3. Cross-site request forgery
  4. Padding oracle

Explanation

Algorithm substitution attacks exploit discrepancies between the algorithm declared in the certificate and the one a verifier actually applies, sometimes allowing a weaker scheme to be used. Robust implementations bind the declared algorithm to the verification routine and reject mismatches.

Question 24PKI / TLS / applied cryptography

What is the effect of marking an X.509 extension as critical?

  1. The extension is ignored by all conforming validators
  2. A validator that does not understand the extension must reject the certificate Correct answer.
  3. The extension is valid for a longer period
  4. The extension is signed with a stronger algorithm

Explanation

The critical flag tells validators that the extension's semantics must be processed; if a validator cannot process it, the certificate must be rejected. Non-critical extensions may be ignored by validators that do not understand them.

Question 25PKI / TLS / applied cryptography

A Diffie-Hellman key exchange is performed over a group with a small subgroup, and the peer's public value is not validated. Which attack becomes feasible?

  1. Small subgroup confinement, leaking bits of the private exponent Correct answer.
  2. Signature forgery against the CA
  3. Certificate expiration bypass
  4. Padding oracle decryption

Explanation

If a peer can supply an element of small order, the shared secret is confined to a small set and repeated exchanges leak information about the private exponent. Validating public values and using safe prime groups or elliptic curves prevents this.

Question 26PKI / TLS / applied cryptography

In an X.509 certificate, which field identifies the entity that signed the certificate and allows a client to locate the issuer's certificate?

  1. The serial number
  2. The validity period
  3. The issuer distinguished name Correct answer.
  4. The subject public key info

Explanation

The issuer distinguished name names the CA that signed the certificate, so a relying party can match it against the subject name of a candidate issuer certificate while building a chain. The serial number uniquely identifies the certificate within that issuer but does not name the issuer itself.

Question 27PKI / TLS / applied cryptography

Which key is used to verify a digital signature that a server produced with its RSA private key?

  1. The client's RSA private key
  2. A shared symmetric session key
  3. The CA's private key
  4. The server's RSA public key Correct answer.

Explanation

Signature verification uses the public key corresponding to the private key that produced the signature, so the server's public key (delivered in its certificate) verifies it. The CA private key is used only to sign certificates, not to verify the server's own signatures.

Question 28PKI / TLS / applied cryptography

A mobile app must validate a server certificate chain. Which property of the root CA certificate allows it to serve as a trust anchor without being signed by another CA?

  1. It contains a Subject Alternative Name
  2. It uses an elliptic curve key
  3. It is self-signed and distributed out of band in the trust store Correct answer.
  4. It has the longest validity period in the chain

Explanation

A trust anchor is trusted because it is provisioned out of band, typically as a self-signed root in the platform trust store; no superior certificate is needed. Validity length, key type, and SAN contents do not confer anchor status.

Question 29PKI / TLS / applied cryptography

Which TLS record protection property ensures that an attacker cannot silently reorder or drop individual encrypted records without detection?

  1. The cipher suite's key exchange group
  2. The server's certificate validity period
  3. The sequence number bound into the AEAD additional authenticated data Correct answer.
  4. The TLS extension list in the ClientHello

Explanation

TLS feeds a per-direction sequence number into the AEAD associated data, so reordering, dropping, or replaying records breaks authentication and the connection fails. The other listed items affect negotiation or identity, not per-record ordering integrity.

Question 30PKI / TLS / applied cryptography

What is the primary function of a certificate signing request (CSR) in a public key infrastructure?

  1. It encrypts application traffic between client and server
  2. It stores the CA's private key for signing
  3. It revokes a previously issued certificate
  4. It conveys the subject's public key and requested attributes to a CA for certification Correct answer.

Explanation

A CSR packages the subject's public key and requested identity attributes, and is signed with the matching private key to prove possession before the CA issues a certificate. It does not carry traffic, revoke certificates, or hold CA secrets.

Question 31PKI / TLS / applied cryptography

In AES-GCM, what is the consequence of reusing the same nonce with the same key for two different messages?

  1. Only message length is leaked
  2. Confidentiality and integrity both break for the affected messages Correct answer.
  3. Nothing changes because GCM is deterministic
  4. The ciphertext becomes longer

Explanation

GCM derives its counter keystream and authentication key from the nonce, so reuse exposes keystream XOR relationships and can allow forgery of the authentication tag. Nonce uniqueness per key is therefore mandatory.

Question 32PKI / TLS / applied cryptography

Which statement best describes the role of the Extended Key Usage extension in an X.509 certificate?

  1. It specifies the revocation checking method
  2. It restricts the certificate to specific purposes such as TLS server authentication Correct answer.
  3. It defines the signature hash algorithm
  4. It lists the certificate's permitted IP addresses

Explanation

Extended Key Usage constrains how the certified key may be used, for example serverAuth or clientAuth, so a relying party can reject a validly signed certificate used for the wrong purpose. Revocation methods, name constraints, and signature algorithms are expressed by other fields.

Question 33PKI / TLS / applied cryptography

Why do TLS implementations derive separate keys for each direction of a connection rather than using one shared key for both?

  1. To prevent reflection attacks and keep each direction's sequence space independent Correct answer.
  2. To avoid using AEAD ciphers
  3. To allow the server to skip the handshake
  4. To reduce the certificate size

Explanation

Distinct client-to-server and server-to-client keys mean traffic reflected back to its sender cannot be accepted as valid, and each direction maintains its own sequence numbers. Certificate size, handshake skipping, and cipher choice are unrelated.

Question 34PKI / TLS / applied cryptography

A server presents a certificate whose subject is CN=api.example.com with a SAN extension listing only DNS:api.example.com. A client connects to api.example.com. How should a modern client evaluate the name?

  1. Accept any name because a SAN is present
  2. Reject the certificate because CN and SAN must differ
  3. Match the requested hostname against the SAN dNSName entries Correct answer.
  4. Match only the legacy CN field

Explanation

Modern validation matches the reference identity against subjectAltName entries of the appropriate type, and the CN is ignored when a SAN is present. A SAN listing the correct name therefore validates successfully.

Question 35PKI / TLS / applied cryptography

A CA issues a subordinate CA certificate that includes the basicConstraints extension with cA=TRUE and pathLenConstraint=0. Which certificates may this subordinate issue?

  1. Any number of additional subordinate CA certificates
  2. Only certificates that omit basicConstraints
  3. Only certificates with the same subject name
  4. End-entity certificates only, not further subordinate CA certificates Correct answer.

Explanation

pathLenConstraint=0 means no non-self-issued CA certificate may appear below this certificate in the chain, so the subordinate may issue only end-entity certificates. It still is a CA and may issue leaves freely.

Question 36PKI / TLS / applied cryptography

A developer must pin a mobile app to a backend. Which pinning approach remains valid across normal certificate renewals while still resisting a compromised public CA?

  1. Pin the subject public key of a key held by the organization Correct answer.
  2. Pin the certificate's notAfter date
  3. Pin the exact leaf certificate serial number
  4. Pin the root CA's common name string

Explanation

Public key pinning survives reissuance as long as the same key pair is reused, and it still rejects certificates from any other CA. Serial numbers, names, and dates are weak or brittle identifiers that change or can be spoofed.

Question 37PKI / TLS / applied cryptography

During a TLS 1.3 handshake, an attacker replays a previously recorded ClientHello with a stale key_share. What prevents the attacker from completing a handshake with the client's old secrets?

  1. The server rejects all ClientHello messages without SNI
  2. Fresh ephemeral key shares are generated per handshake, so the derived secrets differ Correct answer.
  3. The session ticket is encrypted with the client's password
  4. The certificate pins the client's IP address

Explanation

TLS 1.3 derives handshake secrets from fresh ephemeral Diffie-Hellman exchanges, so replayed messages cannot reproduce the same shared secret or Finished values. SNI, IP binding, and passwords are not the mechanism providing this property.

Question 38PKI / TLS / applied cryptography

A verifier receives a CMS SignedData structure with no certificates included and cannot obtain the signer's certificate from another source. What is the practical result?

  1. The signature becomes a MAC
  2. The signature cannot be validated to a trusted identity Correct answer.
  3. The content is automatically decrypted
  4. The signature validates because the key is embedded in the signature bytes

Explanation

CMS signatures identify the signer and rely on the signer's certificate to supply the public key and identity; without it, the verifier cannot build a trusted path. Signature bytes do not embed the verification key.

Question 39PKI / TLS / applied cryptography

A certificate contains a keyUsage extension with only digitalSignature asserted. Which use is permitted for the certified key?

  1. Verifying signatures, such as in a TLS handshake signature Correct answer.
  2. CRL signing
  3. Key encipherment for RSA key transport
  4. Certificate signing

Explanation

keyUsage bits restrict the operations the key may perform; digitalSignature permits signature generation and verification. Key encipherment, certificate signing, and CRL signing require their own distinct bits.

Question 40PKI / TLS / applied cryptography

An application uses AES-CBC with a fixed IV for every file it encrypts. What is the most direct confidentiality consequence?

  1. The key is exposed directly
  2. The MAC tag becomes forgeable
  3. Ciphertext length becomes unbounded
  4. Identical plaintext prefixes produce identical first ciphertext blocks Correct answer.

Explanation

CBC XORs the IV into the first block, so a constant IV makes equal leading plaintext blocks encrypt identically, leaking equality information across files. It does not reveal the key, forge tags, or change ciphertext length behavior.

Question 41PKI / TLS / applied cryptography

A client validates a certificate chain and finds the leaf certificate's validity period has expired, but an OCSP responder reports the certificate as good. What should the client conclude?

  1. The client should retry until OCSP returns revoked
  2. The certificate is invalid because the validity period check fails independently Correct answer.
  3. The certificate is valid if the root is trusted
  4. The certificate is valid because OCSP overrides expiry

Explanation

Validity period and revocation status are separate checks, and a chain must satisfy all of them; a good OCSP response does not extend an expired certificate. Trust in the root and retry behavior do not change the expiry outcome.

Question 42PKI / TLS / applied cryptography

A mobile platform requires that an app's code signature chain terminate in a certificate issued by the platform vendor. What does this design primarily ensure?

  1. The app uses a specific TLS cipher suite
  2. The app's network traffic is encrypted
  3. The app's binary cannot be reverse engineered
  4. Only code approved through the vendor's issuance process is trusted to run Correct answer.

Explanation

Anchoring code-signing trust in a vendor-controlled CA means the platform accepts only binaries whose signatures chain to that authority, enforcing the vendor's review and distribution policy. It does not encrypt traffic, prevent reverse engineering, or select ciphers.

Question 43PKI / TLS / applied cryptography

A server operator wants to reduce the size of the handshake while still letting clients validate the chain. Which change accomplishes this without weakening validation?

  1. Omit unnecessary root and cross certificates from the sent chain Correct answer.
  2. Remove all intermediate certificates
  3. Switch to a weaker signature algorithm
  4. Disable OCSP stapling

Explanation

Clients already hold trust anchors, so sending the root is redundant; trimming redundant certificates shrinks the handshake while keeping the required intermediates. Removing intermediates breaks path building, and the other options reduce security rather than size.

Question 44PKI / TLS / applied cryptography

A signature scheme is implemented so that the same message and key always yield the same signature, and the scheme is proven secure only against key-only attacks. Which property is most clearly missing?

  1. Use of a hash function
  2. Existential unforgeability against adaptive chosen-message attacks Correct answer.
  3. Public key distribution
  4. Correctness of verification

Explanation

Deterministic signatures can still be secure, but a proof limited to key-only attacks does not cover an adversary who can request signatures on chosen messages. Correctness, hashing, and key distribution are separate concerns from the attack model.

Question 45PKI / TLS / applied cryptography

A TLS 1.2 deployment negotiates ECDHE_RSA. An attacker records the session and later compromises the server's RSA private key. What can the attacker recover?

  1. The session keys, because RSA signed the key exchange
  2. The client's private key
  3. The full plaintext of the recorded session
  4. Nothing about the session keys, because the ephemeral ECDHE secrets are gone Correct answer.

Explanation

With ephemeral ECDHE, session keys derive from one-time Diffie-Hellman secrets that are not stored, so later compromise of the long-term RSA signing key does not reveal past sessions. The RSA key signs the exchange but does not encrypt the premaster secret.

Question 46PKI / TLS / applied cryptography

A verifier checks a certificate whose signatureAlgorithm is ecdsa-with-SHA256, but the signature value is 64 bytes and the subject key is an RSA 2048-bit key. What is the correct interpretation?

  1. The certificate is malformed or inconsistent and must be rejected Correct answer.
  2. The signature is valid because ECDSA accepts any key size
  3. The signature should be verified with the RSA key using SHA-256
  4. The certificate is valid if the issuer name matches

Explanation

The signature algorithm must be consistent with the issuer's key type, and an ECDSA signature cannot be verified with an RSA key. A mismatch between algorithm identifier and key material indicates a malformed or malicious certificate that must be rejected.

Question 47PKI / TLS / applied cryptography

A protocol uses a Diffie-Hellman group where the peer's public value is not validated to lie in the correct prime-order subgroup. Which attack does this most directly enable?

  1. Certificate chain substitution
  2. Padding oracle decryption
  3. Small-subgroup confinement that leaks bits of the private exponent Correct answer.
  4. Downgrade to SSL 3.0

Explanation

If a peer value lies in a small subgroup, the shared secret reveals residue information about the private exponent modulo that subgroup order, allowing recovery across repeated interactions. Chain substitution, version downgrade, and padding oracles are separate classes of attack.

Question 48PKI / TLS / applied cryptography

A CA plans to issue certificates with nameConstraints permitting only the DNS subtree example.com. A subscriber requests a certificate for evil.example.com and another for example.org. What is the correct outcome under these constraints?

  1. Both names are permitted because they share a label
  2. example.org is permitted and evil.example.com is rejected
  3. Both names are rejected because constraints apply only to CAs
  4. evil.example.com is permitted and example.org is rejected Correct answer.

Explanation

A dNSName constraint of example.com permits subordinate names within that subtree, including evil.example.com, while example.org falls outside and must be rejected. Name constraints apply to names in certificates issued below the constrained CA.

Question 49PKI / TLS / applied cryptography

A developer stores an AES key in the mobile app binary and also uses the same key to encrypt all users' local files. Which combination of weaknesses is most significant?

  1. Absence of certificate pinning plus use of TLS 1.2
  2. Key extraction from the binary plus loss of per-user key separation Correct answer.
  3. Slow encryption performance plus large file sizes
  4. Lack of a MAC plus use of CBC mode

Explanation

A key shipped in the binary can be extracted by anyone with the app, and reusing it across users means one extraction compromises all data. Performance, file size, pinning, and TLS version are secondary or unrelated to this key management flaw.

Question 50PKI / TLS / applied cryptography

In an X.509 certificate, what does the Authority Key Identifier (AKI) extension primarily enable a relying party to do?

  1. Limit the depth of subordinate CAs that may appear below the issuer
  2. Bind the certificate to a specific DNS name controlled by the subject
  3. Record the revocation status of the certificate at the time of issuance
  4. Identify which CA key signed the certificate so the correct issuer certificate can be selected Correct answer.

Explanation

The Authority Key Identifier carries a value derived from the public key of the issuing CA, typically the key identifier of the CA certificate. A verifier uses it to choose the right issuer certificate when several exist for the same subject name, such as during CA key rollover. It does not constrain names, path length, or revocation.