PKI, DMZ & Proxy

Which of the following is Not classified as a Man in the Middle (MiTM) or Adversary-in-the-Middle (AiTM) attack?

• Wi-fi eavesdropping

• DNS spoofing

• Sender/Source spoofing

• SQL injection

Which of the following best describes Public Key Infrastructure (PKI)?

• A framework for enforcing single sign-on in enterprise networks

• A system of hardware, software, policies, and standards for managing digital certificates and public-key encryption

• A protocol designed to handle secure file transfers over the Internet

• A set of regulations requiring organizations to encrypt all email traffic

X.509 certificates typically contain which of the following pieces of information?

• The user’s password

• A private symmetric key

• The certificate owner’s public key

• The OCSP revocation list

In Certificate Authority (CA) hierarchies, the highest level of trust is usually assigned to:

• Subordinate CAs

• Intermediate CAs

• Root CAs

• Registration Authorities

OCSP (Online Certificate Status Protocol) is primarily used to:

• Issue new certificates on demand

• Revoke expired keys in real time

• Determine the revocation status of digital certificates

• Encrypt data transmitted between a client and server

DNS CAA (Certification Authority Authorization) records allow a domain owner to:

• Block Domain Name System lookups

• Authorize specific CAs to issue certificates for their domain

• Prevent domain hijacking through DNSSEC

• Configure custom SSL/TLS cipher suites

Non-web PKI implementations, such as S/MIME, are commonly used to:

• Secure email communications with digital signatures and encryption

• Replace all TLS connections in web browsers

• Validate the authenticity of DNS records

• Implement a web-of-trust for VoIP calls

In a Web of Trust (WoT) model, trust is primarily built through:

• Central certificate authorities issuing all credentials

• Individuals signing each other’s public keys

• Government-issued identities integrated into a PKI hierarchy

• A single, globally recognized root CA

A Demilitarized Zone (DMZ) in network security is best described as:

• A protected area of the network where only internal traffic is allowed

• A buffer network segment between an internal network and untrusted external networks

• An encrypted network used for storing backups

• A legacy method of forwarding traffic without inspection

Squid Proxy is an example of:

• A network device for creating virtualization containers

• A caching and forwarding web proxy server

• An encrypted tunnel for secure remote access

• A zero-trust network access solution