SkillTestPro | CCNP Security 350-701 SCOR Practice Test 2

CCNP Security 350-701 SCOR Practice Test 2 (Hard) - PKI and Digital Certificates

CISCO CCNP Security Exam Logo

1 / 10

Which entity in a Public Key Infrastructure (PKI) is responsible for issuing and digitally signing certificates, vouching for the identity bound to a public key?

A DNS resolver

A DHCP server

A Certificate Authority (CA)

A syslog server

A NetFlow collector

A NAT gateway

2 / 10

Which PKI mechanism allows a relying party to check, in real time, whether a specific certificate has been revoked before its expiration date?

Online Certificate Status Protocol (OCSP)

Border Gateway Protocol (BGP)

Simple Network Management Protocol (SNMP)

Network Time Protocol (NTP)

Dynamic Host Configuration Protocol (DHCP)

Internet Group Management Protocol (IGMP)

3 / 10

A client browser presents a TLS certificate chain during a connection. Which certificate in that chain, if untrusted by the client's trust store, would cause the entire chain of trust to fail validation?

The web server's HTTP response status code

The web server's own private key file, which is never transmitted

The root Certificate Authority (CA) certificate at the top of the chain

The client's local DNS cache entry for the domain

The client's default gateway's MAC address

The client's system clock's display format setting

4 / 10

Which field within an X.509 digital certificate specifies the domain name(s) the certificate is valid for, which modern browsers rely on for hostname validation?

The certificate's serial number field only

The certificate's color-coded validation badge

The certificate's file size in bytes

The Subject Alternative Name (SAN) field

The issuing CA's physical mailing address field

The certificate's signature algorithm identifier only

5 / 10

Which PKI concept ensures that even if a server's long-term private key is later compromised, previously captured encrypted session traffic cannot be decrypted retroactively?

Self-signed certificate generation

Key escrow

Perfect Forward Secrecy (PFS)

Certificate pinning

Certificate transparency logging

Wildcard certificate issuance

6 / 10

An organization deploys an internal PKI for machine-to-machine authentication within its own data center, using a privately trusted root CA rather than a public CA. What is the primary tradeoff of this approach?

A private CA eliminates the need for any certificate revocation mechanism

Internal certificates cannot be used for TLS encryption at all

Internal PKI certificates are mathematically weaker than any publicly issued certificate, but typically only once corroborated by a second, independent verification step

Private CAs are illegal to operate under any circumstances

Internal certificates will not be automatically trusted by external clients or systems outside the organization, requiring explicit trust store distribution

A private root CA cannot issue certificates with a valid expiration date

7 / 10

Which action would a Certificate Authority take in response to discovering that a certificate's associated private key had been compromised, prior to the certificate's natural expiration?

Change the certificate's font rendering in browsers

Transfer the compromised private key to a new, unrelated domain

Revoke the certificate and publish that revocation via a CRL or OCSP responder

Ignore the compromise since certificates cannot be revoked once issued, a nuance that varies depending on how recently the relevant standard was updated

Automatically extend the certificate's validity period as compensation

Delete all records of the certificate ever having existed

8 / 10

Which PKI deployment model would be most appropriate for a large enterprise wanting to delegate certificate issuance for different business units while maintaining a single ultimate trust anchor?

A hierarchical PKI with a root CA and one or more subordinate (intermediate) CAs

A model that eliminates the concept of a trust anchor entirely

A model where certificates never expire under any configuration

A model requiring every device to generate and self-sign its own certificate independently

A model that relies solely on DNS TXT records instead of X.509 certificates

A flat model with no CA hierarchy of any kind

9 / 10

Which certificate validation failure would occur if a client's system clock were set significantly in the future, beyond a certificate's actual expiration date, even though the certificate was valid at the time of issuance?

The client's incorrect clock would have no effect on certificate validation whatsoever, though this depends heavily on which specific vendor implementation is deployed, a determination that several security frameworks treat as a secondary consideration

The certificate authority would be notified and issue a new root certificate

TLS negotiation would ignore all date-based fields in the certificate

The certificate would automatically renew itself using the client's incorrect clock

The certificate would appear expired to the client and validation would fail, even though it is genuinely still within its intended validity window from the server's perspective

The server would automatically detect and correct the client's clock

10 / 10

Which practice most directly reduces the risk that a compromised intermediate CA could be used to issue fraudulent certificates trusted by clients, without immediate detection?

Disabling all certificate revocation checking entirely

Using only self-signed certificates for every public-facing service

Implementing and monitoring Certificate Transparency (CT) logs to detect unexpected or unauthorized certificate issuance

Publishing the intermediate CA's private key publicly for transparency, under the organization's default security policy before any custom tuning is applied

Removing the root CA from all client trust stores

Extending every certificate's validity period to 50 years

Your score is

The average score is 0%