Public Key Infrastructure (PKI) in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary purpose of a Certificate Authority (CA) in PKI?

In Public Key Infrastructure, what main role does a Certificate Authority (CA) serve?

A It issues digital certificates that verify the ownership of public keys.

B It encrypts all data transmitted over a network.

C It generates symmetric keys for secure communication.

D It stores private keys securely for all users.

💡 Hint

Think about who confirms that a public key belongs to a specific user or entity.

A Certificate Authority (CA) is trusted to issue digital certificates that prove a public key belongs to a particular entity. This helps others trust the key when communicating securely.

📋 Factual

intermediate

Which component in PKI holds the private key that must remain secret?

In Public Key Infrastructure, which part is responsible for keeping the private key confidential?

A The Certificate Authority (CA)

B The End User or Entity

C The Registration Authority (RA)

D The Public Directory

💡 Hint

Consider who actually owns the key pair and uses the private key to decrypt or sign data.

The end user or entity owns the private key and must keep it secret to maintain security. The CA issues certificates but does not hold private keys for users.

🔍 Analysis

advanced

What happens if a private key in PKI is compromised?

Analyze the consequences if an attacker gains access to a user's private key in a PKI system.

A The attacker can impersonate the user and decrypt messages meant for them.

B The attacker can only view public information but cannot decrypt messages.

C The attacker can revoke the user's digital certificate immediately.

D The attacker can generate new public keys for the user.

💡 Hint

Think about what private keys are used for in encryption and authentication.

If a private key is compromised, an attacker can decrypt confidential messages and impersonate the user by signing data as if they were the owner.

❓ Comparison

advanced

How does a Registration Authority (RA) differ from a Certificate Authority (CA) in PKI?

Compare the roles of a Registration Authority and a Certificate Authority in Public Key Infrastructure.

A RA encrypts data; CA decrypts data.

B RA issues certificates; CA stores private keys securely.

C RA verifies user identity before certificate issuance; CA issues the certificates.

D RA manages public keys; CA manages private keys.

💡 Hint

Consider which entity checks identity and which one actually creates the certificate.

The Registration Authority verifies the identity of users requesting certificates. The Certificate Authority then issues the digital certificates based on that verification.

❓ Reasoning

expert

Why is a Certificate Revocation List (CRL) important in PKI?

Explain the purpose of a Certificate Revocation List in Public Key Infrastructure and its impact on security.

A It stores all valid certificates issued by the CA.

B It encrypts all certificates to protect them from tampering.

C It contains private keys that have been compromised.

D It lists certificates that are no longer trustworthy, preventing their use.

💡 Hint

Think about what happens when a certificate should no longer be trusted.

A Certificate Revocation List (CRL) is a list maintained by the CA that contains certificates that have been revoked before their expiration. This helps systems avoid trusting compromised or invalid certificates.

Practice

1. What is the main purpose of Public Key Infrastructure (PKI)?

easy

A. To create firewalls for network security

B. To store passwords in a database

C. To securely exchange information using pairs of keys

D. To scan computers for viruses

Solution

1. Step 1: Understand PKI's role in security

   PKI uses pairs of keys (public and private) to encrypt and decrypt data, ensuring secure communication.

2. Step 2: Compare with other options

   Storing passwords, creating firewalls, and scanning for viruses are different security tasks unrelated to PKI.

3. Final Answer:

   To securely exchange information using pairs of keys -> Option C

4. Quick Check:

   PKI = Secure key pairs for communication [OK]

Hint: PKI = secure keys for safe communication [OK]

Common Mistakes:

• Confusing PKI with antivirus software
• Thinking PKI manages passwords directly
• Mixing PKI with firewall functions

2. Which of the following is the correct component of PKI?

easy

A. Firewall Manager

B. Password Vault

C. Antivirus Scanner

D. Certificate Authority (CA)

Solution

1. Step 1: Identify PKI components

   Certificate Authority (CA) issues digital certificates to verify identities in PKI.

2. Step 2: Eliminate unrelated options

   Firewall Manager, Antivirus Scanner, and Password Vault are security tools but not part of PKI.

3. Final Answer:

   Certificate Authority (CA) -> Option D

4. Quick Check:

   CA = PKI certificate issuer [OK]

Hint: CA issues certificates in PKI [OK]

Common Mistakes:

• Confusing CA with antivirus or firewall tools
• Thinking password vaults are PKI components

3. Consider this scenario: Alice wants to send a secret message to Bob using PKI. Which key does Alice use to encrypt the message?

medium

A. Bob's public key

B. Alice's private key

C. Bob's private key

D. Alice's public key

Solution

1. Step 1: Understand encryption in PKI

   In PKI, the sender encrypts the message using the receiver's public key so only the receiver can decrypt it.

2. Step 2: Identify correct key usage

   Alice uses Bob's public key to encrypt; Bob uses his private key to decrypt.

3. Final Answer:

   Bob's public key -> Option A

4. Quick Check:

   Encrypt with receiver's public key [OK]

Hint: Encrypt with receiver's public key [OK]

Common Mistakes:

• Using sender's keys for encryption
• Confusing public and private keys
• Encrypting with receiver's private key

4. A user tries to verify a digital certificate but gets an error. Which of these is the most likely cause?

medium

A. The certificate was not issued by a trusted Certificate Authority

B. The user's password is incorrect

C. The firewall is blocking the internet connection

D. The antivirus software is outdated

Solution

1. Step 1: Understand certificate verification

   Verification fails if the certificate is not from a trusted Certificate Authority (CA).

2. Step 2: Rule out unrelated causes

   Password errors, firewall issues, or antivirus updates do not directly cause certificate verification errors.

3. Final Answer:

   The certificate was not issued by a trusted Certificate Authority -> Option A

4. Quick Check:

   Untrusted CA causes verification error [OK]

Hint: Check if CA is trusted for certificate errors [OK]

Common Mistakes:

• Blaming password or firewall for certificate issues
• Ignoring the role of trusted CAs

5. An organization wants to ensure that their website visitors can trust their identity online. Which PKI component should they obtain and install?

hard

A. A private key stored on the visitor's device

B. A digital certificate issued by a trusted Certificate Authority

C. A firewall configured to block all incoming traffic

D. An antivirus program to scan visitor devices

Solution

1. Step 1: Identify how trust is established online

   Websites use digital certificates issued by trusted Certificate Authorities to prove their identity to visitors.

2. Step 2: Evaluate other options

   Private keys on visitor devices, firewalls, and antivirus programs do not establish website identity trust.

3. Final Answer:

   A digital certificate issued by a trusted Certificate Authority -> Option B

4. Quick Check:

   Trusted certificate = website identity trust [OK]

Hint: Get a trusted digital certificate for website trust [OK]

Common Mistakes:

• Thinking visitor devices hold website private keys
• Confusing firewalls or antivirus with identity proof