MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

1. What is the main purpose of a Certificate Revocation List (CRL) in cybersecurity?
   a. To publish newly issued certificates
   b. To list digital certificates that are no longer trusted
   c. To store private keys
   d. To manage public key transmission
   Answer: b. To list digital certificates that are no longer trustedtechtarget+2
2. Who is responsible for issuing a CRL?
   a. Certificate Authority (CA)
   b. Web Browser
   c. End User
   d. Network Gateway
   Answer: a. Certificate Authority (CA)emudhra+2
3. Which of the following is NOT included in a CRL?
   a. Revoked certificate serial numbers
   b. Certificates that have reached expiration
   c. Revocation reason codes
   d. The date of revocation
   Answer: b. Certificates that have reached expirationwikipedia+2
4. What cryptographic mechanism is used to ensure the authenticity of a CRL?
   a. Hash functions
   b. Digital signatures
   c. Symmetric encryption
   d. Checksum
   Answer: b. Digital signaturestechdocs.broadcom+1
5. Which field in a CRL identifies the revoked certificate?
   a. Public key
   b. Serial number
   c. Subject name
   d. Issuer name
   Answer: b. Serial numbercsrc.nist+1
6. If a certificate is added to the CRL, what does this imply about its trust status?
   a. It is more trustworthy
   b. It is suspended
   c. It should not be trusted
   d. It is active
   Answer: c. It should not be trustedssojet+2
7. Which method allows checking the status of a single certificate in real time, as a CRL alternative?
   a. DNSSEC
   b. OCSP
   c. HTTPS
   d. SMB
   Answer: b. OCSPsectigostore+2
8. What does the ‘Hold’ status in a CRL indicate?
   a. Permanent revocation
   b. Temporary invalidity
   c. Certificate expiration
   d. Invalid signature
   Answer: b. Temporary invaliditywikipedia
9. A certificate is most commonly revoked if:
   a. The public key is compromised
   b. The private key is compromised
   c. It reaches its expiration date
   d. The CA changes names
   Answer: b. The private key is compromisedtechtarget+2
10. Why do web browsers consult the CRL before establishing an HTTPS connection?
    a. To verify certificate validity
    b. To check for new certificates
    c. To validate DNS records
    d. To update CAs
    Answer: a. To verify certificate validitythesslstore+2
11. What kind of list does a CRL represent?
    a. Whitelist
    b. Blacklist
    c. Graylist
    d. Passlist
    Answer: b. Blacklistthesslstore+1
12. How does a user’s computer generally access a CRL?
    a. Receives it during HTTPS handshake
    b. Downloads it from CA repository
    c. Queries DNS server
    d. Receives it via email
    Answer: b. Downloads it from CA repositoryibm+1
13. Which type of digital certificate is affected by being placed on a CRL?
    a. Only expired certificates
    b. Only root certificates
    c. Any active certificate before expiration
    d. Only self-signed certificates
    Answer: c. Any active certificate before expirationcsrc.nist+1
14. What format is commonly used to encode CRL files?
    a. XML
    b. PEM/DER
    c. ZIP
    d. TXT
    Answer: b. PEM/DERemudhra+1
15. What is included in each CRL entry?
    a. Serial number and revocation date
    b. Issuer’s country
    c. Certificate’s private key
    d. End user’s password
    Answer: a. Serial number and revocation datecsrc.nist+1
16. What is the main security benefit of using a CRL?
    a. Hides server activity
    b. Prevents use of compromised certificates
    c. Encrypts all traffic
    d. Issues certificates automatically
    Answer: b. Prevents use of compromised certificatessecurew2+1
17. Where is the location of the CRL typically specified for a certificate?
    a. CRL Distribution Points (CDP) extension
    b. Subject Alternative Name
    c. Authority Key Identifier
    d. Basic Constraints
    Answer: a. CRL Distribution Points (CDP) extensionibm
18. Who decides to revoke a digital certificate?
    a. Internet Engineering Task Force
    b. Certificate Authority
    c. Internet Service Provider
    d. User’s operating system
    Answer: b. Certificate Authoritytechtarget+1
19. What happens if a user’s certificate appears on the CRL?
    a. User’s traffic is encrypted
    b. Certificate is not trusted for authentication
    c. User gains additional permissions
    d. Certificate is auto-renewed
    Answer: b. Certificate is not trusted for authenticationssojet+1
20. What component most often signs a CRL to ensure its authenticity?
    a. CA’s private key
    b. User’s password
    c. Web browser
    d. Network switch
    Answer: a. CA’s private keytechdocs.broadcom+1
21. Which protocol is typically used to distribute CRLs?
    a. DNS
    b. HTTP/LDAP
    c. SMTP
    d. FTP
    Answer: b. HTTP/LDAPtechdocs.broadcom+1
22. What is the primary difference between CRL and OCSP?
    a. CRL is always newer
    b. OCSP provides certificate status for individual certificates in real-time
    c. OCSP does not check revocation status
    d. CRL cannot be downloaded
    Answer: b. OCSP provides certificate status for individual certificates in real-timeemudhra+2
23. Which field in the CRL tells when it was last updated?
    a. lastUpdate
    b. nextCRL
    c. updateFrequency
    d. timeIssued
    Answer: a. lastUpdatecybrary
24. CA misissuance or a key compromise leads to what CRL action?
    a. Renewal of certificates
    b. Certificate revocation
    c. Password reset
    d. Timestamp update
    Answer: b. Certificate revocationssojet+1
25. What ensures that expired certificates are removed from a CRL?
    a. Manual check by administrators
    b. Automated expiry and removal
    c. User reporting
    d. Revocation by client
    Answer: b. Automated expiry and removaltechtarget
26. If a certificate’s owner has left the organization, what action might the CA take?
    a. Re-issue the same certificate
    b. Add the certificate to the CRL
    c. Ignore the certificate
    d. Transfer it to a new owner
    Answer: b. Add the certificate to the CRLssojet+1
27. Which cryptographic framework defines the CRL standard?
    a. X.500
    b. X.509
    c. PGP
    d. SHA-2
    Answer: b. X.509wikipedia+1
28. What must a relying party do with a CRL before trusting it?
    a. Check its digital signature
    b. Check the CRL’s size
    c. Recalculate the CA’s hash
    d. Check its CRL version
    Answer: a. Check its digital signaturetechdocs.broadcom+1
29. What could happen if CRL checks are skipped during certificate validation?
    a. Only valid certificates are accepted
    b. Revoked certificates may be trusted
    c. CA server is overloaded
    d. Certificates are deleted automatically
    Answer: b. Revoked certificates may be trustedsecurew2+2
30. Which of these is NOT a valid CRL update frequency?
    a. Hourly
    b. Daily
    c. Annually
    d. Weekly
    Answer: c. Annuallysectigostore+1
31. Why might a CRL temporarily have a certificate in ‘Hold’ status?
    a. The certificate is irreversibly revoked
    b. The owner may recover key control
    c. The CA changed its policy
    d. It’s a wildcard certificate
    Answer: b. The owner may recover key controlwikipedia
32. How does a browser use a CRL to check server certificate validity?
    a. Looks for the certificate’s serial number in the CRL
    b. Checks the certificate owner’s email
    c. Sends a request to the server
    d. Auto-updates all root certificates
    Answer: a. Looks for the certificate’s serial number in the CRLthesslstore+2
33. How are CRLs typically accessed in enterprise environments?
    a. Stored locally on each client
    b. Accessed via URLs in certificates
    c. Sent over SMS
    d. Delivered with every OS update
    Answer: b. Accessed via URLs in certificatesibm
34. What happens when a CA’s private key is compromised?
    a. All issued certificates may be revoked and listed in CRL
    b. Only the CA’s certificate is updated
    c. CRL is encrypted again
    d. Server avoids CRL checking
    Answer: a. All issued certificates may be revoked and listed in CRLtechtarget+1
35. What is the maximum lifetime of a CRL as specified by most standards?
    a. One year
    b. 7 days
    c. Defined by CA and use case
    d. 10 years
    Answer: c. Defined by CA and use casecybrary+1
36. A revoked certificate’s entry on a CRL will remain until:
    a. The certificate expires
    b. 24 hours
    c. The CA reissues it
    d. The user requests removal
    Answer: a. The certificate expireswikipedia+1
37. When verifying a certificate, what if the CRL is unavailable due to network issues?
    a. The certificate is always trusted
    b. The certificate validation may fail
    c. The user is auto-notified
    d. No action is taken
    Answer: b. The certificate validation may failmicrofocus+1
38. Compared to OCSP, CRL is:
    a. More resource efficient for many certificates
    b. Always faster
    c. Real-time
    d. Deprecated and unavailable
    Answer: a. More resource efficient for many certificatessectigostore
39. What should be done with a certificate whose owner ceases operations?
    a. Transfer ownership
    b. Revoke and list in CRL
    c. Issue a new public key
    d. Reset password
    Answer: b. Revoke and list in CRLssojet+1
40. Who defines the reason codes for certificate revocation?
    a. End users
    b. Certificate Authority
    c. Web browsers
    d. Search engines
    Answer: b. Certificate Authoritytechtarget+1
41. What does the CRL contain for each revoked certificate?
    a. Hash of the certificate
    b. Serial number and revocation date
    c. Expiration date only
    d. User’s CA password
    Answer: b. Serial number and revocation datecsrc.nist+1
42. For what kind of public key infrastructure is CRL essential?
    a. Symmetric key infrastructure
    b. No-key infrastructure
    c. Public Key Infrastructure (PKI)
    d. Blockchain
    Answer: c. Public Key Infrastructure (PKI)wikipedia+2
43. What protection can CRLs help provide against?
    a. Man-in-the-middle attacks
    b. Brute force password cracking
    c. SQL injection
    d. Cross-site scripting
    Answer: a. Man-in-the-middle attackstechtarget
44. Which entity can suspend a certificate and later reinstate it if necessary?
    a. Web browser
    b. Certificate Authority
    c. End user
    d. DNS registrar
    Answer: b. Certificate Authoritywikipedia
45. When a certificate is permanently invalid, what happens?
    a. Placed in CRL as revoked
    b. Deleted from CA
    c. Forwarded to new owner
    d. Marked as expired
    Answer: a. Placed in CRL as revokedssojet+1
46. If a certificate’s serial number does not appear in the CRL, what does it indicate?
    a. Certificate is definitely invalid
    b. Certificate is trustworthy (not revoked)
    c. Certificate is expired
    d. Certificate is root
    Answer: b. Certificate is trustworthy (not revoked)thesslstore+1
47. What type of revocation status can be ‘reversed’ in CRLs?
    a. Superseded
    b. Hold
    c. Unspecified
    d. KeyCompromise
    Answer: b. Holdwikipedia
48. Why is it important for CRLs to be regularly updated?
    a. To include new CAs
    b. To ensure revoked certificates are promptly listed
    c. To clean expired certificates from disk
    d. To update certificate algorithms
    Answer: b. To ensure revoked certificates are promptly listedcybrary+1
49. What is a major privacy advantage of CRLs over OCSP?
    a. No real-time queries reveal browsing habits
    b. CRLs require HTTPS
    c. CRLs are always smaller files
    d. OCSP is not industry compliant
    Answer: a. No real-time queries reveal browsing habitssmallstep
50. What baseline requirement is in place for CRL publication for public CAs?
    a. CRLs must be issued regularly as required by the CA/Browser Forum
    b. CRLs can be omitted at will
    c. Only root CAs provide CRLs
    d. End users publish CRLs themselves
    Answer: a. CRLs must be issued regularly as required by the CA/Browser Forumsmallstep+1

1. https://www.techtarget.com/searchsecurity/definition/Certificate-Revocation-List
2. https://en.wikipedia.org/wiki/Certificate_revocation_list
3. https://ssojet.com/blog/understanding-certificate-revocation-lists-crls-in-cybersecurity
4. https://emudhra.com/en/blog/certificate-revocation-list-crl
5. https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/network-policy-server-certificate-revocation-list-overview
6. https://csrc.nist.gov/glossary/term/certificate_revocation_list
7. https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/siteminder/12-8/configuring/policy-server-configuration/certificate-validation-for-x-509-client-certificate-authentication/certificate-revocation-list-validation.html
8. https://sectigostore.com/blog/ocsp-vs-crl-whats-the-difference/
9. https://emudhra.com/en/blog/ocsp-vs-crl
10. https://www.thesslstore.com/blog/ocsp-vs-crl-what-each-is-why-browsers-prefer-one-over-the-other/
11. https://www.thesslstore.com/blog/crl-explained-what-is-a-certificate-revocation-list/
12. https://www.ibm.com/docs/ssw_ibm_i_74/rzahu/rzahurzahucertrevlist.htm
13. https://www.keyfactor.com/blog/what-is-a-certificate-revocation-list-crl-vs-ocsp/
14. https://www.securew2.com/blog/certificate-revocation-crl-explained
15. https://smallstep.com/blog/ocsp-vs-crl-explained/
16. https://www.cybrary.it/blog/certification-expiration-and-revocation-list
17. https://docs.microfocus.com/NNMi/10.30/Content/Administer/NNMi_Deployment/Advanced_Configurations/Cert_Validation_CRL_and_OCSP.htm
18. https://emudhra.com/en-us/blog/certificate-revocation-list-crl
19. https://community.cisco.com/t5/security-knowledge-base/crl/ta-p/3113123
20. https://certera.com/blog/ocsp-vs-crl-know-the-difference/