ITPEC FE Subject B April 2024 Question 18

Topic: Security Scenarios

From the answer group below, select the most appropriate combination of answers to be inserted into A through C in Table 1.

Company X is a small trading company. The company is about to provide a new e-commerce web site for customers to make purchases online. The company will also hosts its own email service for the employees to conduct business with partners and customers. Company X will utilize public key infrastructure (PKI) to provide security for both the web server and email service. PKI uses public key cryptography to manage the identity of servers or persons and is widely used on the Internet.

Mr. T, the IT support person of company X is assigned to prepare the web server and email service in accordance with the following requirements:

  • •The e-commerce web application will run on the web server that is certified by a third-party certification authority. All connections to the web server will be secured using HTTPS.
  • •The staff directory along with the contact information will be published on the web site to enable business partners and customers to use the information to securely communicate with employees of company X.

The actions taken by Mr. T are shown in Table 1.

Table 1 Actions taken by Mr. T

NoAction
1To enable secure and trusted connections to the web server, Mr. T submits the web server certificate along with the A to the third-party certification authority. The certification authority signs the certificate with its own private key. Then, he installs the signed certificate on company X’s web server.
2To allow business partners and customers to send encrypted email messages to particular contacts in company X, Mr. T publishes the B along with the employee’s information in the staff directory on company X’s web site.
3To send digitally signed email messages to partners and customers, the employees of company X are required to install the C on their email clients. Therefore, Mr. T provides support to the employees who require assistance.

Answer group

OptionABC

Explanation

A: web server's public key, B: employees' public key, C: employee's private key — public keys go out to be certified or published; private keys stay with their owner and do the signing.

  • •Action 1: a certificate binds the server's identity to its public key. The server sends that public key to the CA, which signs the certificate with the CA's own private key. The server's private key never leaves the server.
  • •Action 2: to encrypt a message for an employee, the sender needs the recipient's public key, and only the employee's private key can decrypt it. So the directory publishes employees' public keys.
  • •Action 3: a digital signature is made with the signer's own private key and checked by others with the matching public key, so each employee installs their own private key in the email client.

Answer (f)

Why not others:

  • •(a), (b) and (c) — send the web server's private key to the CA and publish employees' private keys on the web site; a published private key lets anyone read the employee's encrypted mail and forge the employee's signature
  • •(c) — also installs a public key for signing, but a public key can only encrypt or verify
  • •(d) — C as customers' private key: employees cannot hold customers' private keys, and a signature must use the sender's own key
  • •(e) — C as customers' public key: a public key cannot sign, and it belongs to the wrong party

Key rule: Encrypt with the recipient's public key, sign with the sender's private key, and never send a private key to anyone, a CA included.

Security Scenarios · AI-written, may contain errors

Practice this exam

This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.