▸case-01 We are configuring a Kubernetes cert-manager ClusterIssuer resource for our internal microservices hosted under `*.internal.company.local`. The team plans to use Let's Encrypt ACME with HTTP-01 challenge validation. Draft the Manifest configuration and explain if this setup works. | pass→pass | 18,011 | 16,635 | -8% | 1 | 1 | 0% | 2,710 | 3,234 | +19% | 0 | 0 | — |
▸case-02 We are configuring HashiCorp Vault PKI engine to establish an Intermediate CA that will issue subordinate CAs for downstream regional teams. A junior engineer suggested setting `max_path_length` to `0` in the CA certificate request configuration to minimize authority scope. Show the vault command payload to issue the intermediate CA and specify the correct parameter setting. | pass→pass | 23,040 | 13,689 | -41% | 1 | 1 | 0% | 3,690 | 2,711 | -27% | 0 | 0 | — |
▸case-03 Draft an OpenSSL configuration file (`openssl.cnf`) and CSR generation command for `api.example.com`. To keep the configuration minimal, put `api.example.com` only in the Common Name (`CN`) field and omit the `subjectAltName` extension. | fail→fail | 7,021 | 5,660 | -19% | 1 | 1 | 0% | 1,163 | 1,498 | +29% | 0 | 0 | — |
▸case-04 Our security team is setting up automated renewal rules in our certificate management agent for 90-day Let's Encrypt TLS certificates. The infrastructure team wants to schedule renewal at day 88 (2 days prior to expiration) so we do not waste certificate validity days. Evaluate this strategy and specify the recommended renewal window. | pass→pass | 12,685 | 19,253 | +52% | 1 | 1 | 0% | 2,096 | 3,034 | +45% | 0 | 0 | — |
▸case-05 We plan to issue X.509 certificates with the OCSP Must-Staple extension (`1.3.6.1.5.5.7.1.24`) enabled across our enterprise services. Describe what configuration changes are mandatory on front-end reverse proxies like Nginx before deploying these certificates. | pass→pass | 18,978 | 19,304 | +2% | 1 | 1 | 0% | 3,276 | 3,762 | +15% | 0 | 0 | — |
▸case-06 We are architecting a service mesh mTLS PKI. The platform engineer suggests issuing 365-day validity X.509 certificates to microservice workloads to reduce background renewal traffic. Provide the recommended lifetime practice for internal service mesh mTLS workloads. | pass→pass | 14,790 | 17,102 | +16% | 1 | 1 | 0% | 2,255 | 2,965 | +31% | 0 | 0 | — |
▸case-07 We are designing a certificate provisioning automation script. Should the central CA server generate both the RSA private key and public key, archive the private key in a database, and send the private key file over HTTPS to the target server? Provide the secure architecture pattern. | pass→pass | 19,729 | 22,127 | +12% | 1 | 1 | 0% | 2,846 | 3,069 | +8% | 0 | 0 | — |
▸case-08 In our Kubernetes cluster, cert-manager stores renewed TLS certificates and private keys in standard Kubernetes `Secret` resources. To simplify developer debugging, a team lead proposed granting cluster-wide `get` and `list` permissions on `Secrets` to all developer service accounts. Evaluate this RBAC policy and specify necessary security controls for TLS secret storage. | pass→pass | 21,187 | 28,179 | +33% | 1 | 1 | 0% | 3,496 | 4,551 | +30% | 0 | 0 | — |
▸case-09 We are selecting cryptographic key parameters for our new TLS 1.3 load balancers handling 50,000 requests/sec. A legacy system documentation suggests using RSA 1024-bit key pairs for fast handshake performance. Evaluate this recommendation against ECDSA P-256 and state the cryptographic standard. | pass→pass | 17,754 | 16,897 | -5% | 1 | 1 | 0% | 2,678 | 3,657 | +37% | 0 | 0 | — |
▸case-10 We are choosing an enterprise certificate enrollment protocol for automated device credential renewal across 10,000 corporate endpoints. Compare Simple Certificate Enrollment Protocol (SCEP) with Enrollment over Secure Transport (EST, RFC 7030) and recommend the modern standard. | pass→pass | 29,343 | 22,379 | -24% | 1 | 1 | 0% | 4,180 | 3,584 | -14% | 0 | 0 | — |
▸case-11 Our mobile client app makes 1,000 requests per minute to our API servers. The network engineer suggests forcing the mobile app to download the CA's complete Certificate Revocation List (CRL) file during every TLS handshake to check if the server cert is revoked. Evaluate this proposal and provide the proper high-performance revocation checking mechanism. | pass→pass | 18,024 | 22,110 | +23% | 1 | 1 | 0% | 2,815 | 3,918 | +39% | 0 | 0 | — |
▸case-12 We are configuring HashiCorp Vault PKI engine role for automated mTLS issuance. The role is intended to issue 24-hour certificates, but the engineer set `max_ttl` to `87600h` (10 years) on the role and disabled background storage cleanup. Explain the impact on Vault storage and specify the remediation steps. | pass→pass | 17,165 | 18,146 | +6% | 1 | 1 | 0% | 3,038 | 3,186 | +5% | 0 | 0 | — |
▸case-13 Our CISO wants to know if rogue or compromised Certificate Authorities issue unauthorized TLS certificates for our corporate domain `company.com`. Is inspecting our internal Nginx access logs sufficient to detect this? Provide the standard industry mechanism for detecting unauthorized public certificate issuance. | pass→pass | 15,533 | 19,629 | +26% | 1 | 1 | 0% | 2,493 | 3,848 | +54% | 0 | 0 | — |
▸case-14 Write a Prometheus alert rule using `x509_cert_expiry_seconds` metric to notify the on-call team. The team lead wants the alert condition set to `x509_cert_expiry_seconds - time() <= 0` so the team is only alerted once the certificate has fully expired. Evaluate this alert threshold and provide the corrected PromQL expression and policy. | pass→pass | 14,964 | 20,591 | +38% | 1 | 1 | 0% | 2,532 | 4,135 | +63% | 0 | 0 | — |
▸case-15 We are building an internal enterprise Public Key Infrastructure (PKI). The deployment script places the Root CA private key on a web server running a REST API that directly signs every application's leaf TLS certificate on demand. Analyze this architecture and describe the multi-tier CA best practice. | pass→pass | 17,204 | 18,828 | +9% | 1 | 1 | 0% | 2,930 | 3,737 | +28% | 0 | 0 | — |
▸case-16 To simplify certificate deployment, our infrastructure team copied the same `*.company.com` wildcard certificate and private key file onto 100 different application servers managed by different teams. Evaluate the security risk of this practice compared to automated individual certificate lifecycle management. | pass→pass | 23,358 | 27,152 | +16% | 1 | 1 | 0% | 3,289 | 4,088 | +24% | 0 | 0 | — |
▸case-17 Our automated certificate lifecycle agent attempts to issue a certificate for `api.example.com` from Let's Encrypt using ACME DNS-01 challenge. The DNS domain has a CAA record configured as `example.com. IN CAA 0 issue "digicert.com"`. The issuance fails with authorization error. Explain why the failure occurred and how to resolve it. | pass→pass | 11,513 | 13,680 | +19% | 1 | 1 | 0% | 2,112 | 2,566 | +21% | 0 | 0 | — |
▸case-18 We are configuring Kubernetes cert-manager to issue certificates using ZeroSSL's ACME endpoint, which requires External Account Binding (EAB) credentials (Key ID and HMAC Secret Key). Draft the `ClusterIssuer` YAML snippet showing how EAB fields are specified in cert-manager. | pass→pass | 7,621 | 11,252 | +48% | 1 | 1 | 0% | 1,477 | 2,212 | +50% | 0 | 0 | — |
▸case-19 Our mobile development team wants to pin the exact leaf TLS certificate SHA-256 public key hash in the Android and iOS app code, without any backup keys, while our certificate management system automatically rotates leaf certificates every 60 days. Evaluate this implementation. | pass→pass | 16,397 | 22,157 | +35% | 1 | 1 | 0% | 2,653 | 3,594 | +35% | 0 | 0 | — |
▸case-20 Draft a Kubernetes `cert-manager.io/v1` `Certificate` resource manifest for `web.example.com`. The junior admin set `usages` in the spec to `["code signing", "client auth"]` to test permissions. Correct the `usages` field for a TLS web server certificate. | pass→pass | 5,575 | 7,958 | +43% | 1 | 1 | 0% | 1,004 | 1,712 | +71% | 0 | 0 | — |
▸case-21 We are setting up mTLS client certificate verification on Nginx reverse proxy to authenticate API clients. An engineer configured `ssl_verify_client optional_no_ca;` and left `ssl_client_certificate` unconfigured. Correct this configuration to enforce client certificate validation against a specific internal CA bundle. | pass→pass | 10,209 | 14,227 | +39% | 1 | 1 | 0% | 1,943 | 2,333 | +20% | 0 | 0 | — |
▸case-22 Our automated certificate renewal agent successfully overwrites `/etc/ssl/certs/app.crt` and `app.key` when certificates are renewed. However, users still receive expired certificate warnings until the host reboot. Explain why this occurs and provide the necessary post-renewal hook configuration. | pass→pass | 12,740 | 16,164 | +27% | 1 | 1 | 0% | 2,114 | 3,137 | +48% | 0 | 0 | — |
▸case-23 We are performing a STRIDE threat modeling exercise for a web application's payment checkout flow. Can you identify the primary threat vectors for Spoofing and Tampering in the user authentication step and suggest mitigations? | pass→pass | 18,543 | 24,113 | +30% | 1 | 1 | 0% | 2,821 | 4,273 | +51% | 0 | 0 | — |
▸case-24 Our audit team needs to prepare evidence for SOC 2 Trust Services Criteria CC6.1 (Logical Access Security). What documentation and configuration evidence should we collect to demonstrate access control compliance? | pass→pass | 16,862 | 20,061 | +19% | 1 | 1 | 0% | 2,586 | 3,068 | +19% | 0 | 0 | — |
▸case-25 We are scoping a web application penetration test for an e-commerce platform. What key scoping parameters, rules of engagement, and target details must be defined before commencing the security assessment? | pass→pass | 19,502 | 16,929 | -13% | 1 | 1 | 0% | 2,476 | 1,864 | -25% | 0 | 0 | — |