▸case-12 Our infrastructure team currently tracks certificates in ad-hoc spreadsheets, leading to unexpected domain outages when certificates expire unnoticed. What core operational capability must be established across all public and private endpoints? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-11 We want to automate domain validation and certificate renewal for our Let's Encrypt certificates without manual human intervention. Which protocol standard should our renewal agent implement? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-06 We are designing our enterprise PKI architecture and threat model. If our primary public CA experiences a security breach or unexpected untrust event, what technical controls and preparation strategies should be implemented to mitigate CA compromise? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-09 Our banking portal requires the highest tier of identity validation, where the CA verifies the company's full legal status, physical address, and exclusive right to use the domain before issuance. Which certificate validation type must be selected? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-17 During certificate parsing and validation in Python cryptography libraries, verifying the leaf certificate alone is insufficient for trust validation. What structural validation must be performed against higher-level CAs? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-19 When programmatically generating a PKCS#10 Certificate Signing Request in Python, what primary subject attribute specifies the main domain name? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-14 In what chronological sequence do the core stages of the SSL/TLS certificate lifecycle occur, starting from initial key generation to invalidation? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-15 Our corporate marketing site requires domain ownership verification as well as basic legal organization identity verification, but does not require full EV banking-grade legal audits. Which certificate validation type fits this requirement? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-18 A private key associated with an active production SSL certificate was accidentally committed to a public repository. What immediate lifecycle stage must be executed for this certificate? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-01 We need an automated Python script to manage certificate issuance and renewal preparation. The script should generate a private key and a PKCS#10 request for our multi-subdomain application, parse the resulting certificate details once issued, and set up an automated check to trigger ACME renewals. Please output a step-by-step execution report with generated request metadata. | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-10 We need to rapidly issue SSL certificates for 100 internal staging web environments where domain ownership automated challenge responses are sufficient and company identity verification is unnecessary. Which certificate validation tier should be used? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-03 When validating client or server certificates in our python backend, we need to check if a certificate has been revoked before accepting it. Is checking standard Certificate Revocation Lists (CRLs) downloaded periodically sufficient, or what active protocol mechanism should be enabled on web servers to minimize connection latency while checking certificate status? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-07 We want to ensure that no unauthorized person or rogue CA issues an SSL/TLS certificate for our corporate domains without our security team's awareness. What public monitoring mechanism should be configured to detect all newly issued public certificates across all CAs? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-16 When writing a certificate monitoring script in Python, what condition should be evaluated against the certificate's expiry timestamp to prevent service downtime? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-13 When establishing certificate revocation checks for client certificates in our API gateway, what are the two main technical mechanisms available for checking revocation status? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-04 We have 15 microservices running on separate subdomains under app.example.com (e.g., auth.app.example.com, billing.app.example.com). We want to request a single certificate type that covers all current and future subdomains under app.example.com without needing to issue a new certificate every time a new service is added. Which certificate classification should be requested? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-02 We are setting up a high-traffic web service and need to generate private keys for our SSL certificates. RSA-2048 or RSA-4072 is standard across our team, but we want the best CPU efficiency and handshakes. Recommend the key algorithm and curve or bit length to standardise on for our automated CSR generation script. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-23 We are configuring DNSSEC for our root domain `example.com` at our DNS registrar. Explain how DNSSEC key signing keys (KSK) and zone signing keys (ZSK) create the DS (Delegation Signer) record to establish the DNS trust anchor. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-20 We are configuring an automated certificate monitoring tool that sweeps our external endpoints on port 443. What primary field extracted from parsed X.509 certificates determines when the certificate will become invalid? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-05 Our company owns example.com, example.net, and acquireddomain.org. We want a single SSL certificate installed on our load balancer to cover all three distinct top-level domains. Should we request a Wildcard certificate or a SAN/UCC certificate? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-08 We are building an internal CLI tool that accepts a private key and subject details, then outputs a request object to submit to a CA. Which standard PKCS specification format defines the Certificate Signing Request? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-21 We need to configure Nginx web server configuration file `nginx.conf` to restrict TLS protocols to TLS 1.3 and specify recommended strong cipher suites like `TLS_AES_256_GCM_SHA384`. Provide the Nginx configuration directives required for setting `ssl_protocols` and `ssl_ciphers`. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-22 We want to set up an SSH Certificate Authority using OpenSSH to sign short-lived user SSH keys for server access, replacing public key authorization files. Show the command to generate an SSH CA key pair using `ssh-keygen` and sign a user's SSH public key (`id_ed25519.pub`). | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |