1. Which protocol is primarily used for encrypting web traffic?
🔘 A) SSH
🔘 B) SSL/TLS
🔘 C) PGP
🔘 D) HTTP
✅ Answer: B) SSL/TLS
💡 Explanation: SSL/TLS (Secure Sockets Layer/Transport Layer Security) is used to secure web traffic by encrypting data between the client and server.
2. What port does SSH typically run on by default?
🔘 A) 22
🔘 B) 443
🔘 C) 25
🔘 D) 80
✅ Answer: A) 22
💡 Explanation: SSH (Secure Shell) operates on port 22 by default, providing secure remote login and command execution.
3. Which encryption technique is used in SSL/TLS for key exchange?
🔘 A) AES
🔘 B) RSA
🔘 C) MD5
🔘 D) SHA-256
✅ Answer: B) RSA
💡 Explanation: RSA (Rivest-Shamir-Adleman) is commonly used in SSL/TLS to securely exchange encryption keys between parties.
4. What does PGP stand for?
🔘 A) Pretty Good Privacy
🔘 B) Perfect Global Protection
🔘 C) Private Gateway Protocol
🔘 D) Public Group Policy
✅ Answer: A) Pretty Good Privacy
💡 Explanation: PGP (Pretty Good Privacy) is used for securing emails and files through encryption and digital signatures.
5. What is the primary use of PGP?
🔘 A) Encrypting web traffic
🔘 B) Securing remote logins
🔘 C) Encrypting and signing emails
🔘 D) Protecting Wi-Fi networks
✅ Answer: C) Encrypting and signing emails
💡 Explanation: PGP is widely used for encrypting emails and digitally signing messages to ensure confidentiality and authenticity.
6. Which cryptographic method does SSH use for authentication?
🔘 A) Symmetric encryption
🔘 B) Public-key cryptography
🔘 C) Hashing
🔘 D) Quantum cryptography
✅ Answer: B) Public-key cryptography
💡 Explanation: SSH uses public-key cryptography for authentication, allowing secure access using key pairs.
7. Which version of TLS is considered insecure and deprecated?
🔘 A) TLS 1.2
🔘 B) TLS 1.3
🔘 C) TLS 1.0
🔘 D) TLS 2.0
✅ Answer: C) TLS 1.0
💡 Explanation: TLS 1.0 has several known vulnerabilities and has been deprecated in favor of TLS 1.2 and TLS 1.3.
8. What command is used to initiate an SSH connection in Linux?
🔘 A) connect-ssh
🔘 B) ssh user@hostname
🔘 C) start ssh
🔘 D) ssh-keygen
✅ Answer: B) ssh user@hostname
💡 Explanation: The ssh command is used to connect to a remote server securely.
9. Which layer of the OSI model does SSL/TLS operate at?
🔘 A) Network layer
🔘 B) Transport layer
🔘 C) Application layer
🔘 D) Data link layer
✅ Answer: B) Transport layer
💡 Explanation: SSL/TLS operates at the transport layer to provide encryption for higher-layer protocols like HTTP.
10. What is the primary purpose of TLS Handshake?
🔘 A) Encrypting all data during transmission
🔘 B) Authenticating the server and client and negotiating encryption parameters
🔘 C) Checking for network latency
🔘 D) Detecting malware
✅ Answer: B) Authenticating the server and client and negotiating encryption parameters
💡 Explanation: The TLS handshake is a process where cryptographic keys and encryption methods are agreed upon before secure communication begins.
11. What does an SSH private key provide?
🔘 A) Public authentication
🔘 B) Secure decryption and authentication
🔘 C) Hashing only
🔘 D) Symmetric key exchange
✅ Answer: B) Secure decryption and authentication
💡 Explanation: The SSH private key is used to decrypt data and authenticate securely.
12. Which protocol replaced SSL due to its security flaws?
🔘 A) SSH
🔘 B) PGP
🔘 C) TLS
🔘 D) HTTPS
✅ Answer: C) TLS
💡 Explanation: TLS (Transport Layer Security) replaced SSL due to vulnerabilities like POODLE and BEAST attacks.
13. What is Forward Secrecy in TLS?
🔘 A) A method for passwordless authentication
🔘 B) A feature that ensures past communications remain secure even if keys are compromised
🔘 C) A cryptographic hashing method
🔘 D) A method for faster SSL handshakes
✅ Answer: B) A feature that ensures past communications remain secure even if keys are compromised
💡 Explanation: Forward Secrecy prevents previously captured encrypted data from being decrypted if private keys are later exposed.
14. What type of encryption does SSH use?
🔘 A) Only symmetric encryption
🔘 B) Only asymmetric encryption
🔘 C) A combination of symmetric and asymmetric encryption
🔘 D) No encryption
✅ Answer: C) A combination of symmetric and asymmetric encryption
💡 Explanation: SSH uses asymmetric encryption for authentication and symmetric encryption for session encryption.
15. What does a TLS certificate contain?
🔘 A) A public key and a private key
🔘 B) A public key, domain name, and certificate authority signature
🔘 C) Only the private key
🔘 D) A list of all visited websites
✅ Answer: B) A public key, domain name, and certificate authority signature
💡 Explanation: A TLS certificate contains a public key, the domain name, and a CA signature for authenticity.
16. What is the primary risk of using self-signed TLS certificates?
🔘 A) They are expensive
🔘 B) They may not be trusted by browsers
🔘 C) They cannot be revoked
🔘 D) They use weak encryption
✅ Answer: B) They may not be trusted by browsers
💡 Explanation: Self-signed certificates are not verified by trusted Certificate Authorities (CAs) and may trigger security warnings.
17. What is the primary function of the SSH agent?
🔘 A) Generate SSH keys
🔘 B) Store decrypted private keys securely in memory
🔘 C) Encrypt SSH traffic
🔘 D) Manage SSL certificates
✅ Answer: B) Store decrypted private keys securely in memory
💡 Explanation: The SSH agent stores decrypted private keys so users don’t have to re-enter passphrases frequently.
18. What is the default port for HTTPS (SSL/TLS-secured web traffic)?
🔘 A) 80
🔘 B) 22
🔘 C) 443
🔘 D) 53
✅ Answer: C) 443
💡 Explanation: HTTPS (secured via SSL/TLS) runs on port 443.
19. Which algorithm is commonly used in PGP for symmetric encryption?
🔘 A) AES
🔘 B) RSA
🔘 C) SHA-256
🔘 D) MD5
✅ Answer: A) AES
💡 Explanation: PGP uses AES (Advanced Encryption Standard) for symmetric encryption.
20. What does the “S” in HTTPS stand for?
🔘 A) Secure
🔘 B) Server
🔘 C) SSH
🔘 D) Session
✅ Answer: A) Secure
💡 Explanation: HTTPS stands for HyperText Transfer Protocol Secure, indicating that SSL/TLS secures the connection.
21. What is the primary purpose of SSH tunneling?
🔘 A) Encrypting website traffic
🔘 B) Securely forwarding network traffic through an encrypted channel
🔘 C) Generating PGP keys
🔘 D) Signing TLS certificates
✅ Answer: B) Securely forwarding network traffic through an encrypted channel
💡 Explanation: SSH tunneling (port forwarding) securely routes network traffic through an encrypted SSH connection.
22. Which hashing algorithm is commonly used for message integrity in TLS?
🔘 A) SHA-256
🔘 B) MD5
🔘 C) Blowfish
🔘 D) RC4
✅ Answer: A) SHA-256
💡 Explanation: SHA-256 is widely used for ensuring message integrity in TLS communication.
23. What does HSTS (HTTP Strict Transport Security) do?
🔘 A) Enforces HTTPS connections
🔘 B) Encrypts email messages
🔘 C) Secures SSH logins
🔘 D) Strengthens PGP encryption
✅ Answer: A) Enforces HTTPS connections
💡 Explanation: HSTS ensures that browsers always use HTTPS for a website, preventing downgrade attacks.
24. What does the openssl s_client command do?
🔘 A) Establishes an encrypted SSH session
🔘 B) Tests SSL/TLS connections to a server
🔘 C) Generates SSH key pairs
🔘 D) Encrypts files with PGP
✅ Answer: B) Tests SSL/TLS connections to a server
💡 Explanation: The openssl s_client command checks TLS/SSL certificates and configurations of remote servers.
25. What key size is considered secure for SSH key pairs?
🔘 A) 512-bit
🔘 B) 1024-bit
🔘 C) 2048-bit or higher
🔘 D) 128-bit
✅ Answer: C) 2048-bit or higher
💡 Explanation: 2048-bit or higher (e.g., 4096-bit) RSA keys are recommended for strong SSH security.
26. What is a wildcard SSL certificate?
🔘 A) A certificate that can be used for multiple domains
🔘 B) A certificate used for a single subdomain
🔘 C) A self-signed certificate
🔘 D) A certificate with unlimited validity
✅ Answer: A) A certificate that can be used for multiple domains
💡 Explanation: Wildcard SSL certificates secure a domain and all its subdomains (e.g., *.example.com).
27. Which attack exploits the SSL/TLS renegotiation process?
🔘 A) POODLE
🔘 B) Heartbleed
🔘 C) BEAST
🔘 D) Triple Handshake Attack
✅ Answer: D) Triple Handshake Attack
💡 Explanation: The Triple Handshake Attack exploits session renegotiation in TLS, allowing MITM attacks.
28. What is the primary goal of the SSH protocol?
🔘 A) Secure email transmission
🔘 B) Encrypt web traffic
🔘 C) Secure remote administration and file transfers
🔘 D) Secure database queries
✅ Answer: C) Secure remote administration and file transfers
💡 Explanation: SSH is used to remotely manage systems and transfer files securely.
29. What does OCSP (Online Certificate Status Protocol) check?
🔘 A) If an SSL certificate is revoked
🔘 B) If SSH keys are compromised
🔘 C) If a website supports HTTPS
🔘 D) If a TLS handshake is completed
✅ Answer: A) If an SSL certificate is revoked
💡 Explanation: OCSP checks whether an SSL/TLS certificate has been revoked by the issuing CA.
30. Which cryptographic method does SSH use for secure key exchange?
🔘 A) Diffie-Hellman
🔘 B) RSA
🔘 C) MD5
🔘 D) ECC
✅ Answer: A) Diffie-Hellman
💡 Explanation: SSH uses Diffie-Hellman key exchange to securely establish a session key.
31. What does a Certificate Authority (CA) do?
🔘 A) Issues digital certificates
🔘 B) Manages SSH logins
🔘 C) Encrypts TLS traffic
🔘 D) Stores SSL keys
✅ Answer: A) Issues digital certificates
💡 Explanation: CAs issue SSL/TLS certificates that verify a website’s authenticity.
32. Which protocol secures email communication using PGP?
🔘 A) SMTP
🔘 B) OpenPGP
🔘 C) IMAP
🔘 D) POP3
✅ Answer: B) OpenPGP
💡 Explanation: OpenPGP is an encryption standard used for securing emails.
33. What does the “Perfect” in Perfect Forward Secrecy (PFS) mean?
🔘 A) Data is encrypted with a perfect algorithm
🔘 B) No past session keys can be compromised
🔘 C) It guarantees 100% security
🔘 D) Only quantum-resistant encryption is used
✅ Answer: B) No past session keys can be compromised
💡 Explanation: PFS ensures that past encrypted data cannot be decrypted even if private keys are compromised.
34. Which attack exploits SSL/TLS padding vulnerabilities?
🔘 A) POODLE
🔘 B) CRIME
🔘 C) BEAST
🔘 D) FREAK
✅ Answer: A) POODLE
💡 Explanation: POODLE (Padding Oracle On Downgraded Legacy Encryption) exploits SSL 3.0 padding vulnerabilities.
35. What is the purpose of SSH-Agent?
🔘 A) Store private keys securely in memory
🔘 B) Generate SSH keys
🔘 C) Manage SSL certificates
🔘 D) Encrypt web traffic
✅ Answer: A) Store private keys securely in memory
💡 Explanation: SSH-Agent caches decrypted SSH private keys, so users don’t need to re-enter passphrases.
36. What is the primary function of TLS session resumption?
🔘 A) Reduce handshake time
🔘 B) Generate new certificates
🔘 C) Encrypt email communication
🔘 D) Detect revoked certificates
✅ Answer: A) Reduce handshake time
💡 Explanation: TLS session resumption allows a client to reconnect faster by skipping a full handshake.
37. What attack does HSTS help mitigate?
🔘 A) SSL stripping
🔘 B) Heartbleed
🔘 C) Man-in-the-middle (MITM)
🔘 D) BEAST
✅ Answer: A) SSL stripping
💡 Explanation: HSTS ensures browsers only use HTTPS, preventing SSL stripping attacks.
38. Which protocol ensures encrypted file transfer over SSH?
🔘 A) FTP
🔘 B) SCP
🔘 C) HTTP
🔘 D) Telnet
✅ Answer: B) SCP
💡 Explanation: SCP (Secure Copy Protocol) uses SSH for encrypted file transfers.
39. What is the purpose of the “TLS Record Protocol”?
🔘 A) Encrypts data for secure transmission
🔘 B) Manages SSL certificates
🔘 C) Checks server uptime
🔘 D) Generates encryption keys
✅ Answer: A) Encrypts data for secure transmission
💡 Explanation: The TLS Record Protocol ensures data confidentiality and integrity.
40. What is an SSH bastion host used for?
🔘 A) Securely managing remote access
🔘 B) Encrypting email communication
🔘 C) Generating PGP keys
🔘 D) Managing TLS handshakes
✅ Answer: A) Securely managing remote access
💡 Explanation: A bastion host is an exposed SSH server that acts as a secure gateway.
41. What is the primary function of an SSH fingerprint?
🔘 A) To encrypt SSH traffic
🔘 B) To verify the authenticity of an SSH server
🔘 C) To generate new SSH keys
🔘 D) To prevent brute-force attacks
✅ Answer: B) To verify the authenticity of an SSH server
💡 Explanation: An SSH fingerprint is a cryptographic hash of the server’s public key, used to verify its authenticity during connections.
42. What is a TLS Cipher Suite?
🔘 A) A collection of encryption algorithms used in TLS communication
🔘 B) A type of VPN protocol
🔘 C) A physical hardware security device
🔘 D) A hashing algorithm
✅ Answer: A) A collection of encryption algorithms used in TLS communication
💡 Explanation: A TLS Cipher Suite defines the encryption, hashing, and authentication algorithms used in a TLS session.
43. What type of attack does SSH key-based authentication help mitigate?
🔘 A) Brute-force password attacks
🔘 B) Cross-Site Scripting (XSS)
🔘 C) SQL Injection
🔘 D) Man-in-the-Middle (MITM)
✅ Answer: A) Brute-force password attacks
💡 Explanation: SSH key-based authentication replaces passwords with cryptographic keys, preventing brute-force attacks.
44. What does the term “TLS fallback attack” refer to?
🔘 A) Forcing a connection to downgrade to a weaker TLS version
🔘 B) Cracking the TLS encryption key
🔘 C) Breaking a digital certificate
🔘 D) Forcing a session timeout
✅ Answer: A) Forcing a connection to downgrade to a weaker TLS version
💡 Explanation: A TLS fallback attack exploits protocol downgrades (e.g., forcing TLS 1.2 to use TLS 1.0), making it easier to exploit known vulnerabilities.
45. What does PGP use for key management?
🔘 A) Key pairs stored in a certificate authority
🔘 B) A web of trust model
🔘 C) A centralized key server
🔘 D) A blockchain-based trust system
✅ Answer: B) A web of trust model
💡 Explanation: PGP uses a web of trust, where users sign each other’s keys to establish credibility, unlike centralized CAs.
46. Which of the following is an open-source alternative to SSH?
🔘 A) Telnet
🔘 B) PuTTY
🔘 C) OpenSSH
🔘 D) SSL
✅ Answer: C) OpenSSH
💡 Explanation: OpenSSH is a free, open-source implementation of the SSH protocol used for secure remote administration.
47. What is the purpose of a self-signed TLS certificate?
🔘 A) To provide free, unlimited encryption
🔘 B) To secure internal applications without a Certificate Authority (CA)
🔘 C) To ensure global trust in a website
🔘 D) To enhance key rotation speed
✅ Answer: B) To secure internal applications without a Certificate Authority (CA)
💡 Explanation: Self-signed TLS certificates are typically used for internal servers and testing environments but are not trusted by default in browsers.
48. What is the default bit length for a modern SSH RSA key?
🔘 A) 512-bit
🔘 B) 1024-bit
🔘 C) 2048-bit
🔘 D) 4096-bit
✅ Answer: C) 2048-bit
💡 Explanation: The default RSA key length for SSH is 2048-bit, but 4096-bit is recommended for enhanced security.
49. What does Certificate Pinning help prevent?
🔘 A) Phishing attacks
🔘 B) Man-in-the-Middle (MITM) attacks with fraudulent certificates
🔘 C) Cross-Site Request Forgery (CSRF)
🔘 D) SQL Injection
✅ Answer: B) Man-in-the-Middle (MITM) attacks with fraudulent certificates
💡 Explanation: Certificate Pinning ensures only a specific certificate is trusted, preventing MITM attacks with rogue CAs.
50. What is the role of an SSH bastion host?
🔘 A) To act as a secure gateway for remote access
🔘 B) To generate TLS certificates
🔘 C) To encrypt TLS handshakes
🔘 D) To validate SSL certificates
✅ Answer: A) To act as a secure gateway for remote access
💡 Explanation: An SSH bastion host is a hardened server used as a jump host to access internal systems securely.
51. Which TLS version introduced 0-RTT (Zero Round-Trip Time) mode?
🔘 A) TLS 1.0
🔘 B) TLS 1.1
🔘 C) TLS 1.2
🔘 D) TLS 1.3
✅ Answer: D) TLS 1.3
💡 Explanation: TLS 1.3 introduced 0-RTT, allowing faster connections by reusing previously established sessions.
52. What is SSH X11 forwarding used for?
🔘 A) To transfer files securely
🔘 B) To run graphical applications over SSH
🔘 C) To increase SSH encryption strength
🔘 D) To verify SSH fingerprints
✅ Answer: B) To run graphical applications over SSH
💡 Explanation: SSH X11 forwarding allows users to run GUI applications remotely over SSH.
53. What does a wildcard TLS certificate secure?
🔘 A) A single domain
🔘 B) Multiple top-level domains
🔘 C) A domain and all of its subdomains
🔘 D) Only IP-based connections
✅ Answer: C) A domain and all of its subdomains
💡 Explanation: A wildcard certificate (e.g., *.example.com) secures all subdomains under a primary domain.
54. What command is used to generate a new SSH key pair?
🔘 A) ssh-keygen
🔘 B) ssh-add
🔘 C) ssh-copy-id
🔘 D) openssl keygen
✅ Answer: A) ssh-keygen
💡 Explanation: The ssh-keygen command generates a new SSH key pair for authentication.
55. What does TLS use to prevent replay attacks?
🔘 A) Nonces and sequence numbers
🔘 B) RSA encryption
🔘 C) Certificate Pinning
🔘 D) HSTS
✅ Answer: A) Nonces and sequence numbers
💡 Explanation: TLS uses nonces and sequence numbers to prevent replay attacks, ensuring messages aren’t duplicated.
56. What type of attack was exploited in the Heartbleed vulnerability?
🔘 A) Buffer overflow in OpenSSL’s Heartbeat extension
🔘 B) Man-in-the-Middle (MITM) attack
🔘 C) TLS handshake manipulation
🔘 D) SSH brute force
✅ Answer: A) Buffer overflow in OpenSSL’s Heartbeat extension
💡 Explanation: Heartbleed exploited a buffer overflow in OpenSSL, allowing attackers to read sensitive memory data.
57. What does SSH use for integrity checking?
🔘 A) HMAC
🔘 B) AES
🔘 C) RSA
🔘 D) Diffie-Hellman
✅ Answer: A) HMAC
💡 Explanation: SSH uses HMAC (Hash-based Message Authentication Code) to verify data integrity.
58. What does TLS use for message confidentiality?
🔘 A) Symmetric encryption
🔘 B) Hashing
🔘 C) Public key encryption only
🔘 D) Salting
✅ Answer: A) Symmetric encryption
💡 Explanation: TLS uses symmetric encryption (e.g., AES) for message confidentiality.
61. What is the primary purpose of TLS mutual authentication?
🔘 A) To encrypt data using symmetric keys
🔘 B) To authenticate both the server and client using certificates
🔘 C) To enable certificate pinning
🔘 D) To establish an anonymous connection
✅ Answer: B) To authenticate both the server and client using certificates
💡 Explanation: TLS mutual authentication requires both the client and server to present valid certificates for identity verification.
62. What command is used to check the fingerprint of an SSH key?
🔘 A) ssh -V
🔘 B) ssh-keygen -lf keyfile
🔘 C) openssl check
🔘 D) tls-fingerprint
✅ Answer: B) ssh-keygen -lf keyfile
💡 Explanation: The ssh-keygen -lf command displays the fingerprint of an SSH public key.
63. What is the maximum bit length for an RSA key in OpenSSH?
🔘 A) 4096-bit
🔘 B) 8192-bit
🔘 C) 1024-bit
🔘 D) 16384-bit
✅ Answer: D) 16384-bit
💡 Explanation: OpenSSH supports RSA key lengths up to 16,384 bits, though 4096-bit is commonly used for security and performance.
64. What does the “G” in GPG stand for?
🔘 A) Government
🔘 B) GNU
🔘 C) General
🔘 D) Global
✅ Answer: B) GNU
💡 Explanation: GPG (GNU Privacy Guard) is an open-source implementation of PGP, used for secure communication.
65. What is the primary function of a TLS session ticket?
🔘 A) To encrypt email communications
🔘 B) To speed up subsequent TLS connections
🔘 C) To generate cryptographic keys
🔘 D) To validate OCSP responses
✅ Answer: B) To speed up subsequent TLS connections
💡 Explanation: TLS session tickets allow clients to resume previous TLS sessions without repeating a full handshake.
66. What is a common vulnerability in improperly configured SSH servers?
🔘 A) Key reuse
🔘 B) Lack of two-factor authentication
🔘 C) Weak ciphers and outdated algorithms
🔘 D) All of the above
✅ Answer: D) All of the above
💡 Explanation: SSH servers with weak ciphers, key reuse, and lack of 2FA are prone to brute-force and MITM attacks.
67. What is a CRL (Certificate Revocation List) used for?
🔘 A) Encrypting data
🔘 B) Listing revoked certificates
🔘 C) Signing SSH keys
🔘 D) Creating TLS handshakes
✅ Answer: B) Listing revoked certificates
💡 Explanation: A CRL (Certificate Revocation List) is used by Certificate Authorities to list revoked certificates.
68. What is the primary function of an SSH jump host?
🔘 A) Encrypt SSH connections
🔘 B) Act as an intermediary to access internal systems securely
🔘 C) Manage SSH keys
🔘 D) Generate SSH fingerprints
✅ Answer: B) Act as an intermediary to access internal systems securely
💡 Explanation: An SSH jump host is a secure gateway that routes SSH traffic to internal systems.
69. Which cryptographic algorithm was deprecated in TLS 1.3?
🔘 A) AES
🔘 B) RSA key exchange
🔘 C) ChaCha20
🔘 D) SHA-256
✅ Answer: B) RSA key exchange
💡 Explanation: TLS 1.3 removed RSA key exchange due to its lack of Forward Secrecy.
70. What is the function of the ssh-copy-id command?
🔘 A) Copy SSH keys to a remote server for passwordless login
🔘 B) Generate a new SSH key pair
🔘 C) Transfer encrypted files
🔘 D) Delete SSH keys
✅ Answer: A) Copy SSH keys to a remote server for passwordless login
💡 Explanation: The ssh-copy-id command securely transfers public SSH keys to a remote system for key-based authentication.
71. What is the primary advantage of using Ed25519 keys for SSH authentication?
🔘 A) Faster key generation and verification
🔘 B) Stronger encryption than RSA
🔘 C) Smaller key size with better security
🔘 D) All of the above
✅ Answer: D) All of the above
💡 Explanation: Ed25519 keys provide strong security, faster performance, and smaller key sizes, making them an excellent choice for SSH authentication.
72. What does TLS use to ensure confidentiality of session data?
🔘 A) Public-key cryptography
🔘 B) Symmetric encryption
🔘 C) Hashing algorithms
🔘 D) Diffie-Hellman key exchange
✅ Answer: B) Symmetric encryption
💡 Explanation: TLS uses symmetric encryption (e.g., AES) for data confidentiality after the handshake is completed.
73. What is the role of gpg --verify in PGP?
🔘 A) Encrypt a message
🔘 B) Verify a signed message or file
🔘 C) Generate a new key pair
🔘 D) Export public keys
✅ Answer: B) Verify a signed message or file
💡 Explanation: The gpg --verify command checks whether a PGP-signed file is valid and was not tampered with.
74. What is the default port for an SSH SOCKS proxy?
🔘 A) 22
🔘 B) 443
🔘 C) 1080
🔘 D) 8080
✅ Answer: C) 1080
💡 Explanation: The default port for an SSH SOCKS proxy is 1080, allowing secure browsing via SSH tunnels.
75. What is the purpose of an Extended Validation (EV) certificate in TLS?
🔘 A) To provide higher encryption strength
🔘 B) To verify the organization’s identity more strictly
🔘 C) To enable certificate pinning
🔘 D) To prevent brute-force attacks
✅ Answer: B) To verify the organization’s identity more strictly
💡 Explanation: EV certificates require stronger identity verification for organizations and show a green bar in older browsers.
76. What is the primary difference between SSH and Telnet?
🔘 A) SSH is encrypted, while Telnet is not
🔘 B) Telnet is faster than SSH
🔘 C) SSH is only used for Windows servers
🔘 D) Telnet supports only IPv6
✅ Answer: A) SSH is encrypted, while Telnet is not
💡 Explanation: SSH encrypts all communication, whereas Telnet sends data in plaintext, making it insecure.
77. What happens if an SSH private key is leaked?
🔘 A) The associated public key becomes invalid
🔘 B) Attackers can gain unauthorized access to systems
🔘 C) The SSH server shuts down automatically
🔘 D) The SSH fingerprint changes
✅ Answer: B) Attackers can gain unauthorized access to systems
💡 Explanation: If an SSH private key is compromised, attackers can authenticate as the legitimate user.
78. What type of key does SSH use to authenticate a client?
🔘 A) Public key
🔘 B) Private key
🔘 C) Symmetric key
🔘 D) Session key
✅ Answer: A) Public key
💡 Explanation: SSH authenticates clients using their public key, while the private key remains confidential.
79. What command lists all installed SSH keys in an agent?
🔘 A) ssh-keygen -l
🔘 B) ssh-agent -k
🔘 C) ssh-add -l
🔘 D) ssh-config --list
✅ Answer: C) ssh-add -l
💡 Explanation: The ssh-add -l command lists all keys stored in the SSH agent.
80. What cryptographic protocol is recommended for replacing RSA in SSH?
🔘 A) DSA
🔘 B) ChaCha20
🔘 C) Ed25519
🔘 D) DES
✅ Answer: C) Ed25519
💡 Explanation: Ed25519 is a modern, secure, and fast alternative to RSA in SSH authentication.
81. Which command is used to remove all identities from the SSH authentication agent?
🔘 A) ssh-agent -r
🔘 B) ssh-add -D
🔘 C) ssh-keygen -R
🔘 D) ssh-remove-all
✅ Answer: B) ssh-add -D
💡 Explanation: The ssh-add -D command removes all stored identities (SSH keys) from the SSH agent.
82. What is the primary purpose of the OCSP stapling mechanism in TLS?
🔘 A) To reduce OCSP response time and improve security
🔘 B) To generate TLS session keys
🔘 C) To enforce HTTPS in browsers
🔘 D) To provide Forward Secrecy
✅ Answer: A) To reduce OCSP response time and improve security
💡 Explanation: OCSP stapling allows a web server to attach an OCSP response to a TLS handshake, improving performance and security.
83. Which encryption algorithm is commonly used in modern TLS implementations?
🔘 A) RC4
🔘 B) AES-GCM
🔘 C) MD5
🔘 D) DES
✅ Answer: B) AES-GCM
💡 Explanation: AES-GCM (Advanced Encryption Standard with Galois Counter Mode) is a secure and efficient encryption algorithm used in modern TLS.
84. What does the Strict-Transport-Security HTTP header enforce?
🔘 A) Disabling non-secure HTTP connections
🔘 B) Enabling OCSP stapling
🔘 C) Enforcing HMAC authentication
🔘 D) Preventing SQL injection attacks
✅ Answer: A) Disabling non-secure HTTP connections
💡 Explanation: The Strict-Transport-Security (HSTS) header forces browsers to only use HTTPS, preventing downgrade attacks.
85. What is the primary function of TLS session resumption?
🔘 A) To speed up repeated TLS connections
🔘 B) To generate new SSL certificates
🔘 C) To encrypt SSH keys
🔘 D) To perform key rotation
✅ Answer: A) To speed up repeated TLS connections
💡 Explanation: TLS session resumption allows clients to reconnect faster without a full handshake.
86. What does SSH use to encrypt interactive terminal sessions?
🔘 A) Asymmetric encryption only
🔘 B) Symmetric encryption after key exchange
🔘 C) Hashing algorithms
🔘 D) Plaintext communication
✅ Answer: B) Symmetric encryption after key exchange
💡 Explanation: SSH uses asymmetric encryption for key exchange and then switches to symmetric encryption for session data.
87. What attack does SSH guard against by using sequence numbers?
🔘 A) Brute-force attacks
🔘 B) Replay attacks
🔘 C) SQL injection
🔘 D) Cross-site scripting (XSS)
✅ Answer: B) Replay attacks
💡 Explanation: SSH assigns sequence numbers to packets to prevent replay attacks.
88. What is the purpose of an intermediate certificate in SSL/TLS?
🔘 A) To sign root CA certificates
🔘 B) To establish a chain of trust between the root CA and end-entity certificates
🔘 C) To encrypt the TLS handshake
🔘 D) To store private keys
✅ Answer: B) To establish a chain of trust between the root CA and end-entity certificates
💡 Explanation: Intermediate certificates act as a bridge between root Certificate Authorities (CAs) and end-user certificates.
89. Which SSH configuration file controls server settings?
🔘 A) /etc/ssh/ssh_config
🔘 B) /etc/ssh/sshd_config
🔘 C) ~/.ssh/config
🔘 D) /var/log/ssh.log
✅ Answer: B) /etc/ssh/sshd_config
💡 Explanation: The /etc/ssh/sshd_config file contains SSH server settings, including port, authentication methods, and key exchange protocols.
90. What is the purpose of the tls-prober tool?
🔘 A) To check for TLS configuration issues and vulnerabilities
🔘 B) To scan networks for open SSH ports
🔘 C) To generate TLS keys
🔘 D) To perform brute-force attacks
✅ Answer: A) To check for TLS configuration issues and vulnerabilities
💡 Explanation: tls-prober scans servers for TLS misconfigurations and security flaws.
91. What SSH option prevents password authentication and enforces key-based login?
🔘 A) PermitRootLogin no
🔘 B) PasswordAuthentication no
🔘 C) AllowUsers root
🔘 D) EnablePasswordSecurity on
✅ Answer: B) PasswordAuthentication no
💡 Explanation: Setting PasswordAuthentication no in sshd_config forces SSH key-based authentication.
92. What is a common attack against weak SSH passwords?
🔘 A) SQL injection
🔘 B) Brute-force attack
🔘 C) Buffer overflow
🔘 D) Clickjacking
✅ Answer: B) Brute-force attack
💡 Explanation: Attackers use brute-force attacks to guess weak SSH passwords and gain unauthorized access.
93. What is the default expiration time for a PGP key?
🔘 A) 1 year
🔘 B) 5 years
🔘 C) No expiration by default
🔘 D) 10 years
✅ Answer: C) No expiration by default
💡 Explanation: PGP keys do not expire by default, but users can set expiration dates when generating a key.
94. What attack does TLS use MAC (Message Authentication Code) to prevent?
🔘 A) Man-in-the-Middle (MITM)
🔘 B) SQL injection
🔘 C) Timing attacks
🔘 D) Buffer overflow
✅ Answer: A) Man-in-the-Middle (MITM)
💡 Explanation: TLS MAC ensures message integrity, preventing MITM attacks.
95. What type of encryption does SSH use for file transfers?
🔘 A) RSA
🔘 B) Symmetric encryption
🔘 C) MD5
🔘 D) No encryption
✅ Answer: B) Symmetric encryption
💡 Explanation: SSH encrypts file transfers using symmetric encryption algorithms like AES.
96. What does the gpg --export command do?
🔘 A) Exports a PGP public key
🔘 B) Encrypts a message
🔘 C) Signs a file
🔘 D) Generates a new key pair
✅ Answer: A) Exports a PGP public key
💡 Explanation: gpg --export exports a PGP public key for sharing.
97. What is the role of sshd in SSH?
🔘 A) SSH client
🔘 B) SSH daemon (server)
🔘 C) Key generator
🔘 D) File encryption tool
✅ Answer: B) SSH daemon (server)
💡 Explanation: sshd is the SSH server process that listens for incoming connections.
98. What is the purpose of mod_ssl in Apache?
🔘 A) To enable TLS/SSL support in Apache web server
🔘 B) To generate SSH keys
🔘 C) To validate PGP signatures
🔘 D) To prevent brute-force attacks
✅ Answer: A) To enable TLS/SSL support in Apache web server
💡 Explanation: mod_ssl is an Apache module that enables SSL/TLS support.
99. What is the main purpose of Diffie-Hellman key exchange in SSH?
🔘 A) To securely establish a shared symmetric key
🔘 B) To generate public keys
🔘 C) To sign SSH certificates
🔘 D) To store passwords
✅ Answer: A) To securely establish a shared symmetric key
💡 Explanation: Diffie-Hellman allows SSH clients and servers to negotiate a shared secret securely.
100. What is the standard port for OCSP responder services?
🔘 A) 80
🔘 B) 443
🔘 C) 21
🔘 D) 8080
✅ Answer: A) 80
💡 Explanation: OCSP responders typically operate on port 80 to provide certificate revocation status.
101. Which of the following protocols is often used for secure file transfer over SSH?
🔘 A) SCP
🔘 B) FTP
🔘 C) Telnet
🔘 D) HTTP
✅ Answer: A) SCP
💡 Explanation: SCP (Secure Copy Protocol) is used for securely transferring files over SSH.
102. What does the “S” in SSL/TLS stand for?
🔘 A) Secure
🔘 B) Session
🔘 C) System
🔘 D) Server
✅ Answer: A) Secure
💡 Explanation: SSL/TLS stands for Secure Sockets Layer/Transport Layer Security, which provides encryption and security for network communications.
103. Which TLS version introduced improved security features like 0-RTT?
🔘 A) TLS 1.0
🔘 B) TLS 1.1
🔘 C) TLS 1.2
🔘 D) TLS 1.3
✅ Answer: D) TLS 1.3
💡 Explanation: TLS 1.3 introduced 0-RTT, reducing connection times and improving security.
104. Which of the following ciphers is most commonly used in modern TLS encryption?
🔘 A) RC4
🔘 B) AES
🔘 C) DES
🔘 D) 3DES
✅ Answer: B) AES
💡 Explanation: AES (Advanced Encryption Standard) is widely used for secure encryption in modern TLS protocols.
105. What is the primary purpose of a public key in asymmetric encryption?
🔘 A) To encrypt data
🔘 B) To decrypt data
🔘 C) To sign data
🔘 D) To store session keys
✅ Answer: A) To encrypt data
💡 Explanation: The public key is used to encrypt data, while the private key is used to decrypt it.
106. What is the default port number used for HTTPS?
🔘 A) 22
🔘 B) 80
🔘 C) 443
🔘 D) 53
✅ Answer: C) 443
💡 Explanation: HTTPS typically runs on port 443, which is used for secure web communication.
107. Which of the following tools is commonly used to generate PGP keys?
🔘 A) OpenSSL
🔘 B) GPG
🔘 C) SSL Labs
🔘 D) Nmap
✅ Answer: B) GPG
💡 Explanation: GPG (GNU Privacy Guard) is commonly used to generate and manage PGP keys for encryption and signing.
108. What is the difference between SSH and SFTP?
🔘 A) SSH is for secure login, and SFTP is for file transfers
🔘 B) SFTP provides a faster transfer rate than SSH
🔘 C) SSH uses TLS encryption, while SFTP uses AES
🔘 D) SFTP is only for encrypted email communication
✅ Answer: A) SSH is for secure login, and SFTP is for file transfers
💡 Explanation: SSH is used for secure remote login and command execution, while SFTP (Secure File Transfer Protocol) is used for secure file transfers over SSH.
109. Which of the following is a commonly used method for SSH key management?
🔘 A) SSH-agent
🔘 B) FTP
🔘 C) SSL/TLS
🔘 D) RSA token
✅ Answer: A) SSH-agent
💡 Explanation: The SSH-agent stores private SSH keys securely in memory, allowing automatic authentication.
110. What is the purpose of a PGP key pair?
🔘 A) To encrypt the contents of a file
🔘 B) To provide authentication for SSH sessions
🔘 C) To create digital signatures for emails and files
🔘 D) To prevent SSL/TLS session hijacking
✅ Answer: C) To create digital signatures for emails and files
💡 Explanation: PGP key pairs are used to encrypt and sign emails and files, providing authentication and integrity.
111. Which type of attack can occur if SSL/TLS certificates are not properly verified?
🔘 A) Man-in-the-Middle (MITM)
🔘 B) Cross-Site Scripting (XSS)
🔘 C) SQL Injection
🔘 D) Denial of Service (DoS)
✅ Answer: A) Man-in-the-Middle (MITM)
💡 Explanation: MITM attacks can occur if the SSL/TLS certificate is not verified properly, allowing attackers to intercept and alter communications.
112. What is the role of a Certificate Authority (CA) in SSL/TLS communication?
🔘 A) To encrypt SSL traffic
🔘 B) To generate private keys
🔘 C) To issue digital certificates for websites
🔘 D) To monitor SSL traffic for vulnerabilities
✅ Answer: C) To issue digital certificates for websites
💡 Explanation: Certificate Authorities (CAs) issue digital certificates that verify the identity of websites and facilitate secure SSL/TLS connections.
113. What does SSL stripping do?
🔘 A) Encrypts HTTP traffic to make it secure
🔘 B) Downgrades an HTTPS connection to HTTP
🔘 C) Secures FTP sessions
🔘 D) Changes the encryption algorithm of SSL/TLS
✅ Answer: B) Downgrades an HTTPS connection to HTTP
💡 Explanation: SSL stripping is an attack that downgrades a secure HTTPS connection to HTTP, making data vulnerable to interception.
114. Which of the following is the most secure key exchange mechanism used in TLS 1.3?
🔘 A) RSA key exchange
🔘 B) Diffie-Hellman key exchange
🔘 C) Elliptic Curve Diffie-Hellman (ECDHE)
🔘 D) Static Diffie-Hellman
✅ Answer: C) Elliptic Curve Diffie-Hellman (ECDHE)
💡 Explanation: ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) provides Forward Secrecy and is the most secure key exchange method used in TLS 1.3.
115. What does the ssh-copy-id command do?
🔘 A) Copies a public SSH key to a remote system for authentication
🔘 B) Copies a file securely to a remote system
🔘 C) Verifies the fingerprint of an SSH key
🔘 D) Generates a new SSH key pair
✅ Answer: A) Copies a public SSH key to a remote system for authentication
💡 Explanation: The ssh-copy-id command installs a public SSH key on a remote system for passwordless authentication.
116. What is the key difference between SSH and SSL/TLS?
🔘 A) SSH is used for file transfers, while SSL/TLS is used for web traffic
🔘 B) SSH encrypts web traffic, while SSL/TLS is for remote logins
🔘 C) SSH uses symmetric encryption, while SSL/TLS uses asymmetric encryption
🔘 D) SSH is used for remote login and command execution, while SSL/TLS secures web traffic
✅ Answer: D) SSH is used for remote login and command execution, while SSL/TLS secures web traffic
💡 Explanation: SSH is used for remote logins and command execution, while SSL/TLS secures web traffic.
117. Which of the following is the most secure hashing algorithm used in SSL/TLS for integrity checks?
🔘 A) MD5
🔘 B) SHA-1
🔘 C) SHA-256
🔘 D) SHA-512
✅ Answer: C) SHA-256
💡 Explanation: SHA-256 is the most commonly used hashing algorithm for integrity checks in SSL/TLS.
118. Which TLS cipher suite provides both encryption and integrity protection?
🔘 A) RSA
🔘 B) AES-GCM
🔘 C) ECDSA
🔘 D) SHA-1
✅ Answer: B) AES-GCM
💡 Explanation: AES-GCM (Advanced Encryption Standard with Galois/Counter Mode) provides both encryption and integrity protection.
119. What is the main purpose of OCSP (Online Certificate Status Protocol)?
🔘 A) To verify SSL/TLS certificate expiration dates
🔘 B) To check the revocation status of SSL/TLS certificates
🔘 C) To store SSL/TLS certificates
🔘 D) To sign SSL/TLS certificates
✅ Answer: B) To check the revocation status of SSL/TLS certificates
💡 Explanation: OCSP is used to check whether an SSL/TLS certificate has been revoked by the issuing Certificate Authority (CA).
120. Which SSH authentication method uses cryptographic keys instead of passwords?
🔘 A) Public-key authentication
🔘 B) Password-based authentication
🔘 C) Two-factor authentication
🔘 D) Challenge-response authentication
✅ Answer: A) Public-key authentication
💡 Explanation: Public-key authentication uses a private/public key pair instead of passwords for secure SSH authentication.
121. What is the primary role of a TLS handshake?
🔘 A) Encrypt data transmission
🔘 B) Authenticate the client and server and negotiate encryption parameters
🔘 C) Store session keys for later use
🔘 D) Verify the client’s IP address
✅ Answer: B) Authenticate the client and server and negotiate encryption parameters
💡 Explanation: The TLS handshake is used to authenticate both parties and establish encryption settings before data transfer.
122. What does SSH port forwarding allow?
🔘 A) Running a web server over SSH
🔘 B) Encrypting FTP transfers
🔘 C) Securely tunneling network traffic through an SSH connection
🔘 D) Automating SSH authentication
✅ Answer: C) Securely tunneling network traffic through an SSH connection
💡 Explanation: SSH port forwarding (tunneling) allows secure routing of network traffic through an SSH connection.
123. What is the main advantage of Elliptic Curve Cryptography (ECC) over RSA in TLS?
🔘 A) It is more resistant to quantum computing attacks
🔘 B) It provides stronger security with smaller key sizes
🔘 C) It does not require key exchange
🔘 D) It is faster for encryption but slower for decryption
✅ Answer: B) It provides stronger security with smaller key sizes
💡 Explanation: ECC (Elliptic Curve Cryptography) provides strong security with smaller key sizes, making it more efficient than RSA.
124. Which SSH key type is recommended for maximum security?
🔘 A) RSA (2048-bit)
🔘 B) DSA (1024-bit)
🔘 C) Ed25519
🔘 D) MD5
✅ Answer: C) Ed25519
💡 Explanation: Ed25519 is a modern and secure SSH key algorithm, offering high security and fast performance.
125. What is the main purpose of Transport Layer Security (TLS)?
🔘 A) Encrypting and securing data in transit
🔘 B) Encrypting stored data
🔘 C) Generating cryptographic hashes
🔘 D) Creating symmetric encryption keys
✅ Answer: A) Encrypting and securing data in transit
💡 Explanation: TLS is used to encrypt network traffic, ensuring secure communication between clients and servers.
126. What does the SSH -L option do?
🔘 A) Enables logging for SSH
🔘 B) Starts an SSH listener for incoming connections
🔘 C) Creates a local port forwarding tunnel
🔘 D) Lists all active SSH sessions
✅ Answer: C) Creates a local port forwarding tunnel
💡 Explanation: The ssh -L option is used for local port forwarding, allowing a remote service to be accessed securely.
127. Which attack exploits the vulnerability in SSL/TLS renegotiation?
🔘 A) POODLE
🔘 B) BEAST
🔘 C) Triple Handshake Attack
🔘 D) Heartbleed
✅ Answer: C) Triple Handshake Attack
💡 Explanation: The Triple Handshake Attack allows an attacker to intercept and manipulate TLS connections by exploiting session renegotiation.
128. What is the purpose of a root certificate in SSL/TLS?
🔘 A) To encrypt user data
🔘 B) To validate and sign other certificates in the trust hierarchy
🔘 C) To store SSL keys
🔘 D) To manage TLS handshakes
✅ Answer: B) To validate and sign other certificates in the trust hierarchy
💡 Explanation: A root certificate is the top-level certificate in a Public Key Infrastructure (PKI) and is used to sign and validate other certificates.
129. What is the main purpose of the .ssh/authorized_keys file in SSH?
🔘 A) To store SSH client configuration
🔘 B) To list public keys authorized for SSH login
🔘 C) To generate new SSH keys
🔘 D) To store SSH logs
✅ Answer: B) To list public keys authorized for SSH login
💡 Explanation: The .ssh/authorized_keys file contains public keys that are allowed to authenticate without a password.
130. What is Forward Secrecy in SSL/TLS?
🔘 A) The ability to reuse session keys for faster encryption
🔘 B) The protection of past communications even if the private key is compromised
🔘 C) The automatic renewal of SSL certificates
🔘 D) The use of self-signed certificates
✅ Answer: B) The protection of past communications even if the private key is compromised
💡 Explanation: Forward Secrecy ensures that past encrypted sessions remain secure, even if the private key is later compromised.
131. What is the recommended way to disable weak ciphers in an SSH server?
🔘 A) Using Ciphers directive in sshd_config
🔘 B) Changing the SSH port to a non-standard one
🔘 C) Running SSH in debug mode
🔘 D) Disabling password authentication
✅ Answer: A) Using Ciphers directive in sshd_config
💡 Explanation: The Ciphers directive in sshd_config is used to disable weak encryption algorithms in SSH.
132. What does the TLS “Certificate Transparency” mechanism prevent?
🔘 A) Unauthorized certificate issuance
🔘 B) DNS spoofing attacks
🔘 C) SQL injection attacks
🔘 D) Side-channel attacks
✅ Answer: A) Unauthorized certificate issuance
💡 Explanation: Certificate Transparency (CT) helps detect and prevent fraudulent certificate issuance by maintaining public logs of issued certificates.
133. What is the function of gpg --list-keys in PGP?
🔘 A) Encrypts a message
🔘 B) Lists all stored PGP keys
🔘 C) Generates a new key pair
🔘 D) Deletes a public key
✅ Answer: B) Lists all stored PGP keys
💡 Explanation: The gpg --list-keys command is used to display all PGP keys stored in a user’s keyring.
134. What does the TLS_FALLBACK_SCSV mechanism prevent?
🔘 A) TLS downgrade attacks
🔘 B) MITM attacks
🔘 C) Certificate spoofing
🔘 D) Key exchange failures
✅ Answer: A) TLS downgrade attacks
💡 Explanation: TLS_FALLBACK_SCSV is a security measure that prevents forced downgrades to weaker TLS versions.
135. What is the recommended replacement for SHA-1 in TLS?
🔘 A) MD5
🔘 B) SHA-256
🔘 C) AES-128
🔘 D) RSA
✅ Answer: B) SHA-256
💡 Explanation: SHA-256 is recommended to replace the deprecated SHA-1 in modern TLS implementations.
136. What is the purpose of the SSH -N flag?
🔘 A) Disables encryption
🔘 B) Prevents remote commands from executing
🔘 C) Disables password authentication
🔘 D) Enables verbose logging
✅ Answer: B) Prevents remote commands from executing
💡 Explanation: The ssh -N option is used to set up SSH tunneling without executing remote commands.
137. What is the purpose of HSTS in web security?
🔘 A) To prevent HTTPS downgrade attacks
🔘 B) To encrypt email communication
🔘 C) To validate SSH fingerprints
🔘 D) To generate TLS keys
✅ Answer: A) To prevent HTTPS downgrade attacks
💡 Explanation: HSTS (HTTP Strict Transport Security) forces browsers to use HTTPS, preventing downgrade attacks.
138. Which of the following is a major improvement in TLS 1.3?
🔘 A) Removal of insecure ciphers
🔘 B) Faster handshakes
🔘 C) Stronger encryption algorithms
🔘 D) All of the above
✅ Answer: D) All of the above
💡 Explanation: TLS 1.3 improves security, speed, and efficiency by removing insecure ciphers, reducing handshake latency, and enhancing encryption.
141. What does SSH multiplexing help with?
🔘 A) Running multiple SSH commands without establishing a new connection each time
🔘 B) Encrypting SSH keys
🔘 C) Increasing the security of SSH connections
🔘 D) Preventing SSH session hijacking
✅ Answer: A) Running multiple SSH commands without establishing a new connection each time
💡 Explanation: SSH multiplexing allows multiple SSH sessions to reuse the same TCP connection, reducing overhead.
142. What is the primary purpose of a wildcard SSL certificate?
🔘 A) To secure multiple subdomains under the same domain
🔘 B) To provide stronger encryption than regular certificates
🔘 C) To support multiple key exchange mechanisms
🔘 D) To encrypt TLS handshakes
✅ Answer: A) To secure multiple subdomains under the same domain
💡 Explanation: Wildcard SSL certificates can secure all subdomains of a domain (e.g., *.example.com).
143. Which SSH option is used to specify an identity file for authentication?
🔘 A) -p
🔘 B) -i
🔘 C) -X
🔘 D) -L
✅ Answer: B) -i
💡 Explanation: The -i flag allows SSH users to specify a private key file for authentication.
144. What is the default validity period of an SSL/TLS certificate issued by a Certificate Authority (CA)?
🔘 A) 90 days
🔘 B) 1 year
🔘 C) 2 years
🔘 D) 10 years
✅ Answer: B) 1 year
💡 Explanation: As per recent guidelines, SSL/TLS certificates issued by CAs typically have a maximum validity of 1 year.
145. What feature in TLS 1.3 replaces the traditional RSA key exchange?
🔘 A) Ephemeral Diffie-Hellman (DHE)
🔘 B) Pre-shared keys
🔘 C) Elliptic Curve Diffie-Hellman (ECDHE)
🔘 D) Static RSA
✅ Answer: C) Elliptic Curve Diffie-Hellman (ECDHE)
💡 Explanation: TLS 1.3 removed RSA key exchange and replaced it with ECDHE, which provides Forward Secrecy.
146. What is the primary function of the ssh-agent program?
🔘 A) To store decrypted SSH private keys securely in memory
🔘 B) To generate SSH keys
🔘 C) To copy SSH keys to a remote server
🔘 D) To encrypt SSH traffic
✅ Answer: A) To store decrypted SSH private keys securely in memory
💡 Explanation: ssh-agent allows users to store private keys so they don’t have to enter passphrases repeatedly.
147. Which of the following is a common risk of self-signed SSL certificates?
🔘 A) They are not trusted by default in web browsers
🔘 B) They have shorter expiration periods
🔘 C) They provide weaker encryption
🔘 D) They require manual installation on all clients
✅ Answer: A) They are not trusted by default in web browsers
💡 Explanation: Self-signed certificates are not issued by a trusted Certificate Authority (CA), leading to browser security warnings.
148. What is the primary function of the sshd_config file?
🔘 A) To configure the SSH client
🔘 B) To configure the SSH server
🔘 C) To store private SSH keys
🔘 D) To monitor SSH logs
✅ Answer: B) To configure the SSH server
💡 Explanation: The /etc/ssh/sshd_config file controls SSH server settings, including authentication and encryption settings.
149. What attack exploits vulnerabilities in SSL/TLS compression mechanisms?
🔘 A) BEAST
🔘 B) POODLE
🔘 C) CRIME
🔘 D) Heartbleed
✅ Answer: C) CRIME
💡 Explanation: The CRIME attack exploits vulnerabilities in TLS compression, allowing attackers to recover session cookies.
150. What is the purpose of an HMAC in SSH?
🔘 A) To verify data integrity
🔘 B) To encrypt SSH traffic
🔘 C) To generate SSH keys
🔘 D) To enable Forward Secrecy
✅ Answer: A) To verify data integrity
💡 Explanation: HMAC (Hash-based Message Authentication Code) is used in SSH to ensure message integrity.
151. What is the primary benefit of using TLS session tickets?
🔘 A) Faster reconnection times
🔘 B) Stronger encryption
🔘 C) Forward Secrecy
🔘 D) Protection against MITM attacks
✅ Answer: A) Faster reconnection times
💡 Explanation: TLS session tickets allow a client to resume a previous session quickly, reducing the need for a full handshake.
152. What type of encryption does PGP use?
🔘 A) Only symmetric encryption
🔘 B) Only asymmetric encryption
🔘 C) A combination of symmetric and asymmetric encryption
🔘 D) Hashing only
✅ Answer: C) A combination of symmetric and asymmetric encryption
💡 Explanation: PGP encrypts messages using symmetric encryption, and then asymmetrically encrypts the session key.
153. What command lists the fingerprints of known SSH host keys?
🔘 A) ssh -K
🔘 B) ssh-keygen -l
🔘 C) ssh-agent -L
🔘 D) ssh-add -F
✅ Answer: B) ssh-keygen -l
💡 Explanation: The ssh-keygen -l command displays the fingerprint of an SSH public key.
154. Which TLS version deprecated weak ciphers like RC4 and MD5?
🔘 A) TLS 1.1
🔘 B) TLS 1.2
🔘 C) TLS 1.3
🔘 D) SSL 3.0
✅ Answer: B) TLS 1.2
💡 Explanation: TLS 1.2 deprecated insecure ciphers like RC4 and MD5, enhancing security.
155. What does gpg --sign do?
🔘 A) Encrypts a message
🔘 B) Creates a digital signature for a file
🔘 C) Decrypts a file
🔘 D) Lists PGP keys
✅ Answer: B) Creates a digital signature for a file
💡 Explanation: The gpg --sign command generates a PGP digital signature, verifying file authenticity.
156. What does SSH X11 forwarding allow?
🔘 A) Running graphical applications over SSH
🔘 B) Faster SSH key exchange
🔘 C) Encrypting all SSH sessions
🔘 D) Secure remote file transfers
✅ Answer: A) Running graphical applications over SSH
💡 Explanation: X11 forwarding enables users to run graphical applications remotely over SSH.
157. What is a common attack against weak SSH passwords?
🔘 A) Brute-force attack
🔘 B) DNS spoofing
🔘 C) TLS downgrade
🔘 D) Clickjacking
✅ Answer: A) Brute-force attack
💡 Explanation: Attackers attempt to guess weak SSH passwords using brute-force methods.
158. What does the ssh -o option do?
🔘 A) Specifies an SSH configuration option
🔘 B) Enables verbose logging
🔘 C) Disables authentication
🔘 D) Encrypts SSH traffic
✅ Answer: A) Specifies an SSH configuration option
💡 Explanation: The ssh -o option allows users to define specific SSH settings in a command-line session.
159. Which component of TLS handles encryption?
🔘 A) TLS Record Protocol
🔘 B) TLS Handshake Protocol
🔘 C) OCSP
🔘 D) HSTS
✅ Answer: A) TLS Record Protocol
💡 Explanation: The TLS Record Protocol encrypts and secures transmitted data.
160. What is the purpose of a client certificate in TLS?
🔘 A) To authenticate the client to the server
🔘 B) To encrypt data
🔘 C) To sign server certificates
🔘 D) To verify TLS ciphers
✅ Answer: A) To authenticate the client to the server
💡 Explanation: Client certificates are used in mutual TLS authentication to verify client identity.
161. What is the primary function of an SSH jump server?
🔘 A) To act as an intermediary for accessing internal systems securely
🔘 B) To encrypt SSH private keys
🔘 C) To store SSH logs
🔘 D) To block brute-force attacks
✅ Answer: A) To act as an intermediary for accessing internal systems securely
💡 Explanation: An SSH jump server is used to provide controlled access to internal systems, reducing direct exposure.
162. Which OpenSSL command is used to generate a new RSA private key?
🔘 A) openssl genrsa -out key.pem 2048
🔘 B) openssl enc -rsa -genkey
🔘 C) openssl create-key -rsa
🔘 D) openssl generate-rsa 4096
✅ Answer: A) openssl genrsa -out key.pem 2048
💡 Explanation: The openssl genrsa command generates an RSA private key, specifying the key size (e.g., 2048-bit).
163. What type of key does SSH use for secure authentication?
🔘 A) Symmetric key
🔘 B) Public-private key pair
🔘 C) AES key
🔘 D) TLS session key
✅ Answer: B) Public-private key pair
💡 Explanation: SSH uses public-private key pairs to authenticate users securely.
164. What does the TLS “Finished” message indicate?
🔘 A) The handshake is complete, and encryption can begin
🔘 B) The TLS session has been terminated
🔘 C) The certificate is verified
🔘 D) The client and server have agreed on a new session key
✅ Answer: A) The handshake is complete, and encryption can begin
💡 Explanation: The TLS “Finished” message signifies the successful completion of the handshake, allowing encrypted communication to begin.
165. What SSH option prevents a remote command from being executed?
🔘 A) ssh -N
🔘 B) ssh -X
🔘 C) ssh -R
🔘 D) ssh -L
✅ Answer: A) ssh -N
💡 Explanation: The ssh -N option is used when setting up SSH tunnels without executing any remote command.
166. What type of TLS certificate is required for EV (Extended Validation) status?
🔘 A) Self-signed certificate
🔘 B) Wildcard certificate
🔘 C) Organization Validated (OV) certificate
🔘 D) Extended Validation (EV) certificate
✅ Answer: D) Extended Validation (EV) certificate
💡 Explanation: EV certificates require strict identity verification and display a trust indicator in browsers.
167. What is the primary purpose of an SSH bastion host?
🔘 A) To provide controlled access to internal networks
🔘 B) To generate encryption keys
🔘 C) To encrypt all SSH sessions
🔘 D) To act as a load balancer
✅ Answer: A) To provide controlled access to internal networks
💡 Explanation: A bastion host is a hardened system that acts as an access gateway to internal systems.
168. What is the default port for the OCSP protocol?
🔘 A) 80
🔘 B) 443
🔘 C) 21
🔘 D) 53
✅ Answer: A) 80
💡 Explanation: OCSP (Online Certificate Status Protocol) typically operates on port 80 for certificate status checks.
169. What does the Strict-Transport-Security header prevent?
🔘 A) HTTPS downgrade attacks
🔘 B) DNS spoofing
🔘 C) Buffer overflow attacks
🔘 D) SQL injection
✅ Answer: A) HTTPS downgrade attacks
💡 Explanation: HSTS (HTTP Strict Transport Security) ensures that browsers always use HTTPS, preventing downgrade attacks.
170. Which command is used to generate a new SSH key pair?
🔘 A) ssh-genkey
🔘 B) ssh-keygen
🔘 C) ssh-add
🔘 D) ssh-copy-id
✅ Answer: B) ssh-keygen
💡 Explanation: The ssh-keygen command is used to generate new SSH key pairs for authentication.
171. What is the function of the tls-prober tool?
🔘 A) To check for TLS misconfigurations and vulnerabilities
🔘 B) To monitor SSH sessions
🔘 C) To generate encryption keys
🔘 D) To encrypt SSL traffic
✅ Answer: A) To check for TLS misconfigurations and vulnerabilities
💡 Explanation: tls-prober is a security tool that scans servers for TLS-related security flaws.
172. What is the maximum validity of Let’s Encrypt SSL certificates?
🔘 A) 30 days
🔘 B) 90 days
🔘 C) 1 year
🔘 D) 3 years
✅ Answer: B) 90 days
💡 Explanation: Let’s Encrypt certificates are valid for 90 days and must be renewed frequently.
173. What is the purpose of SSH reverse port forwarding?
🔘 A) To allow remote systems to access a local service
🔘 B) To encrypt an SSH session
🔘 C) To secure web traffic over SSH
🔘 D) To bypass firewall restrictions
✅ Answer: A) To allow remote systems to access a local service
💡 Explanation: Reverse SSH port forwarding allows remote systems to connect back to a local service.
174. What protocol does SSH use for key exchange?
🔘 A) AES
🔘 B) RSA
🔘 C) Diffie-Hellman
🔘 D) SHA-256
✅ Answer: C) Diffie-Hellman
💡 Explanation: SSH uses Diffie-Hellman key exchange to securely establish a shared session key.
175. What feature in TLS 1.3 significantly improves security?
🔘 A) Removal of RSA key exchange
🔘 B) Faster handshake process
🔘 C) Improved cipher selection
🔘 D) All of the above
✅ Answer: D) All of the above
💡 Explanation: TLS 1.3 introduced improved security by removing RSA key exchange, speeding up the handshake, and enhancing cipher security.
176. Which hashing algorithm is used in TLS 1.3 for integrity verification?
🔘 A) MD5
🔘 B) SHA-256
🔘 C) SHA-1
🔘 D) Blowfish
✅ Answer: B) SHA-256
💡 Explanation: TLS 1.3 uses SHA-256 for integrity verification to protect against tampering.
177. What is the primary advantage of using a VPN over SSH tunneling for secure connections?
🔘 A) VPN can encrypt all network traffic
🔘 B) SSH is slower than VPN
🔘 C) VPN provides stronger encryption
🔘 D) SSH cannot be used for encryption
✅ Answer: A) VPN can encrypt all network traffic
💡 Explanation: A VPN encrypts all network traffic, while SSH tunneling only encrypts specific traffic.
178. What is the function of gpg --decrypt?
🔘 A) Encrypts a file
🔘 B) Decrypts a PGP-encrypted file
🔘 C) Generates a new PGP key
🔘 D) Exports a public key
✅ Answer: B) Decrypts a PGP-encrypted file
💡 Explanation: The gpg --decrypt command is used to decrypt files encrypted using PGP.
179. What is the primary weakness of using a self-signed SSL certificate?
🔘 A) It is not trusted by browsers
🔘 B) It has weaker encryption
🔘 C) It cannot be revoked
🔘 D) It expires faster than CA-issued certificates
✅ Answer: A) It is not trusted by browsers
💡 Explanation: Self-signed certificates are not issued by a trusted CA, making them untrusted in browsers.
180. What does OCSP (Online Certificate Status Protocol) check?
🔘 A) Whether an SSL certificate is revoked
🔘 B) The expiration date of a certificate
🔘 C) The encryption strength of TLS
🔘 D) The hostname in a TLS certificate
✅ Answer: A) Whether an SSL certificate is revoked
💡 Explanation: OCSP checks whether a certificate has been revoked before its expiration date.
181. What is the purpose of TLS Server Name Indication (SNI)?
🔘 A) To allow multiple SSL certificates on the same IP address
🔘 B) To encrypt DNS queries
🔘 C) To enforce mutual authentication
🔘 D) To improve SSL handshake speed
✅ Answer: A) To allow multiple SSL certificates on the same IP address
💡 Explanation: SNI (Server Name Indication) enables a single server to host multiple SSL/TLS certificates for different domains.
182. What does the SSH -T option do?
🔘 A) Disables pseudo-terminal allocation
🔘 B) Enables X11 forwarding
🔘 C) Forces password authentication
🔘 D) Lists active SSH sessions
✅ Answer: A) Disables pseudo-terminal allocation
💡 Explanation: The ssh -T option prevents SSH from allocating a pseudo-terminal, often used in automation scripts.
183. What is the primary goal of SSL/TLS renegotiation?
🔘 A) To refresh encryption keys during a session
🔘 B) To extend the validity of a TLS certificate
🔘 C) To speed up HTTPS connections
🔘 D) To force certificate re-validation
✅ Answer: A) To refresh encryption keys during a session
💡 Explanation: SSL/TLS renegotiation allows refreshing session keys for additional security.
184. Which SSH authentication method is the most secure?
🔘 A) Password authentication
🔘 B) Public-key authentication
🔘 C) Challenge-response authentication
🔘 D) Plaintext authentication
✅ Answer: B) Public-key authentication
💡 Explanation: Public-key authentication is the most secure SSH authentication method as it eliminates password-based attacks.
185. What does the tlsdate tool do?
🔘 A) Synchronizes system time securely using TLS
🔘 B) Generates TLS keys
🔘 C) Checks SSL certificate expiration
🔘 D) Encrypts SSH traffic
✅ Answer: A) Synchronizes system time securely using TLS
💡 Explanation: tlsdate synchronizes system time by securely retrieving it from TLS-enabled servers.
186. What is the function of OCSP stapling?
🔘 A) Reduces the need for real-time OCSP requests
🔘 B) Encrypts TLS handshakes
🔘 C) Prevents certificate spoofing
🔘 D) Provides automatic certificate renewal
✅ Answer: A) Reduces the need for real-time OCSP requests
💡 Explanation: OCSP stapling allows a web server to pre-fetch the OCSP response and send it during the TLS handshake.
187. What command is used to force SSH to use a specific private key?
🔘 A) ssh -k
🔘 B) ssh -i
🔘 C) ssh -P
🔘 D) ssh -X
✅ Answer: B) ssh -i
💡 Explanation: The ssh -i option specifies a custom private key file for authentication.
188. What does the TLS_PSK cipher suite use for authentication?
🔘 A) Pre-shared keys
🔘 B) RSA certificates
🔘 C) Diffie-Hellman key exchange
🔘 D) HMAC
✅ Answer: A) Pre-shared keys
💡 Explanation: The TLS_PSK cipher suite uses Pre-Shared Keys (PSK) instead of public-key cryptography.
189. What is a common vulnerability in older versions of SSL/TLS?
🔘 A) Lack of Forward Secrecy
🔘 B) Weak encryption algorithms
🔘 C) Susceptibility to MITM attacks
🔘 D) All of the above
✅ Answer: D) All of the above
💡 Explanation: Older SSL/TLS versions suffer from weak encryption, lack of Forward Secrecy, and vulnerabilities to MITM attacks.
190. What protocol replaces SSL in modern secure communications?
🔘 A) IPSec
🔘 B) TLS
🔘 C) SSH
🔘 D) VPN
✅ Answer: B) TLS
💡 Explanation: TLS (Transport Layer Security) is the modern replacement for the outdated SSL protocol.
191. What is the primary risk of using expired SSL/TLS certificates?
🔘 A) Reduced encryption strength
🔘 B) Certificate errors and trust issues
🔘 C) Increased website speed
🔘 D) Faster handshake times
✅ Answer: B) Certificate errors and trust issues
💡 Explanation: Expired SSL/TLS certificates cause trust errors, leading to browser security warnings.
192. What is the default SSH key file name for RSA authentication?
🔘 A) id_ecdsa
🔘 B) id_dsa
🔘 C) id_rsa
🔘 D) id_ed25519
✅ Answer: C) id_rsa
💡 Explanation: RSA keys are stored in ~/.ssh/id_rsa for SSH authentication.
193. What is the purpose of ssh-copy-id?
🔘 A) To copy public SSH keys to a remote host for authentication
🔘 B) To generate new SSH keys
🔘 C) To delete SSH keys from a remote server
🔘 D) To list all stored SSH keys
✅ Answer: A) To copy public SSH keys to a remote host for authentication
💡 Explanation: ssh-copy-id simplifies public key authentication by copying public SSH keys to remote servers.
194. Which hashing algorithm was removed from TLS 1.3?
🔘 A) SHA-256
🔘 B) MD5
🔘 C) SHA-3
🔘 D) Whirlpool
✅ Answer: B) MD5
💡 Explanation: TLS 1.3 removed MD5 due to its weaknesses in collision attacks.
195. What is the primary use of gpg --armor?
🔘 A) To export keys in ASCII format
🔘 B) To encrypt files
🔘 C) To sign emails
🔘 D) To generate PGP keys
✅ Answer: A) To export keys in ASCII format
💡 Explanation: The gpg --armor option exports keys and messages in ASCII format, making them more portable.
196. What is the main benefit of TLS session resumption?
🔘 A) Faster reconnection times
🔘 B) Increased encryption strength
🔘 C) Automatic certificate renewal
🔘 D) Reduced need for HSTS
✅ Answer: A) Faster reconnection times
💡 Explanation: TLS session resumption speeds up subsequent connections by reusing previously established session parameters.
197. What does the ssh -q option do?
🔘 A) Runs SSH in quiet mode, suppressing warnings and errors
🔘 B) Lists active SSH keys
🔘 C) Enables verbose logging
🔘 D) Forces password authentication
✅ Answer: A) Runs SSH in quiet mode, suppressing warnings and errors
💡 Explanation: The ssh -q option suppresses output messages, making SSH connections quieter.
198. What is the purpose of an Extended Validation (EV) TLS certificate?
🔘 A) To provide strict identity verification for organizations
🔘 B) To increase encryption strength
🔘 C) To support wildcard domains
🔘 D) To enable Forward Secrecy
✅ Answer: A) To provide strict identity verification for organizations
💡 Explanation: EV TLS certificates require rigorous identity verification before being issued.
199. Which TLS extension prevents downgrade attacks?
🔘 A) TLS_FALLBACK_SCSV
🔘 B) OCSP Stapling
🔘 C) SNI
🔘 D) PFS
✅ Answer: A) TLS_FALLBACK_SCSV
💡 Explanation: TLS_FALLBACK_SCSV prevents protocol downgrade attacks by ensuring clients do not fall back to weaker TLS versions.
200. What does gpg --delete-key do?
🔘 A) Removes a PGP key from the keyring
🔘 B) Revokes a PGP key
🔘 C) Encrypts a file
🔘 D) Lists available keys
✅ Answer: A) Removes a PGP key from the keyring
💡 Explanation: The gpg --delete-key command removes a stored PGP key from the local keyring.
201. What is the purpose of the SSH -C option?
🔘 A) Enables compression for SSH connections
🔘 B) Copies SSH keys to a remote server
🔘 C) Forces password authentication
🔘 D) Disables encryption for faster connections
✅ Answer: A) Enables compression for SSH connections
💡 Explanation: The ssh -C option enables compression, which can improve performance on low-bandwidth networks.
202. What is the primary benefit of using TLS 1.3 over TLS 1.2?
🔘 A) Improved handshake speed and security
🔘 B) Support for older cipher suites
🔘 C) More reliance on RSA key exchange
🔘 D) Increased key sizes for SSL certificates
✅ Answer: A) Improved handshake speed and security
💡 Explanation: TLS 1.3 offers a faster handshake and removes insecure algorithms, making it more secure and efficient than TLS 1.2.
203. What does gpg --edit-key allow you to do?
🔘 A) Modify or manage PGP key properties
🔘 B) Encrypt a file using GPG
🔘 C) Export a GPG key
🔘 D) Delete a GPG key
✅ Answer: A) Modify or manage PGP key properties
💡 Explanation: The gpg --edit-key command allows users to modify key properties, such as adding new user IDs or revoking keys.
204. What is the purpose of the CipherSuites directive in TLS configurations?
🔘 A) To specify the list of allowed encryption algorithms
🔘 B) To manage SSH key authentication
🔘 C) To enforce SSL certificate renewal
🔘 D) To store cryptographic keys
✅ Answer: A) To specify the list of allowed encryption algorithms
💡 Explanation: The CipherSuites directive defines which encryption algorithms a TLS server will support, helping enforce security policies.
205. What does an SSH honeypot do?
🔘 A) Captures unauthorized SSH login attempts for security monitoring
🔘 B) Encrypts SSH connections with stronger algorithms
🔘 C) Automatically blocks IP addresses after failed logins
🔘 D) Creates SSH keys for authentication
✅ Answer: A) Captures unauthorized SSH login attempts for security monitoring
💡 Explanation: An SSH honeypot is a security tool designed to attract and monitor unauthorized SSH login attempts to detect and analyze attack patterns.