Which of the following practices are important for the security of private keys? (Choose TWO correct answers.)

Question

Options

• APrivate keys should be created on the systems where they will be used and should never leave
• BPrivate keys should be uploaded to public key servers.
• CPrivate keys should be included in X509 certificates.
• DPrivate keys should have a sufficient length for the algorithm used for key generation.
• EPrivate keys should always be stored as plain text files without any encryption.

• A
  4% (1)
• B
  4% (1)
• C
  83% (19)
• E
  9% (2)

Explanation

There appears to be an error in the provided answer key. The stated correct answers (C, D) contain a factual mistake - C is incorrect, and A should be selected instead. The actual correct answers are A and D.

Why A is correct: Private keys should be generated directly on the system where they will be used and never exported or transmitted elsewhere. Every time a private key moves, it creates an opportunity for interception or compromise.

Why D is correct: Key length directly determines cryptographic strength. Each algorithm (RSA, ECC, etc.) has minimum recommended lengths (e.g., RSA-2048+, ECC-256+) - too short and the key is vulnerable to brute-force attacks.

Why C is wrong (despite being listed as correct): X.509 certificates contain the public key, not the private key. Including a private key in a certificate would be a severe security breach, exposing it to anyone who sees the certificate.

Why B is wrong: Public key servers are for distributing public keys. Uploading a private key there would compromise it entirely.

Why E is wrong: Plain-text storage means anyone with file system access can steal the key. Private keys should be encrypted at rest (e.g., password-protected PEM files or stored in a hardware security module).

Memory tip: Think "private = stays private." A private key never leaves its birthplace (A), needs to be strong enough to do its job (D), and is the opposite of what goes in a certificate or on a public server.

Recommendation: Double-check your source material - the answer key listing C as correct is wrong and could cost you points on the real exam.

No community discussion yet for this question.