SK0-004 · Question #767
A technician wants to send a secure message to a user. The technician receives the public encryption keys from the user. Which of the following actions would be a prudent response?
The correct answer is B. Send the user an encrypted message. Receiving a user's public key is the standard first step in asymmetric encryption; the correct action is to use that key to encrypt a message only the user can decrypt.
Question
A technician wants to send a secure message to a user. The technician receives the public encryption keys from the user. Which of the following actions would be a prudent response?
Options
- ANotify the security team
- BSend the user an encrypted message
- CRevoke the compromised keys
- DAdd the encryption keys to the CRL
How the community answered
(54 responses)- A2% (1)
- B91% (49)
- C6% (3)
- D2% (1)
Why each option
Receiving a user's public key is the standard first step in asymmetric encryption; the correct action is to use that key to encrypt a message only the user can decrypt.
Receiving a public key is a routine operation in PKI and does not constitute a security incident requiring team notification.
In asymmetric (public-key) cryptography, a sender encrypts a message using the recipient's public key. Only the recipient's paired private key can decrypt it, ensuring confidentiality. Receiving a public key is a normal, expected part of this workflow and requires no alarm.
Revoking keys is appropriate only when a private key is compromised or a certificate is no longer trusted, not when legitimately receiving a public key.
A Certificate Revocation List (CRL) is used to publish invalidated certificates, not to store or register public keys received from other users.
Concept tested: Asymmetric encryption public key usage
Source: https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final
Topics
Community Discussion
No community discussion yet for this question.