Lab 8 Assessment

1. Where can you store your public keys or public certificate files in the public domain? Is this the same thing as a public key infrastructure (PKI) server?

Certificate stores

2. What do you need if you want to decrypt encrypted messages and files from a trusted sender?

Decryption key

3. When referring to IPSec tunnel mode, what two types of headers are available and how do they differ?

Authentication Header is used to prove the identity of the sender and ensure the data is not tampered with while Encapsulated Security Payload provides authentication and encryption and encrypts the IP packets and ensures their integrity.

4. Provide a step by step progression for a typical Certificate Enrollment process with a Certificate Authority.

Create Enrollment Object
Set Enrollment Parameters
Create Request
Submit Request
Process request
Get Certificate
Accept Certificate

5. When designing a PKI infrastructure what are the advantages and disadvantages of making the CA available publicly over the Internet or keeping it within the private network?

Advantages
Straight-forward Concept
Chain-length limit
Less time to obtain a usable certificate within the CA

Disadvantages
Scalability
Single point of trust
Still need an impeccable CA

6. Designing a PKI involves several steps. Per the Windows Best Practices for Designing a PKI, what are those steps? In your words, explain what each step is meant to do? * Outline the business scenario * Define the application certificate requirements * Create certificate policies and practices statements * Design the certification authority (CA) infrastructure * Create a certificate renewal strategy * Develop a CA management plan

7. When deploying a PKI, it is important to understand how many CAs will be necessary to properly implement the