SSCP Cryptography Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Encrypt email

  Why it's wrong here

  The serverAuth EKU restricts the certificate to authenticating TLS servers, so it cannot perform S/MIME email encryption, which requires the emailProtection EKU. It is tempting because serverAuth certificates are frequently used for secure communications, but that role is limited to TLS server authentication, not message-level encryption.

• ✓

  Authenticate a TLS server

  Why this is correct

  The serverAuth EKU value permits the certificate's public key to authenticate a TLS server during the handshake, proving the server's identity to clients. This satisfies the stem's specified extension, restricting usage to server authentication rather than clientAuth, code signing or email protection.

• ✗

  Sign code

  Why it's wrong here

  The serverAuth EKU restricts the certificate to authenticating TLS servers, so code signing is outside its permitted use. Code signing requires the codeSigning EKU; serverAuth would be correct for a web or application server presenting TLS credentials.

• ✗

  Issue subordinate CA certificates

  Why it's wrong here

  Issuing subordinate CA certificates requires the basicConstraints extension with CA:TRUE and keyCertSign key usage; serverAuth alone grants no signing authority over other certificates. It is tempting because CAs do issue certificates, but a serverAuth leaf certificate is an end-entity credential, not a signing authority.