Which THREE of the following GnuPG operations require your own private key to be present in ~/.gnupg? (Choose three.)
LPIC-1 Exam 102-500, objective 110. Security hard
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Choose 3.
Correct Decrypting a file that a colleague encrypted to your public key.
Correct. Anything encrypted with a public key can only be opened with the matching private key, which is why gpg prompts for its passphrase during decryption.
Correct Creating a detached signature over a tarball you are publishing.
Correct. Signing is a private-key operation; the signature is what proves that the holder of the private key saw the data.
Correct Generating a revocation certificate for your own key.
Correct. A revocation certificate is itself a signed statement about the key, so gpg --gen-revoke needs the private key and its passphrase. That is why the certificate is made in advance and stored somewhere safe.
Not correct Verifying a signature that a colleague made on a file.
Wrong. Verification uses the signer's public key, which you import into your keyring. No private key of yours is involved.
Not correct Encrypting a file so that a colleague can read it.
Wrong. Encryption uses the recipient's public key. You can encrypt to someone without owning any key pair yourself, although then you cannot read the result back.
Not correct Importing a public key file that a colleague sent you.
Wrong. gpg --import only writes the key into your public keyring. Nothing is decrypted or signed, so no private key is touched.
Why
In public-key cryptography the private key does two jobs, decrypting what was encrypted to you and signing what you vouch for, while the public key does the complementary two, encrypting to someone else and verifying their signatures. Revocation is a signing operation in disguise, which is the practical reason for producing the certificate immediately after key generation: if the private key or its passphrase is ever lost, revocation becomes impossible afterwards.
Where this comes from
- Cited
- manual page gpg(1)
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 110 and space the ones you get wrong.
More questions on this objective
- During an audit you must list every file under /usr that has the set-user-ID bit set, regardless of what its other permission bits are. Which command does that? machine-checked
- You locked the password of the account `intern` and confirmed that its hash in /etc/shadow now begins with an exclamation mark. The intern nevertheless still reaches a shell on the host over SSH, without being prompted for anything. What is going on, and what actually stops it? machine-checked
- You have just been added to a sudo rule on a host and want sudo itself to report which commands you are allowed to run there, without running any of them. Type the complete command. machine-checked
- A daemon started from your bash session keeps hitting a 'too many open files' error. Which command raises the limit on open file descriptors for the current shell and the processes it starts to 4096? machine-checked
- You are about to take a server down for maintenance and want ordinary users refused at login for the next hour, with an explanatory message, while root can still get in. On a system using PAM's pam_nologin, creating which file achieves this? machine-checked
- Which two commands report the users who are logged in right now, rather than a history of past logins? (Choose two.) machine-checked