Examkin

Question

Difficulty: MediumPassword Security Policies, MFA, and Certificates

A network administrator is implementing certificate-based client authentication (EAP-TLS) for 802.1X enterprise wireless access. When an authentication server receives a digital certificate presented by a client device, which two methods or attributes are used by the server to check whether the certificate has been explicitly revoked before its natural expiration date? (Select TWO.)

  1. Querying an Online Certificate Status Protocol (OCSP) responder via HTTP to obtain real-time certificate statusAnswer
  2. Downloading and parsing a Certificate Revocation List (CRL) published periodically by the issuing Certificate Authority (CA)Answer
  3. C
    Inspecting the Certificate Signing Request (CSR) block embedded within the public key payload during the EAP exchange
  4. D
    Verifying that the client device's MAC address matches the Subject Alternative Name (SAN) attribute using TACACS+

Answer

The correct methods for checking certificate revocation are querying an Online Certificate Status Protocol (OCSP) responder for real-time status and checking a Certificate Revocation List (CRL) published by the issuing CA.
To verify that a certificate has not been revoked prior to expiration, an authentication server uses either Certificate Revocation Lists (CRLs), which are regularly updated lists of revoked serial numbers published by the CA, or Online Certificate Status Protocol (OCSP), which provides real-time revocation status checks over HTTP.

Step-by-Step Solution

1
Identify the primary mechanisms used in Public Key Infrastructure (PKI) to track and check revoked digital certificates.
The standard PKI mechanisms for revocation checking are CRLs (time-based list files) and OCSP (real-time protocol queries).
When a private key is compromised or a certificate is prematurely retired, the CA marks it as revoked via CRL or OCSP.
2
Evaluate the function of Certificate Revocation Lists (CRLs).
A CRL contains a list of serial numbers of revoked certificates published periodically to a Certificate Distribution Point (CDP).
Authentication servers download the list from the CDP to verify the client certificate serial number is not listed.
3
Evaluate the function of Online Certificate Status Protocol (OCSP).
OCSP performs an online query to check the revocation status of a specific certificate without downloading a full list.
This allows immediate, real-time revocation verification during dynamic EAP-TLS authentication.

Key Concept

Digital Certificate Revocation Checking (CRL and OCSP)
Rate this question

Topics

Password Security Policies, MFA, and Certificates

More questions from this topic