Examkin

Question

Difficulty: Very hardPublic Key Infrastructure and Certificate Management

An enterprise security administrator is deploying a high-volume public web service that requires TLS mutual authentication (mTLS) for client devices and automated certificate lifecycle management. The administrator must ensure that client certificate status checks are optimized for minimal latency without exposing the internal Certificate Authority (CA) to external query floods, while also establishing an automated, secure enrollment mechanism for enterprise endpoint certificates. Which of the following technical controls and configurations should the administrator implement to satisfy these requirements? (Select TWO.)

  1. Configure Online Certificate Status Protocol (OCSP) stapling on the web server to append cached, digitally signed CA revocation responses to client TLS handshakes.Answer
  2. Implement Automated Certificate Management Environment (ACME) with standardized challenge protocols to automate certificate request and issuance for enterprise endpoints.Answer
  3. C
    Distribute Certificate Revocation Lists (CRLs) via HTTP directly from the primary offline Root CA to external client endpoints during initial connection setup.
  4. D
    Generate an asymmetric private key on the intermediate CA and transfer it to the client endpoint alongside the Certificate Signing Request (CSR).
  5. E
    Use a symmetric preshared key to digitally sign the server certificate to guarantee non-repudiation and client validation across untrusted networks.

Answer

The administrator should configure OCSP stapling on the web server to optimize revocation checks without exposing the CA, and deploy the Automated Certificate Management Environment (ACME) protocol to automate endpoint certificate enrollment.
Enabling OCSP stapling delegates the burden of fetching digitally signed revocation status to the web server itself, which appends the OCSP response into the TLS handshake, reducing latency and shielding the CA from direct client queries. Utilizing ACME automates key pair creation, challenge verification, CSR submission, and certificate installation across endpoints securely.

Step-by-Step Solution

1
Evaluate revocation checking optimization requirements.
Identify that OCSP stapling caches signed revocation status directly on the web server, eliminating client-to-CA query latency and protecting internal CA infrastructure from external traffic spikes.
Direct CRL downloads or direct OCSP querying by clients introduce performance bottlenecks and privacy issues.
2
Evaluate automated certificate lifecycle management options.
Identify ACME as the standard open protocol for automated domain validation, key issuance, and certificate renewal.
Manual CSR processing and centralized private key distribution violate PKI key security principles and scalability standards.

Key Concept

PKI Certificate Lifecycle Automation and Revocation Optimization
Rate this question

Topics

Public Key Infrastructure and Certificate Management

More questions from this topic