Examkin

Question

Difficulty: HardPublic Key Infrastructure and Certificate Management

A security administrator is setting up an automated deployment server that requires an enterprise-issued code-signing certificate from an internal Certificate Authority (CA). Which of the following procedures correctly follows Public Key Infrastructure (PKI) standards for generating and submitting a Certificate Signing Request (CSR)?

  1. Generate the public and private key pair locally on the deployment server, protect the private key on that server, and transmit only the CSR containing the public key to the CA for signing.Answer
  2. B
    Generate the key pair and CSR directly on the Root CA server, then download both the signed certificate and the private key file to the deployment server over the network.
  3. C
    Generate a single shared symmetric key on the deployment server, embed the symmetric key into the CSR payload, and transmit it to the CA for asymmetric validation.
  4. D
    Generate an SHA-256 digest of the request file on the deployment server and submit only the hash value to the CA, relying on hashing alone to establish non-repudiation.

Answer

Generate the public and private key pair locally on the deployment server, protect the private key on that server, and transmit only the CSR containing the public key to the CA for signing.
In standard PKI workflows, the applicant system generates its own public/private key pair locally. The private key is securely retained, and only the public key along with identification data is packaged into the Certificate Signing Request (CSR) sent to the Certificate Authority. This prevents private key exposure during transmission.

Step-by-Step Solution

1
Analyze standard PKI key pair generation location
The target system (deployment server) generates the asymmetric key pair locally so the private key never leaves the boundary of the requesting system.
Preventing private key transit across network interfaces minimizes key exposure and compromise risk.
2
Evaluate the contents and submission of the Certificate Signing Request (CSR)
The CSR package includes the subject identity details and the generated public key, digitally signed by the generated private key to prove key ownership.
The CA requires only the public key and identity validation to issue a signed X.509 digital certificate.
3
Select the choice matching correct CSR generation workflow
The option specifying local key generation and transmitting only the CSR with the public key to the CA is identified as the correct procedure.
This maintains appropriate security boundaries and adheres to standard PKI lifecycle rules.

Key Concept

Public Key Infrastructure (PKI) Certificate Signing Request (CSR) Lifecycle Workflow
Rate this question

Topics

Public Key Infrastructure and Certificate Management

More questions from this topic