Examkin

Question

Difficulty: MediumPublic Key Infrastructure and Certificate Management

A systems engineer is implementing security controls for a enterprise API gateway that requires mutual TLS authentication. To optimize client connection speeds, the engineer wants to eliminate third-party real-time lookup latency during certificate revocation verification. Additionally, the engineer must request a new web server certificate following strict Public Key Infrastructure (PKI) enrollment best practices. Which of the following steps should the security engineer take to meet these requirements?

  1. Enable OCSP stapling on the server to provide clients with time-stamped, CA-signed certificate status responses during the initial handshake.Answer
  2. B
    Submit both the private key and the public key inside the Certificate Signing Request (CSR) file sent to the Certificate Authority for validation.
  3. Generate the key pair locally on the server hardware and send only the public key along with identification details inside the Certificate Signing Request (CSR).Answer
  4. D
    Embed symmetric encryption key certificates into the API gateway payload to accelerate asymmetric key exchange during connection establishment.
  5. E
    Configure the web server to append digital signatures to standard HTTP GET request headers to guarantee connection integrity without encryption.

Answer

The engineer should enable OCSP stapling on the server to provide cached revocation status responses during the TLS handshake, and generate the key pair locally to include only the public key in the Certificate Signing Request (CSR).
Enabling OCSP stapling offloads real-time revocation verification from the client to the server, significantly reducing handshake latency while keeping certificate status checks up to date. During certificate issuance, generating key pairs locally and submitting only the public key within the CSR maintains the strict secrecy of the server's private key.

Step-by-Step Solution

1
Evaluate the requirement for optimizing certificate revocation checking performance.
OCSP stapling delegates revocation queries to the server, which caches signed responses from the CA and staples them into the TLS handshake, preventing client lookup delays and privacy leaks.
Direct client OCSP checks cause latency and depend on third-party server availability, which OCSP stapling effectively resolves.
2
Determine correct PKI certificate enrollment and CSR generation steps.
The server generates a public-private key pair locally, retains the private key in secure storage, and embeds the public key and organizational details into the CSR sent to the CA.
Exposing or transmitting private keys during CSR creation compromises key integrity and violates PKI security boundaries.

Key Concept

Public Key Infrastructure (PKI) Certificate Enrollment and OCSP Stapling Mechanics
Estimated Time:1m 30s
Rate this question

Topics

Public Key Infrastructure and Certificate Management

More questions from this topic