Examkin

Question

Difficulty: Very hardCryptographic and Security Control Weaknesses

A healthcare enterprise recently integrated a third-party remote patient monitoring service that communicates via HTTPS with an internal API gateway. During an incident investigation, security analysts discovered that an attacker who obtained a compromised, revoked private key from a former partner company successfully established a man-in-the-middle (MitM) session and exfiltrated sensitive patient records. The API gateway validated that the presented certificate was issued by a trusted Certificate Authority (CA) and had not reached its expiration date, but failed to inspect current revocation data. Which cryptographic control weakness directly allowed this unauthorized session to be established?

  1. Improper certificate revocation validation failing to check CRL or OCSP endpoints during the TLS handshakeAnswer
  2. B
    Flawed key pair generation during the Certificate Signing Request creation process
  3. C
    Improper selection of symmetric bulk ciphers for endpoint identity verification
  4. D
    Misconfiguration of network-level preventive controls at the enterprise boundary

Answer

Improper certificate revocation validation failing to check CRL or OCSP endpoints during the TLS handshake
The correct answer identifies improper certificate validation—specifically the failure to check Certificate Revocation Lists (CRLs) or Online Certificate Status Protocol (OCSP) responses—as the root vulnerability. A digital certificate must be verified against current revocation databases to ensure that stolen, compromised, or prematurely invalidated private keys are rejected during handshake negotiation.

Step-by-Step Solution

1
Analyze the incident details
The attacker utilized a key that was known to be compromised and previously revoked by the issuing CA.
Understanding the attacker's vector reveals that the vulnerability lies within PKI certificate status verification.
2
Evaluate the gateway's validation checks
The gateway confirmed CA signature trust and expiration dates, but omitted checking revocation lists or querying status responders.
A certificate remains accepted despite revocation if the relying party does not query CRLs or OCSP.
3
Identify the underlying cryptographic weakness
The failure to enforce real-time or updated revocation verification allowed the revoked credential to authenticate successfully.
Complete certificate validation mandates checking signature trust, validity period, path depth, and revocation status.

Key Concept

Public Key Infrastructure (PKI) Certificate Revocation Checking (CRL and OCSP)
Rate this question

Topics

Cryptographic and Security Control Weaknesses

More questions from this topic