Examkin

Question

Difficulty: MediumPublic Key Infrastructure and Certificate Management

A security administrator is refining the Public Key Infrastructure (PKI) deployment for an enterprise RADIUS server supporting 802.1X EAP-TLS authentication. Mobile clients connecting over high-latency cellular links experience frequent authentication timeouts caused by real-time Certificate Revocation List (CRL) downloads. To optimize client authentication performance and ensure secure server identity verification, which of the following mechanisms or configurations should the administrator implement? (Select TWO).

  1. Enable OCSP stapling on the RADIUS server to deliver signed revocation status directly within the TLS handshake.Answer
  2. Configure the server certificate with Subject Alternative Name (SAN) extensions and Server Authentication Extended Key Usage (EKU) attributes.Answer
  3. C
    Export the private key of the issuing Root CA to mobile endpoints so clients can sign local revocation responses offline.
  4. D
    Embed an AES-256 symmetric pre-shared key inside the server's Certificate Signing Request (CSR) to encrypt status checks.
  5. E
    Generate SHA-256 hashes of client public keys to establish non-repudiation without performing digital signature verification.

Answer

The correct configurations are enabling OCSP stapling on the server to provide direct revocation status during the TLS handshake, and configuring the server certificate with proper Subject Alternative Name (SAN) and Extended Key Usage (EKU) attributes.
Enabling OCSP stapling shifts the burden of fetching revocation status to the server, which attaches a time-stamped OCSP response signed by the CA directly inside the TLS handshake, eliminating out-of-band client network requests. Additionally, configuring Subject Alternative Name (SAN) and Extended Key Usage (EKU) attributes ensures that clients can validate server identity and authorized usage roles per EAP-TLS standards.

Step-by-Step Solution

1
Identify performance bottleneck in PKI revocation checking for mobile clients.
Real-time CRL downloads cause network overhead and connection timeouts on high-latency links.
Downloading complete CRL files requires separate client-side HTTP/LDAP requests.
2
Select server-side status optimization technique.
OCSP stapling caches a signed revocation assertion on the server and includes it during the TLS handshake.
This removes the requirement for the client to contact an external OCSP responder or download large CRLs.
3
Ensure server certificate configuration supports 802.1X identity validation.
Proper SAN entries and EKU attributes (Server Authentication) allow clients to verify server identity without certificate validation errors.
EAP-TLS clients strictly validate server purpose and hostname alignment.

Key Concept

Public Key Infrastructure, OCSP Stapling, and Certificate Extensions
Rate this question

Topics

Public Key Infrastructure and Certificate Management

More questions from this topic