Examkin

Question

Difficulty: MediumPublic Key Infrastructure and Certificate Management

A security architect is deploying TLS certificates for three newly established internal microservices hosted on distinct domain structures: identity.corp.local, billing.corp.internal, and api.corp.com. To simplify management, the architect intends to issue a single digital certificate that will be trusted and valid across all three different fully qualified domain names. Which of the following configuration options should the security architect specify during certificate generation to achieve this goal?

  1. Subject Alternative Name (SAN) extensionAnswer
  2. B
    Wildcard certificate request
  3. C
    Shared symmetric encryption key pair
  4. D
    Non-repudiation key usage flag

Answer

The Subject Alternative Name (SAN) extension should be specified in the certificate request.
The correct option is the Subject Alternative Name (SAN) extension. SAN is an X.509 extension that allows security professionals to specify multiple hostnames, IP addresses, or domain names (including different top-level domains) in a single SSL/TLS certificate.

Step-by-Step Solution

1
Analyze the technical requirements of the scenario.
The requirement demands securing three distinct domain names (identity.corp.local, billing.corp.internal, and api.corp.com) using a single digital certificate.
Different domain names with varied top-level domains cannot be covered by standard single-domain certificates or wildcard certificates.
2
Evaluate PKI certificate extension options for multi-domain support.
The Subject Alternative Name (SAN) X.509 extension field explicitly allows multiple discrete hostnames and domain names to be embedded within a single certificate.
SAN extensions provide flexible identity binding across unrelated domain structures.

Key Concept

Subject Alternative Name (SAN) Certificates
Estimated Time:1m 15s
Rate this question

Topics

Public Key Infrastructure and Certificate Management

More questions from this topic