Examkin

Question

Difficulty: MediumPublic Key Infrastructure and Certificate Management

A security administrator is optimizing the Public Key Infrastructure (PKI) architecture for an enterprise web portal that hosts services across multiple distinct domain names. The administrator must eliminate client-side OCSP lookup delays during TLS handshakes and consolidate multi-domain identity validation into a single digital certificate. Which of the following PKI mechanisms should the administrator implement to meet these objectives? (Select TWO.)

  1. Enable OCSP stapling on the web servers to deliver a cached, signed revocation status response directly during the TLS handshake.Answer
  2. Include Subject Alternative Name (SAN) extension entries in the Certificate Signing Request to secure multiple distinct domain names under one certificate.Answer
  3. C
    Configure key escrow on the public CA to store private keys for non-repudiation and automated CSR issuance.
  4. D
    Generate private keys centrally on the Certificate Authority and transmit them embedded inside the CSR file.
  5. E
    Replace asymmetric TLS certificates with static symmetric keys distributed to all client browsers.

Answer

The correct options are enabling OCSP stapling on the web servers and using the Subject Alternative Name (SAN) extension in the Certificate Signing Request.
Enabling OCSP stapling shifts the burden of fetching certificate status from the client to the server, which caches a signed status response from the CA and staple it to the TLS handshake, reducing latency. Utilizing Subject Alternative Name (SAN) extensions allows an organization to secure multiple different domains and hostnames with a single certificate.

Step-by-Step Solution

1
Identify the mechanism that resolves client-side OCSP lookup delays during TLS handshakes.
OCSP stapling allows the web server to cache the CA's signed revocation response and present it to the client during the TLS handshake, eliminating extra client queries.
This offloads latency and protects client browsing privacy.
2
Identify the certificate extension designed for supporting multiple distinct fully qualified domain names (FQDNs).
The Subject Alternative Name (SAN) extension allows a single X.509 certificate to specify multiple hostnames and domain names.
This fulfills the requirement to consolidate multi-domain identity coverage into one certificate.

Key Concept

Public Key Infrastructure (PKI) Certificate Extensions and Revocation Protocols
Rate this question

Topics

Public Key Infrastructure and Certificate Management

More questions from this topic