210-250 · Question #192
When using PKI which two of the following are true? (Choose two.)
The correct answer is A. Currently, PKI digital identity certificates use the X.509 version 3 structure. C. A client device must trust the CA in order to validate another device certificate that is issued by. PKI digital certificates use the X.509 v3 standard, and clients must trust the issuing CA to validate peer certificates. Constant CA contact is not required, and CAs do sign end-entity certificates.
Question
When using PKI which two of the following are true? (Choose two.)
Options
- ACurrently, PKI digital identity certificates use the X.509 version 3 structure.
- BCurrently, the PKI architecture requires that the client devices stay in constant contact with the
- CA client device must trust the CA in order to validate another device certificate that is issued by
- DThe CA does not sign the user or device certificate; it only signs its own root certificate
How the community answered
(59 responses)- A86% (51)
- B8% (5)
- D5% (3)
Why each option
PKI digital certificates use the X.509 v3 standard, and clients must trust the issuing CA to validate peer certificates. Constant CA contact is not required, and CAs do sign end-entity certificates.
X.509 version 3 is the current industry standard for PKI digital identity certificates, extending earlier versions with support for certificate extensions that define key usage, subject alternative names, and policy constraints.
PKI does not require constant CA contact - certificate validation is performed locally using the CA's already-trusted public key, with CRL downloads or OCSP queries used periodically only to check revocation status.
PKI trust is chain-based - a client must have the issuing CA certificate in its trusted store so it can use the CA's public key to cryptographically verify the digital signature on a peer's certificate, confirming the certificate is authentic and unmodified.
The CA does sign end-entity (user and device) certificates using its private key - this is the core PKI mechanism that binds an entity's identity to its public key and establishes trust for relying parties.
Concept tested: PKI trust chain and X.509 v3 certificate standard
Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/active-directory-certificate-services-overview
Topics
Community Discussion
No community discussion yet for this question.