CAS-002 · Question #860
Using SSL, an administrator wishes to secure public facing server farms in three subdomains: dc1.east.company.com, dc2.central.company.com, and dc3.west.company.com. Which of the following is the…
The correct answer is C. 3. Because each subdomain sits under a different second-level domain, a separate wildcard certificate is required for each parent domain, totaling three certificates.
Question
Using SSL, an administrator wishes to secure public facing server farms in three subdomains:
dc1.east.company.com, dc2.central.company.com, and dc3.west.company.com. Which of the following is the number of wildcard SSL certificates that should be purchased?
Options
- A0
- B1
- C3
- D6
How the community answered
(36 responses)- A3% (1)
- B6% (2)
- C81% (29)
- D11% (4)
Why each option
Because each subdomain sits under a different second-level domain, a separate wildcard certificate is required for each parent domain, totaling three certificates.
Purchasing zero wildcard certificates would leave all three public-facing servers without SSL coverage, violating the stated security requirement.
A single wildcard for *.company.com does not cover third-level hostnames such as dc1.east.company.com because RFC 6125 restricts wildcard matching to a single DNS label.
A wildcard certificate (e.g., *.east.company.com) matches exactly one label to the left of the defined domain and does not extend across multiple subdomain levels. Since dc1.east.company.com, dc2.central.company.com, and dc3.west.company.com each belong to distinct second-level domains under company.com, three separate wildcard certificates - one per parent domain - are the minimum needed to secure all three hosts.
Six certificates far exceeds the minimum; three wildcard certificates are sufficient to cover the required subdomains with no redundancy needed.
Concept tested: Wildcard SSL certificate scope and subdomain coverage
Source: https://www.rfc-editor.org/rfc/rfc6125
Topics
Community Discussion
No community discussion yet for this question.