A security architect wants to ensure a remote host's identity and decides that pinning the X.509 certificate to the device is the most effective solution. Which of the following must happen first?

The correct answer is C. Use an out-of-band method to obtain the certificate.. When implementing certificate pinning, the first step is to securely obtain the remote host's X.509 certificate through an out-of-band method. This ensures that the certificate is trusted and verified outside of the regular communication channel (e.g., via a secure channel or pre

Submitted by luis.pe· Mar 6, 2026Security Architecture

Question

Options

AUse Distinguished Encoding Rules (DER) for the certificate.
BExtract the private key from the certificate.
CUse an out-of-band method to obtain the certificate.
DCompare the retrieved certificate with the embedded certificate.

How the community answered

(65 responses)

A
2% (1)
B
11% (7)
C
83% (54)
D
5% (3)

Explanation

When implementing certificate pinning, the first step is to securely obtain the remote host's X.509 certificate through an out-of-band method. This ensures that the certificate is trusted and verified outside of the regular communication channel (e.g., via a secure channel or pre- distribution), preventing any potential man-in-the-middle attacks. Once the certificate is securely obtained and verified, it can then be pinned to the device so that future connections to that host will only be accepted if the certificate matches the pinned one.

Community Discussion

No community discussion yet for this question.

Full CAS-005 Practice