While implementing a PKI for a company, a security analyst plans to utilize a dedicated server as the certificate authority that is only used to sign intermediate certificates. Which of the…

The correct answer is C. Powered off F. Air gapped. Powered off: This prevents malicious actors from accessing the CA remotely. When the server is not actively required for signing, it should be completely powered down so that there is no attack surface for threat actors to exploit, no network connectivity, and no running…

Submitted by lars.no· Mar 6, 2026Security Operations

Question

While implementing a PKI for a company, a security analyst plans to utilize a dedicated server as the certificate authority that is only used to sign intermediate certificates. Which of the following are the MOST secure states for the certificate authority server when it is not in use? (Choose two.)

Options

AOn a private VLAN
BFull disk encrypted
CPowered off
DBacked up hourly
EVPN accessible only
FAir gapped

How the community answered

(44 responses)

A
2% (1)
B
9% (4)
C
82% (36)
D
2% (1)
E
5% (2)

Explanation

Powered off: This prevents malicious actors from accessing the CA remotely. When the server is not actively required for signing, it should be completely powered down so that there is no attack surface for threat actors to exploit, no network connectivity, and no running processes. Air gapped: An air-gapped system is physically isolated from any networks, including local and external (internet), making remote attacks and unauthorized access nearly impossible. This aligns with industry best practice where root or offline CAs are not connected to any network except during key ceremonies or signing sessions.

Topics

#PKI security#Certificate Authority#Air gap#Secure configuration

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice