GSLC · Question #25
You work as a Network Administrator for NetTech Inc. The company has a Windows Server 2008 Active Directory-based single domain single forest network. The company's network is connected to the…
The correct answer is A. Take the root enterprise CA offline after it issues certificates to its subordinate CAs. In a PKI hierarchy, taking the root CA offline after issuing certificates to subordinate CAs is a critical security best practice to protect the trust anchor of the entire infrastructure.
Question
You work as a Network Administrator for NetTech Inc. The company has a Windows Server 2008 Active Directory-based single domain single forest network. The company's network is connected to the Internet through a T1 line. The firewall is configured on the network for securing the internal network from the intruders on the Internet. You are designing a public key infrastructure (PKI) for the network. The network will use a root enterprise certificate authority (CA) and two subordinate CAs. The root CA will be used to issue certificates to the subordinate CAs, and the subordinate CAs will be used to issue certificates to the clients. The security policy of the company dictates that the security of high-level CAs should not be compromised. Which of the following steps will you take to implement the security policy of the company?
Options
- ATake the root enterprise CA offline after it issues certificates to its subordinate CAs.
- BPlace all CA servers in a locked room.
- CTake subordinate CAs offline after they get their certificates from the root CA.
- DConfigure a firewall on the network.
How the community answered
(62 responses)- A71% (44)
- B18% (11)
- C6% (4)
- D5% (3)
Why each option
In a PKI hierarchy, taking the root CA offline after issuing certificates to subordinate CAs is a critical security best practice to protect the trust anchor of the entire infrastructure.
The root CA is the trust anchor of the entire PKI hierarchy, and if it is compromised, all certificates issued by any CA in the chain become untrusted. Taking the root CA offline after issuing certificates to subordinate CAs eliminates its network attack surface entirely, since it only needs to be brought online to renew or revoke subordinate CA certificates. This is a standard PKI hardening practice aligned with Windows Server CA deployment guidance.
Physical security of a locked room is a supplementary control but does not address network-based attacks against an online root CA.
Subordinate CAs must remain online continuously to issue and revoke certificates for clients; taking them offline would break normal PKI operations.
A firewall is already configured on the network per the scenario, and it protects perimeter traffic but does not specifically protect the root CA from internal compromise.
Concept tested: PKI root CA offline security best practice
Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/pki-design-guide
Topics
Community Discussion
No community discussion yet for this question.