You work as a Network Administrator for Tech Perfect Inc. The company has a Windows Active Directory-based single domain single forest network. The company's network is connected to the Internet throu

The root CA is the ultimate trust anchor in a PKI hierarchy - once it has signed the subordinate CA certificates, it has no further operational need to remain online. Keeping it offline (air-gapped) eliminates its exposure to network-based attacks, and if a subordinate CA is ever compromised, the isolated root CA can still be used to revoke and reissue subordinate CA certificates without itself being at risk.

Taking the subordinate CA offline defeats its operational purpose - it must remain online and accessible to issue, renew, and revoke certificates for clients on an ongoing basis.

Placing CA servers in a locked room is a physical security control that does not address network-based compromise, which is the primary attack vector for a high-level CA.

A firewall is already described as present on the network and provides perimeter defense, but it does not isolate the root CA from network-based attacks the way taking it offline does.