nerdexam
Fortinet

NSE4 · Question #455

Which of the following statements must be true for a digital certificate to be valid? (Choose two.)

The correct answer is A. It must be signed by a "trusted" CA D. It must be still within its validity period. For a digital certificate to be considered valid, it must be issued by a trusted Certificate Authority (CA) and its current date must fall within its specified validity period.

Submitted by lars.no· Apr 18, 2026Firewall and Authentication

Question

Which of the following statements must be true for a digital certificate to be valid? (Choose two.)

Options

  • AIt must be signed by a "trusted" CA
  • BIt must be listed as valid in a Certificate Revocation List (CRL)
  • CThe CA field must be "TRUE"
  • DIt must be still within its validity period

How the community answered

(25 responses)
  • A
    92% (23)
  • B
    4% (1)
  • C
    4% (1)

Why each option

For a digital certificate to be considered valid, it must be issued by a trusted Certificate Authority (CA) and its current date must fall within its specified validity period.

AIt must be signed by a "trusted" CACorrect

A digital certificate is considered valid only if it has been signed by a Certificate Authority (CA) that is implicitly or explicitly trusted by the entity verifying the certificate, forming a chain of trust.

BIt must be listed as valid in a Certificate Revocation List (CRL)

A valid certificate must *not* be listed as revoked in a Certificate Revocation List (CRL); being listed as 'valid' in a CRL is not a condition for validity, as CRLs list *invalid* certificates.

CThe CA field must be "TRUE"

The 'CA field' (Basic Constraints extension with cA:TRUE) indicates if a certificate can function as a Certificate Authority to sign other certificates, which is a property of CA certificates, not a universal requirement for an end-entity digital certificate to be valid.

DIt must be still within its validity periodCorrect

Every digital certificate includes a 'Not Before' and 'Not After' date, and for the certificate to be valid, the current date and time must fall strictly within this defined validity period.

Concept tested: Digital certificate validity requirements

Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/design/certificate-revocation-and-status-checking

Topics

#Digital Certificates#Certificate Validity#PKI#Trusted CA

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full NSE4 Practice