Your company wants greater visibility into their traffic and has asked you to start planning an SSL Decryption project. The company does not have a PKI infrastructure, and multiple certificates…

Question

Options

• Aself-signed root CA
• Bexternal CA certificate
• Cserver certificate
• Ddevice certificate

• A
  86% (24)
• B
  7% (2)
• C
  4% (1)
• D
  4% (1)

Explanation

A self-signed root CA is correct because a Certificate Authority (CA) certificate is specifically designed to sign and issue other certificates - it contains the CA:TRUE basic constraint, giving it the authority to generate subordinate certificates. This is exactly what's needed when no external PKI exists and multiple certificates must be created for an SSL decryption deployment.

Why the distractors are wrong:

• B (External CA certificate): This relies on a third-party CA infrastructure, which the company doesn't have and would require ongoing cost and dependency on an outside vendor.
• C (Server certificate): Server certificates are end-entity certificates issued to servers for identity purposes - they cannot sign or issue other certificates.
• D (Device certificate): Device certificates authenticate specific devices; like server certs, they are leaf certificates with no signing authority.

Memory tip: Think of a root CA as the "parent" - only a parent can have children (issue other certs). Server and device certificates are "children" that can't have children of their own. When you see "generate other certificates," always look for the CA.

No community discussion yet for this question.