Which of the following MUST be updated immediately when an employee is terminated to prevent unauthorized access?

Registration in a PKI context refers to the process of enrolling for a certificate through a Registration Authority and is not an action taken during employee termination.

The Certificate Authority (CA) issues and signs certificates but updating the CA itself is not the immediate action required - the CA publishes the CRL, which is what needs updating.

The CRL (Certificate Revocation List) is a published list of digital certificates that have been revoked before their expiration date. When an employee is terminated, their certificate must be immediately added to the CRL so that any system validating that certificate will reject it, preventing the former employee from authenticating or accessing protected resources.

A recovery agent is designated to recover encrypted data if a user loses their key, not a component that needs updating to revoke access upon termination.