SY0-301 · Question #614
Which of the following identifies certificates that have been compromised or suspected of being compromised?
The correct answer is A. Certificate revocation list. A Certificate Revocation List (CRL) is a published list maintained by a Certificate Authority that identifies digital certificates that have been revoked before their scheduled expiration date.
Question
Which of the following identifies certificates that have been compromised or suspected of being compromised?
Options
- ACertificate revocation list
- BAccess control list
- CKey escrow registry
- DCertificate authority
How the community answered
(20 responses)- A90% (18)
- C5% (1)
- D5% (1)
Why each option
A Certificate Revocation List (CRL) is a published list maintained by a Certificate Authority that identifies digital certificates that have been revoked before their scheduled expiration date.
A Certificate Revocation List is issued and digitally signed by a Certificate Authority and contains the serial numbers of all certificates that have been revoked due to compromise, key loss, or policy violation. Relying parties check the CRL before trusting a certificate to ensure it has not been invalidated. OCSP (Online Certificate Status Protocol) is a real-time alternative to CRLs for the same purpose.
An Access Control List defines permissions for network resources or file system objects and has no role in tracking certificate status.
Key escrow is a system for storing copies of cryptographic keys for authorized recovery, not for tracking revoked certificates.
A Certificate Authority issues and manages certificates but the specific mechanism for listing revoked certificates is the CRL it publishes.
Concept tested: Certificate Revocation List PKI trust management
Source: https://learn.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/configure-the-cdp-and-aia-extensions-on-ca1
Topics
Community Discussion
No community discussion yet for this question.