An attacker compromises a public CA and issues unauthorized X.509 certificates for Company.com. In the future, impact of similar incidents. Which of the following would assist Company.com with its…

Certificate pinning associates a specific host with its expected public key or certificate, so even if a rogue CA issues a fraudulent certificate for Company.com, clients configured with the pin will reject it because it does not match the pinned value. This directly mitigates the risk of unauthorized certificates issued by compromised CAs by bypassing normal CA chain-of-trust validation in favor of a hard-coded trusted identity.

Certificate stapling (OCSP Stapling) allows a server to provide a pre-fetched, CA-signed OCSP response to prove its certificate has not been revoked, but it does not prevent a compromised CA from issuing and having clients trust an unauthorized certificate.

Certificate chaining establishes the trust path from an end-entity certificate up to a trusted root CA, but if the root CA itself is compromised, the entire chain built from it remains trusted, offering no protection against unauthorized issuance.

Extended Validation (EV) certificates provide a higher level of identity vetting by the CA during issuance, but if the CA is compromised, an attacker can still obtain EV certificates fraudulently, providing no additional technical protection against unauthorized certificates.