SY0-501 · Question #267
The firewall administrator is adding a new certificate for the company's remote access solution. The solution requires that the uploaded file contain the entire certificate chain for the certificate…
The correct answer is B. Intermediate authority. The certificate upload was rejected because the firewall administrator failed to include the intermediate authority certificate, which is a required component for completing the certificate trust chain between the end-entity certificate and the root CA.
Question
The firewall administrator is adding a new certificate for the company's remote access solution. The solution requires that the uploaded file contain the entire certificate chain for the certificate to load properly. The administrator loads the company certificate and the root CA certificate into the file. The file upload is rejected. Which of the following is required to complete the certificate chain?
Options
- ACertificate revocation list
- BIntermediate authority
- CRecovery agent
- DRoot of trust
How the community answered
(31 responses)- A6% (2)
- B77% (24)
- C13% (4)
- D3% (1)
Why each option
The certificate upload was rejected because the firewall administrator failed to include the intermediate authority certificate, which is a required component for completing the certificate trust chain between the end-entity certificate and the root CA.
A Certificate Revocation List (CRL) is used to check the revocation status of a certificate, not to build the trust path of the certificate chain itself.
A complete certificate chain establishes a path of trust from the end-entity certificate (the company certificate) to the trusted root CA certificate. If the company certificate was issued by an intermediate certificate authority, that intermediate certificate is a critical component missing between the end-entity and the root CA, and its absence prevents the chain from being validated properly.
A recovery agent is a specific role, often used in scenarios like Encrypting File System (EFS) for key recovery, and is unrelated to completing a certificate trust chain.
The root of trust is typically the root CA certificate, which the question states was already included in the uploaded file, indicating the issue is with the incomplete path leading to it.
Concept tested: Certificate chain building and validation components
Source: https://learn.microsoft.com/en-us/windows/win32/seccrypto/certificate-chains#chain_building
Topics
Community Discussion
No community discussion yet for this question.