SY0-501 · Question #39
A security administrator is trying to encrypt communication. For which of the following reasons should administrator take advantage of the Subject Alternative Name (SAM) attribute of a certificate?
The correct answer is B. It provides extended site validation. The Subject Alternative Name (SAN) attribute allows a single certificate to validate the identity of multiple hostnames or services, which is crucial for encrypting communication across varied domains or subdomains.
Question
A security administrator is trying to encrypt communication. For which of the following reasons should administrator take advantage of the Subject Alternative Name (SAM) attribute of a certificate?
Options
- AIt can protect multiple domains
- BIt provides extended site validation
- CIt does not require a trusted certificate authority
- DIt protects unlimited subdomains
How the community answered
(25 responses)- A12% (3)
- B72% (18)
- C4% (1)
- D12% (3)
Why each option
The Subject Alternative Name (SAN) attribute allows a single certificate to validate the identity of multiple hostnames or services, which is crucial for encrypting communication across varied domains or subdomains.
While the SAN attribute enables a single certificate to protect multiple domains by listing them, 'extended site validation' (B) more precisely describes the technical *reason* the certificate is trusted for these multiple identities.
The SAN attribute allows an SSL/TLS certificate to specify multiple distinct hostnames, IP addresses, or URIs for which the certificate is valid. When a client connects to any of these listed identities, it can successfully validate the certificate against the accessed hostname, effectively extending the scope of identity validation beyond a single common name.
Publicly trusted SSL/TLS certificates, including those utilizing SANs, fundamentally require issuance by a trusted Certificate Authority (CA) to be automatically trusted by client devices and browsers.
The SAN attribute allows explicit listing of multiple specific subdomains; however, it does not provide generic 'unlimited' subdomain protection, which is typically a function of wildcard certificates.
Concept tested: SSL/TLS Certificate Subject Alternative Name (SAN) functionality for multi-domain validation
Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/adcs-appendix-b--revocation-configuration-examples#subject-alternative-name-san-extension
Topics
Community Discussion
No community discussion yet for this question.