SY0-501 · Question #467
User from two organizations, each with its own PKI, need to begin working together on a joint project. Which of the following would allow the users of the separate PKIs to work together without…
The correct answer is A. Trust model. When two organizations with separate PKIs need to collaborate, a trust model (specifically cross-certification or bridge CA trust) allows each PKI to recognize and validate certificates issued by the other, eliminating connection errors caused by untrusted certificate chains.
Question
User from two organizations, each with its own PKI, need to begin working together on a joint project. Which of the following would allow the users of the separate PKIs to work together without connection errors?
Options
- ATrust model
- BStapling
- CIntermediate CA
- DKey escrow
How the community answered
(26 responses)- A73% (19)
- B15% (4)
- C4% (1)
- D8% (2)
Why each option
When two organizations with separate PKIs need to collaborate, a trust model (specifically cross-certification or bridge CA trust) allows each PKI to recognize and validate certificates issued by the other, eliminating connection errors caused by untrusted certificate chains.
A trust model, specifically cross-certification or a bridge CA arrangement, enables two independent PKIs to mutually recognize each other's Certificate Authorities. By establishing this trust relationship, certificates issued by either organization's CA are considered valid by the other, allowing users to authenticate and communicate without certificate trust errors.
Stapling (OCSP stapling) is a performance and privacy optimization that allows a web server to cache and present its own certificate revocation status, which does not address cross-organizational PKI trust issues.
An Intermediate CA is a subordinate CA within a single PKI hierarchy used to delegate certificate issuance, but it does not by itself establish trust between two completely separate PKI infrastructures.
Key escrow is a mechanism for storing copies of cryptographic keys with a trusted third party for recovery purposes, and has no role in establishing trust between two separate PKIs.
Concept tested: Cross-organizational PKI trust model establishment
Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/cross-certification-and-qualified-subordination
Topics
Community Discussion
No community discussion yet for this question.