Exam SY0-601 topic 1 question 858 discussion

Actual exam question from CompTIA's SY0-601

Question #: 858
Topic #: 1

A security analyst is reviewing a secure website that is generating TLS certificate errors. The analyst determines that the browser is unable to receive a response from the OCSP for the certificate. Which of the following actions would most likely resolve the issue?

A. Run a traceroute on the OCSP domain to find where the domain is failing.
B. Create an exclusion for the OCSP domain in the content filter
C. Unblock the OCSP protocol in the host-based firewall
D. Add the root certificate to the trusted sites on the workstation with the issue.

Show Suggested Answer

Suggested Answer: C 🗳️

by CircaG at March 24, 2024, 5:07 p.m.

Comments

Submit Cancel

CircaG

Highly Voted 1 year, 3 months ago

Selected Answer: C

C. OCSP (Online Certificate Status Protocol) is used to check the validity of certificates, and if the browser is unable to receive a response from the OCSP server due to firewall restrictions, it may result in TLS certificate errors. By unblocking the OCSP protocol in the host-based firewall, the browser will be able to communicate with the OCSP server and verify the certificate's validity, resolving the issue.

upvoted 5 times

LuckyAro

1 year, 3 months ago

Nowhere in the question was it mentioned that OCSP was blocked due to firewall restrictions, this is an assumption, it could be anything causing this connection issue.

upvoted 5 times

ps1hacker

1 year, 3 months ago

I find a lot of these CompTIA questions require some assumption. For example there are answer that says "change the default pw" even though it never says they are using the default pw in the question. For me, it seems if there is an answer for it, its safe to assume they are using that practice.

upvoted 1 times

NetworkTester1235

1 year, 2 months ago

If its not stated in the question then it never happened

upvoted 2 times

spearous

1 year, 2 months ago

No, the question can be paraphrased as: from you experience, what could be happened most likely? the question is asking your best guess.

upvoted 1 times

...

LarryMJ

Most Recent 1 month ago

Selected Answer: B

A. Run a traceroute – This helps diagnose routing issues but doesn’t fix the problem. It’s a troubleshooting step, not a solution. C. Unblock the OCSP protocol in the host-based firewall – OCSP is HTTP-based (usually port 80), so it doesn't need a special protocol unblock; unlikely to be blocked this way. D. Add the root certificate to the trusted sites – This helps with certificate trust, but if OCSP can't be reached, the trust chain still fails due to revocation checking errors.

upvoted 1 times

...

shady23

1 year, 2 months ago

Selected Answer: C

C. Unblock the OCSP protocol in the host-based firewall

upvoted 1 times

...

MortG7

1 year, 3 months ago

This was bugging me. Sorry for all the verbiage, but here is what I found: 6. Generic SSL Protocol Error This error is particularly tricky to resolve because there are multiple potential causes, including: A firewall or other security software interfering with the SSL protection. Check your firewall or security software settings to ensure they're not blocking or interfering with SSL connections. Then, try disabling any features that might disrupt your SSL. Obviously, TLS is the replacement for SSL as many of you already know.

upvoted 3 times

...

paCer66

1 year, 3 months ago

B. OCSP (non-stapling) is using http:// protocol -> no C, no D. A is meaningless here. Maybe the similar scenario as here: https://community.meraki.com/t5/Security-SD-WAN/http-ocsp-digicert-com-categorized-as-a-Malware-Site/m-p/7786

upvoted 3 times

...