Exam CAS-004 topic 1 question 587 discussion

Actual exam question from CompTIA's CAS-004

Question #: 587
Topic #: 1

An organization wants to set up an internal PKI to support encrypting traffic between internal support web applications and user’s endpoint devices. A security policy requires that certificates must validate for each request to reduce the risk of an on-path attack. The business requires that the solution does not reduce the response of the web applications. Which of the following solutions would best satisfy both the security and business requirements?

A. Require each endpoint to validate using a CRL.
B. Implement certificate pinning for all web applications.
C. Outsource PKI management to a managed service provider.
D. Configure the CA to support OCSP responder services.

Show Suggested Answer

Suggested Answer: D 🗳️

by Bright07 at Jan. 25, 2025, 2:55 a.m.

Comments

Submit Cancel

Bright07

5 months ago

Selected Answer: D

D. Configure the CA to support OCSP responder services. Reason : OCSP (Online Certificate Status Protocol) provides a method for checking the revocation status of certificates in real time. This allows the web applications to verify the validity of certificates quickly without needing to download a full Certificate Revocation List (CRL) every time a request is made. This satisfies both the security requirement (ensuring that certificates are valid and not revoked) and the business requirement (not impacting the web application’s response time significantly).

upvoted 3 times

...