Exam CAS-004 topic 1 question 638 discussion

The correct answer is C. Use an out-of-band method to obtain the certificate. Certificate pinning involves associating (or "pinning") a specific certificate or public key to a particular host or service. In this case, pinning the X.509 certificate to the device means the device will only trust a specific certificate for that remote host, ensuring the identity of the remote host can be verified. Before pinning a certificate, you must first securely obtain the correct certificate from the remote host. This is typically done via an out-of-band method, meaning you get the certificate securely through a trusted channel (e.g., via secure email, a trusted administrator, or a physical method) to ensure you're not receiving a potentially compromised certificate from an untrusted or attacker-controlled source. Once you have the correct certificate, you can then store (pin) it to the device and compare any future certificates presented by the remote host against the pinned certificate to ensure the identity is genuine.