Exam SY0-601 topic 1 question 123 discussion

We need to revoke the code-signing certificate as this is the most secure way to ensure that the comprised key wont be used by attackers. Usually there are bots crawking all over repos searching this kind of human errors.

In this scenario, the company's code-signing certificate private key has been exposed to the public, which is a significant security concern. The first and most critical step the company should take is to revoke the compromised code-signing certificate. By revoking the certificate, the company informs all parties that the certificate is no longer trustworthy and should not be used for signing applications or code. After revoking the certificate, the company can then proceed with other necessary actions, such as verifying that the public key is not exposed, deleting the private key from the repository, and updating the Data Loss Prevention (DLP) solution to check for private keys. However, the immediate priority is to prevent the malicious use of the compromised certificate by revoking it as soon as possible.

MR. application developer is about to be fired lmao

CAs revoke certificates for several reasons such as when the private key is compromised or the CA is compromised

D. Revoke the code-signing certificate

In the scenario described, the company's code-signing certificate private key has been accidentally uploaded to a public web server. This poses a significant security risk as malicious actors could potentially use the private key to sign malicious code, impersonating the company. The first and most critical step the company should take is to revoke the code-signing certificate. By revoking the certificate, any code that was previously signed with it will no longer be trusted, and the risk of malicious use is mitigated. After revoking the certificate, the company can take further actions such as deleting the private key from the repository, verifying the public key is not exposed, and updating the Data Loss Prevention (DLP) solution to check for private keys. However, the immediate priority is to revoke the certificate to prevent further damage or misuse.

MorganB 0 minutes ago Awaiting moderator approval Pass my exam 27, April 23. This question was on my tested worded differently but the answer is the same.

D. Revoke the code-signing certificate.

revoke the certificate and you should perform user training to minimize the chance for this to happen again

D is containment

This is D

Revoke they certificate with a revocation authority, and go about getting a new one with a certificate authority.