MENU
Service A requires self-signed digital certificates from all of its service consumers. The service and its service consumers both belong to the same organization. You are presented with a new requirement to only allow access to those service consumers with certificates that have not expired. How can this requirement be addressed with minimal impacts on the current security architecture?
Suggested Answer: A
Get Premium S90.18 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
33 comments · newest first
RE
Rebecka
10 months ago
Signing with an external CA seems unnecessary for this setup.
MI
Miss
10 months ago
Wait, can self-signed certs really handle expiry checks?
DA
Daisy
11 months ago
I think option D might be the best choice here.
HO
Hoa
11 months ago
Totally agree, option A makes sense!
BE
Berry
11 months ago
The certificates have validity periods, so we can check that.
WI
Willodean
11 months ago
I don't think any of the options fully address the requirement. Maybe option D is the best choice, but I need to think it through more.
LU
Luis
11 months ago
I feel like using certificates is definitely valid in this case, so option C seems wrong. But I can't recall the specifics of how to check expiry.
NO
Nobuko
12 months ago
I think we discussed something similar in class about using external CAs for revocation lists. Option B sounds plausible, but it might complicate things.
CO
Colette
12 months ago
I remember that self-signed certificates have validity periods, so maybe option A is correct? But I'm not entirely sure how that works in practice.
ER
Erick
12 months ago
Hmm, I'm not sure. I'll need to think this through carefully and consider all the options before deciding on the best approach.
LE
Leandro
1 year ago
Using certificates in this scenario doesn't seem like a valid option to me. There must be a better way to handle this requirement.
TE
Teri
1 year ago
I'm a bit confused on this one. Wouldn't we need to use an external certificate authority to access the CRL and check the expiry dates?
RA
Raelene
1 year ago
This seems like a straightforward question. The current security mechanism should already address the requirement since the certificates contain a validity period.
PU
Pura
1 year ago
Ah, the old 'self-signed certificates in the same organization' trick. It's like they're trying to make this question as confusing as possible. I'm just going to go with the CRL option and call it a day.
ST
Stanton
1 year ago
Yeah, I agree. None of the above might be the safest choice.
AU
Audrie
1 year ago
I'm not sure, but using certificates may not be the best option here.
ED
Edelmira
1 year ago
But what if the current security mechanism already covers the expiry dates?
DI
Dierdre
1 year ago
I think the CRL option is the way to go.
HA
Haydee
1 year ago
I'm not sure about either option. Maybe we should consider other alternatives.
IN
India
1 year ago
I disagree, I believe option B is the way to go. We need to have access to the CRL to check expiry dates.
DA
Dana
1 year ago
Haha, 'None of the above'? Well, that's a convenient answer. I guess the exam writers ran out of ideas and just threw that in as a catch-all.
LE
Leontine
1 year ago
Haha, yeah, 'None of the above' does seem like a bit of a cop-out.
CA
Casey
1 year ago
A) The current security mechanism already addresses this requirement because the certificates contain a value that represents the validity period.
BR
Brynn
1 year ago
I think option A is the best choice because the certificates already have the validity period.
BO
Bobbie
1 year ago
Using certificates is not a valid option? What is this, the dark ages? Everything runs on certificates these days. That's a bit of a stretch, don't you think?
ZO
Zona
1 year ago
Ah, I see. We need to go the external CA route to get access to the CRL. Seems like a bit of a hassle, but I guess it's the most secure option.
JO
Joni
1 year ago
Ah, I see. We need to go the external CA route to get access to the CRL. Seems like a bit of a hassle, but I guess it's the most secure option.
JO
Jose
1 year ago
B) The certificates need to be signed by an external certificate authority so that the certificate authority's Certificate Revocation List (CRL) can be accessed in order to check the expiry dates of the certificates.
TI
Timmy
1 year ago
A) The current security mechanism already addresses this requirement because the certificates contain a value that represents the validity period.
BE
Benedict
1 year ago
The current security mechanism already addresses this requirement? Really? How can that be if we need to check for expired certificates? Sounds like a stretch to me.
JE
Jerry
1 year ago
A) I agree, the current security mechanism should already have a way to check for expired certificates. It's important to ensure the validity of the certificates.
SI
Silvana
1 year ago
B) The certificates need to be signed by an external certificate authority so that the certificate authority's Certificate Revocation List (CRL) can be accessed in order to check the expiry dates of the certificates.
LU
Luis
1 year ago
A) The current security mechanism already addresses this requirement because the certificates contain a value that represents the validity period.