ISC2 Exam ISSAP Topic 4 Question 12 Discussion

longer valid, and therefore should not be relied upon. A CRL is generated and published periodically, after a defined timeframe. A CRL can also

be published immediately after a certificate has been revoked. The CRL is always issued by the CA which issues the corresponding certificates.

All CRLs have a lifetime during which they are valid; this timeframe is often 24 hours or less. During a CRL's validity period, it may be consulted

by a PKI-enabled application to verify a certificate prior to use.

Answer option A is incorrect. A certification Practice Statement (CPS) is a policy document, defined by the American Bar Association. The CPS is

associated with a certification authority (CA). It defines the measures that are used to secure CA operations and management of the

certificates issued by the CA. The CPS can be considered as an agreement between the organization managing the CA and the people relying

on the certificates issued by the CA.

Answer option B is incorrect. Certificate Policy is a policy statement defined in the X.509 standard. The CP is associated with a certificate. It

defines the measures that are used to validate a certificate's subject prior to certificate issuance and the CA's responsibilities regarding those

certificates. The CP is also considered as the certificate-issuance policy which can determine whether the presented certificate will be trusted

or not.

Answer option D is incorrect. A certification authority (CA) or certificate authority is an entity that issues digital certificates for use by other

parties. It is an example of a trusted third party. A CA issues digital certificates that contain a public key and the identity of the owner. The

matching private key is not similarly made available publicly, but kept secret by the end user who generated the key pair. The certificate is

also an attestation by the CA that the public key contained in the certificate belongs to the person, organization, server or other entity noted

in the certificate. A CA's obligation in such schemes is to verify an applicant's credentials, so that users and relying parties can trust the

information in the CA's certificates. A variety of standards and tests are used by CAs to do so.

If the user trusts the CA and can verify the CA's signature, then he can also verify that a certain public key does indeed belong to a person

identified in the certificate.