CAS-004 Security Engineering Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Disable certificate pinning after the first successful connection

  Why it's wrong here

  Disabling pinning after the first connection removes the protection entirely for every subsequent session, leaving later connections open to man-in-the-middle interception. Pinning must remain enforced on every connection. The option is tempting as a way to avoid breaking the app during certificate rotation, but rotation should be handled by pinning a backup key instead.

• ✗

  Pin the root CA certificate only

  Why it's wrong here

  Pinning only the root CA leaves the app trusting every certificate that CA issues, so a compromised or mis-issued intermediate defeats the pin. Pinning the leaf or public key narrows trust to the specific certificate. Root pinning is tempting because it survives certificate rotation, but that convenience sacrifices the granularity the attack prevention requires.

• ✓

  Pin the public key of the server certificate

  Why this is correct

  Pinning the public key rather than the full certificate lets the app continue trusting the server after certificate renewal, provided the key pair is reused. This maintains man-in-the-middle protection while avoiding outages from routine certificate rotation.

• ✗

  Pin the entire certificate chain

  Why it's wrong here

  Pinning the entire chain breaks whenever any intermediate or leaf certificate is renewed, forcing an app update; it also adds no security beyond pinning the leaf or public key. Pinning the leaf certificate or its public key is the recommended practise. Chain pinning is tempting because it appears thorough, yet it mainly creates operational fragility.

Go deeper

Related to this question