CAS-004 Security Engineering Practice Question
A company wants to implement certificate pinning for its mobile application to prevent man-in-the-middle attacks. Which of the following is the BEST practice when implementing certificate pinning?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pin the public key of the server certificate
Pinning the public key rather than the entire certificate allows for certificate renewal without invalidating the pin.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable certificate pinning after the first successful connection
Why it's wrong here
This defeats the purpose of pinning.
- ✗
Pin the root CA certificate only
Why it's wrong here
This allows any certificate from that CA.
- ✓
Pin the public key of the server certificate
Why this is correct
Public key pinning remains valid across certificate renewals.
- ✗
Pin the entire certificate chain
Why it's wrong here
If the certificate is renewed, the app will break.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.