CAS-004 Security Engineering Practice Question
A security architect is designing a PKI hierarchy for a large enterprise that issues certificates for internal users, devices, and code signing. Which of the following best practices should be implemented to minimize the impact of a CA compromise?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a segmented CA hierarchy with offline root CA and separate issuing CAs for each purpose
Using a tiered CA hierarchy with a root CA that remains offline and issuing CAs for specific purposes limits exposure. If an issuing CA is compromised, only its certificates need to be revoked, and the root CA can issue a new subordinate CA.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Rely on certificate transparency logs to detect compromises
Why it's wrong here
CT logs help detect misissuance but do not minimize impact of a CA compromise.
- ✗
Keep the root CA online for immediate certificate revocation
Why it's wrong here
Root CA should be offline to protect its private key.
- ✗
Use a single CA for all certificate types to reduce complexity
Why it's wrong here
A single CA increases blast radius if compromised.
- ✓
Implement a segmented CA hierarchy with offline root CA and separate issuing CAs for each purpose
Why this is correct
This compartmentalizes risk and allows easier recovery.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.