CAS-004 Security Engineering Practice Question
A security engineer is reviewing a PKI deployment where the root CA is kept offline. The issuing CA signs certificates for internal applications. Recently, a subordinate CA was compromised, and the engineer needs to revoke all certificates issued by that CA. Which of the following is the most efficient method to revoke these certificates?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Publish a CRL from the compromised CA listing all certificates it issued
The best method is to use a CRL issued by the compromised CA, marking all its unexpired certificates as revoked. Revoking the CA certificate itself invalidates all certificates issued by it, including valid ones. Distributing a new CRL from the root CA would require the root to be online. Individual certificate revocation is inefficient.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Re-issue all certificates from a different issuing CA without revocation
Why it's wrong here
The original certificates remain valid unless revoked; re-issuing does not revoke them.
- ✗
Use OCSP to individually check and revoke each certificate
Why it's wrong here
OCSP is for status checking, not bulk revocation; individually revoking thousands of certificates is inefficient.
- ✓
Publish a CRL from the compromised CA listing all certificates it issued
Why this is correct
Publishing a CRL from the compromised CA marks those certificates as revoked, while the CA certificate remains valid for CRL issuance.
- ✗
Revoke the compromised CA certificate and issue a new CRL from the root CA
Why it's wrong here
Revoking the CA certificate invalidates all certificates under that CA, which may be too broad if some certificates are still trusted.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.