CEH Cryptography and Malware Analysis Practice Question
A company's internal PKI uses an offline root CA and an online issuing CA. A security engineer needs to revoke a compromised certificate issued by the online CA. Which CRL distribution point should the engineer update?
⚠ Common exam trap
EC-Council often tests the misconception that the root CA must be involved in revocation of end-entity certificates, but in reality only the issuing CA that signed the certificate can revoke it and update its own CRL.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The CRL published by the online issuing CA
The compromised certificate was issued by the online issuing CA, so only that CA has the authority to revoke it and publish the updated CRL. Clients validating the certificate will check the CRL distribution point (CDP) embedded in the certificate, which points to the issuing CA's CRL. Updating the CRL on the online issuing CA ensures that revocation status is immediately available to relying parties.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The CRL published by the certificate authority that signed the issuing CA's certificate
Why it's wrong here
The certificate authority that signed the issuing CA's certificate is the root CA in a two-tier PKI. While the root CA establishes the chain of trust, its Certificate Revocation List (CRL) primarily contains information about revoked subordinate CA certificates, not the end-entity certificates issued by those subordinate CAs. Therefore, checking the root CA's CRL would not provide the necessary revocation status for an end-entity certificate issued by the online CA.
- ✗
The CRL published by the intermediate CA, if any
Why it's wrong here
The question explicitly describes a two-tier Public Key Infrastructure (PKI) with an offline root CA and an online issuing CA. There is no mention or implication of an intermediate CA in this specific scenario. While an intermediate CA would publish its own CRL for certificates it issues, its absence from the described architecture means its CRL is not relevant for determining the revocation status of certificates issued by the designated online issuing CA.
- ✓
The CRL published by the online issuing CA
Why this is correct
The online issuing CA is directly responsible for generating, signing, and managing the lifecycle of end-entity certificates within this PKI. When an end-entity certificate needs to be revoked, it is the issuing CA that records this revocation event and publishes it in its own Certificate Revocation List (CRL). Consequently, clients validating an end-entity certificate must consult the CRL published by the online issuing CA to ascertain its current revocation status.
- ✗
The CRL published by the offline root CA
Why it's wrong here
The offline root CA, being the trust anchor, is primarily responsible for signing the certificates of its subordinate CAs, such as the online issuing CA in this setup. It does not directly issue end-entity certificates to users or devices. Therefore, its Certificate Revocation List (CRL) would only contain information about revoked CA certificates that it signed, not the end-entity certificates issued by its subordinate online CA.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.