GSEC Cryptography Application Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Key Usage extension populated solely with Digital Signature, Non-Repudiation, and Key Encipherment flags.

  Why it's wrong here

  Key Usage defines cryptographic operations permissible for the specific key pair, such as signing or encryption. While vital for operational security, it does not restrict which specific subject names or domain namespaces a subordinate CA can certify.

• ✗

  Authority Information Access extension pointing directly to the organization's primary online OCSP responder.

  Why it's wrong here

  Authority Information Access only publishes OCSP and CA issuer endpoints for revocation checking; it constrains nothing about which domains the sub-CA may certify. Name Constraints is the extension that restricts issuance to permitted DNS namespaces, so AIA leaves the sub-CA free to sign any domain.

• ✓

  Name Constraints extension configured with explicit permitted and excluded subtree subdirectories for domain namespaces.

  Why this is correct

  Name Constraints enforce strict boundaries on subordinate CAs by defining exact permitted and excluded domain namespaces. If a sub-CA attempts to issue a certificate outside these boundaries, relying parties will immediately reject it as invalid.

• ✗

  Extended Key Usage extension restricted strictly to TLS Web Server Authentication and Code Signing.

  Why it's wrong here

  Extended Key Usage limits the application purposes for which the certified public key can be used, such as server authentication. It does not restrict the target domain names or organizational subtrees that the subordinate CA is authorized to issue against.