mediumMultiple Choice
SSCP Practice Question: A financial services firm with 500 servers and…
A financial services firm with 500 servers and 2000 workstations uses an internal public key infrastructure (PKI) for authentication and secure communication. The root CA certificate is self-signed and stored on an offline root CA server. Recently, the root CA server was physically stolen from a locked data center. Although the server was encrypted, forensic analysis confirms that the root CA private key was extracted. The security team must immediately revoke trust in the compromised root CA and issue new certificates to all devices. The environment includes Active Directory and Group Policy. Which approach best ensures all systems trust the new CA hierarchy and obtain valid certificates with minimal disruption?
⚠ Common exam trap
Watch out — candidates often think re-issuing only subordinate CAs (Option C) is sufficient, overlooking that end-entity certificates signed by the compromised root remain untrusted and must also be replaced to restore a valid chain of trust.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Generate a new root CA, sign new subordinate CAs, distribute the new root via Group Policy, and re-issue all end-entity certificates.
The root CA private key has been compromised, requiring the entire PKI hierarchy to be rebuilt from scratch. A new self-signed root CA must be generated, new subordinate CAs signed under it, and all end-entity certificates re-issued to devices. Distributing the new root CA certificate via Active Directory Group Policy ensures that all domain-joined systems trust the new hierarchy automatically, minimizing manual intervention and disruption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Generate a new root CA, sign new subordinate CAs, distribute the new root via Group Policy, and re-issue all end-entity certificates.
Why this is correct
Because the root private key was extracted, the entire hierarchy is untrusted; only a fresh root with new subordinates restores trust. Publishing the new root through Group Policy pushes it to all domain-joined machines automatically, and re-issuing end-entity certificates completes the replacement with minimal manual disruption.
- ✗
Publish a certificate revocation list (CRL) and wait for existing certificates to expire.
Why it's wrong here
A CRL only marks certificates as untrusted; it does not issue replacements, and waiting for expiry leaves compromised trust active for the certificates' remaining lifetime. CRLs suit routine revocation, but here the root key is stolen, so the hierarchy must be rebuilt and reissued via Group Policy.
- ✗
Generate a new root CA certificate and key, then re-issue all subordinate CA certificates without re-issuing end-entity certificates.
Why it's wrong here
Re-issuing subordinate CA certificates leaves every end-entity certificate chained to the compromised root's key, so trust is not actually revoked. It is tempting because it appears to avoid the cost of re-enrolling 2500 devices, and would be correct if only an intermediate CA, not the root, had been compromised.
- ✗
Enable OCSP stapling on all web servers to check revocation status in real time.
Why it's wrong here
OCSP stapling only attaches a signed revocation response to a TLS handshake; it cannot revoke a compromised root or push a new trust anchor to 2500 devices. It is tempting because it genuinely reduces revocation-check latency for leaf certificates, and would be the right choice when clients must avoid querying the CA's OCSP responder directly.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.