AZ-802 Secure Windows Server Infrastructure Practice Question
Exhibit
C:\> certutil -verify -urlfetch ServerCert.cer ... Leaf certificate verification: PASS Revocation check: FAILED ...
Refer to the exhibit. You are investigating why a secure connection is failing on your web server. Based on the output, what is the most likely reason?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The server cannot reach the CRL distribution point.
A failed revocation check indicates that the client or server cannot verify if the certificate has been prematurely invalidated by the issuing CA. This check is crucial for security because it ensures that compromised certificates are not being used. Connectivity failures here usually stem from the inability to reach the Certificate Revocation List (CRL) distribution point, often due to network blocking or incorrect DNS resolution for the URL defined in the certificate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The certificate has expired.
Why it's wrong here
If the certificate were expired, the leaf certificate verification would fail with a date-related error. Since the leaf certificate verification passed, the certificate is currently valid from a temporal perspective, but the identity or status cannot be confirmed due to the revocation check failure, which is a distinct issue.
- ✓
The server cannot reach the CRL distribution point.
Why this is correct
The revocation check fails when the system cannot download the latest CRL or OCSP response to verify the certificate's status. This is commonly caused by firewall restrictions, missing proxy configurations, or an invalid URL within the certificate's Authority Information Access field, preventing the server from confirming it remains valid.
- ✗
The certificate chain is incomplete.
Why it's wrong here
If the chain were incomplete, the leaf verification would return an error regarding an untrusted root or an incomplete chain. Because the certificate verification itself passed, the system recognizes the root CA. The failure is specifically confined to the revocation check, meaning the certificate is trusted but its current status is unknown.
- ✗
The private key is missing on the server.
Why it's wrong here
If the private key were missing, the certificate would not be usable for SSL/TLS handshakes, leading to an immediate connection error before any revocation check could occur. The output shows that the certificate is being processed correctly, confirming that the private key access is likely functional for the server's operations.
Visual reference
About these practice questions
One of 116 original AZ-802 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-802 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-802 exam.