An organization is building its own Public Key Infrastructure (PKI). The security architect has designed a two-tier hierarchy with an offline Root CA and an online Intermediate CA. The Intermediate CA will be responsible for signing certificates for all internal web servers.

The diagram below shows the intended signing process. What is the most critical security measure for protecting the long-term integrity of this entire PKI?
```mermaid
graph TD
subgraph "Offline / Air-gapped"
RootCA[Root CA Certificate & Private Key]
end
subgraph "Online Network"
IntermediateCA[Intermediate CA Certificate & Private Key]
WebServerCert[Web Server Certificate]
end
RootCA --"Signs"-- IntermediateCA
IntermediateCA --"Signs"-- WebServerCert
```

Question

An organization is building its own Public Key Infrastructure (PKI). The security architect has designed a two-tier hierarchy with an offline Root CA and an online Intermediate CA. The Intermediate CA will be responsible for signing certificates for all internal web servers.

The diagram below shows the intended signing process. What is the most critical security measure for protecting the long-term integrity of this entire PKI?
```mermaid
graph TD
subgraph "Offline / Air-gapped"
RootCA[Root CA Certificate & Private Key]
end
subgraph "Online Network"
IntermediateCA[Intermediate CA Certificate & Private Key]
WebServerCert[Web Server Certificate]
end
RootCA --"Signs"--> IntermediateCA
IntermediateCA --"Signs"--> WebServerCert
```

Accepted Answer

Ensuring the Root CA's private key is kept securely offline and air-gapped at all times, except when needed for signing.

Answer

Using a 4096-bit RSA key for the Intermediate CA.

Answer

Implementing a robust Certificate Revocation List (CRL) and OCSP responder for the Intermediate CA.

Answer

Automating the issuance of web server certificates using a protocol like ACME.

Top vendors

Top exams

Free 303-300 sample questions

Ready for the full 303-300 bank?