Remediation for Exploited Internal PKI Flaw
During a penetration test, a flaw in the internal PKI was exploited to gain domain administrator rights using specially crafted certificates. Which of the following remediation tasks should be completed as part of the cleanup phase?
Answer
Correct answer: A — Updating the CRL to immediately invalidate the specially crafted certificates used to gain domain administrator rights.
Community Votes
55% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests the distinction between eradication (fixing the root cause) and cleanup/recovery (restoring secure state); the trap is selecting the long-term fix (patching) over the immediate containment action (revocation).
This question addresses the remediation of a compromised internal Public Key Infrastructure (PKI) where domain administrator rights were gained via crafted certificates. It establishes that revoking compromised credentials is the immediate priority to stop active unauthorized access.
Many learners select 'Patching the CA' because it fixes the underlying vulnerability, but this is an eradication step, not the immediate cleanup/remediation required to neutralize the threat posed by already-issued malicious certificates.
Community Discussion (19 comments)
baronvon
👍 12
Selected: B
B. Patching the CA Here's why: Patching the Certificate Authorities: This involves updating the CA software to address the specific vulnerability that was exploited. Since the attack exploited a flaw in the PKI, patching the CA is crucial to fixing the vulnerability and preventing similar attacks in the future. While the other options are also important in a broader security context, they may not directly address the specific issue with the PKI flaw: -Updating the Certificate Revocation Lists (CRLs): This is important for managing revoked certificates but may not address the root cause of the PKI vulnerability. -Changing passwords: This is a good security practice but would not resolve the underlying issue with the PKI vulnerability. -Implementing SOAR (Security Orchestration, Automation, and Response): SOAR can help with automating responses and managing security operations but does not directly address the specific PKI vulnerability. -Therefore, patching the Certificate Authorities is the most effective and direct remediation task for this situatio
Ty13
👍 10
Selected: A
A. Updating the CRL It's a really bad question because you would do BOTH A and B. The only reason I'm saying A is because the question specifically says "cleanup phase". Patching the CA would TECHNICALLY fall under the Eradication Phase - we're eradicating a threat (patching a vulnerable CA server) - and then cleanup would be updating the CRL.
Ashtom
👍 1
Selected: A
the ca is not a software that can be patched. its an entity/org
9149f41
👍 1
Selected: B
CRL is for revocation; this way we can reissue the certificate and resolve the issue as well. But it does not underlying vulnerability in the CA itself. The question tells to cleanup the phase, which is more accurate with just patching the existing CA.
ramzie
👍 1
Selected: A
Answer is A Update the CRL because Immediately invalidates compromised certificates Prevents further use of malicious certificates Blocks certificate-based authentication attempts Part of proper PKI hygiene after compromise WHy not B Patching the CA Important but secondary to immediate threat Doesn't address already issued certificates Long-term solution rather than immediate cleanup Doesn't stop current compromise
laternak26
👍 2
Selected: B
B. Patching the CA: The flaw in the internal Public Key Infrastructure (PKI) was exploited during the penetration test to gain domain administrator rights, which indicates a vulnerability within the Certificate Authority (CA) system. To prevent similar attacks in the future, the CA should be patched to fix any identified vulnerabilities in the certificate issuance process. This is a critical step in remediating the flaw and securing the PKI system against further exploitation. Why NOT: A. Updating the CRL (Certificate Revocation List): While updating the CRL is important to revoke any compromised or malicious certificates, it addresses only the symptom (the specific certificates) rather than the root cause (the vulnerability in the CA). The flaw that allowed for the exploitation needs to be patched first, as it could enable the attacker to issue more certificates in the future.
AndyK2
👍 1
Selected: B
B. Patching the CA
MikelMiguel
👍 1
Selected: B
The cleanup phase in a penetration test refers to the steps taken after the test has been completed to ensure that any changes made during the testing process are reversed, and the environment is restored to its original state. This phase ensures that no trace of the penetration test remains and that any potential security risks introduced during the test are mitigated. In the context of the remediation task in question, the cleanup phase focuses on fixing the vulnerabilities exploited during the penetration test and ensuring the security of the system moving forward. For example, patching the Certification Authority (CA) if it was the root cause of the domain administrator privilege escalation would be a critical task during this phase.
fmeox567
👍 1
Selected: B
The correct answer is: B. Patching the CA GPT
cyberWoof
👍 1
Selected: A
Updating the CRL
Emmyrajj
👍 1
Selected: A
The correct answer is: A. Updating the CRL (Certificate Revocation List) Explanation: When a flaw in the PKI (Public Key Infrastructure) is exploited, especially involving malicious or compromised certificates, the first step in remediation is to revoke the affected certificates to prevent further misuse. This is done by updating the Certificate Revocation List (CRL) or using Online Certificate Status Protocol (OCSP). This ensures that any certificate used in the attack is marked as invalid, mitigating the risk of continued exploitation.
9ef4a35
👍 1
A. Updating the CRL
Murtuza
👍 1
Selected: B
Patching the CA
User92
👍 1
Selected: B
Updating the CRL is also important, but it primarily deals with revoking compromised certificates rather than fixing the underlying vulnerability.
tamdod
👍 2
This occurred during a penetration test. We should patch the CA first to prevent further exploitation, that ensures no new certificates can be issued using the same flaw. The we would update the CRL.
TrebleSmith
👍 3
Selected: A
While patching the Certificate Authority is important to prevent a similar attack in the future, I believe that updating the Certificate Revocation List will apply more directly to the clean-up phase.
suleman1000
👍 1
Selected: B
B: Patching the CA
salahsami2002
👍 1
B. Patching the CA (Certificate Authority) Since the flaw in the internal Public Key Infrastructure (PKI) was exploited to gain domain administrator rights, the primary remediation task should be to patch the Certificate Authority (CA). This will address the vulnerability that allowed the exploitation of the PKI system. Other tasks like updating the Certificate Revocation List (CRL) may be necessary, but patching the CA will directly resolve the issue that led to the compromise.
a4e15bd
👍 5
A. Update the CRL is correct The first priority is to revoke any compromise certificates. This ensures that those certificates can no longer be used for unauthorized access.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is A (Updating the CRL) because the immediate threat is the use of specially crafted, valid-looking certificates to gain domain admin rights. Updating the Certificate Revocation List (CRL) or implementing Online Certificate Status Protocol (OCSP) responses effectively invalidates these compromised certificates, preventing further unauthorized authentication. This action directly addresses the impact of the flaw during the cleanup phase by ensuring the malicious artifacts are no longer trusted.Why the Other Options Are Wrong
B (Patching the CA) is an eradication activity; while necessary to prevent future exploitation of the same flaw, it does not immediately revoke the power of certificates already issued using the exploit. C (Changing passwords) is irrelevant to the specific vector of certificate-based authentication abuse in this context. D (Implementing SOAR) is a strategic automation tool, not a specific remediation task for a PKI compromise.Community Comment Notes
Community consensus is split, with many arguing for B due to its importance in fixing the root cause. However, commenters noting the 'cleanup phase' nuance correctly identify that revocation (A) is the operational step to handle the compromised assets. One user noted, 'the ca is not a software that can be patched,' highlighting a misconception about PKI components, while others emphasized that updating the CRL 'immediately invalidates compromised certificates.'Exam Strategy
Always distinguish between 'Eradication' (removing the cause/vulnerability) and 'Cleanup/Recovery' (restoring normal operations and revoking compromised tokens). In incident response questions, look for the option that stops the immediate bleed before you look for the permanent fix.
Frequently Asked Questions
Why is patching the CA not the cleanup phase?
Patching the CA is part of the Eradication phase, as it removes the vulnerability source. Cleanup focuses on handling the immediate consequences, such as revoking compromised certificates via the CRL.
Does updating the CRL fix the vulnerability itself?
No, updating the CRL only revokes trust in the compromised certificates. The underlying vulnerability in the CA must still be fixed through patching (Eradication) to prevent new malicious certificates from being issued.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →