PKI Cleanup: Update CRL vs Patch the CA

SY0-701 By islever Editorial Last updated

Given an incident, apply appropriate incident response activities. Given a scenario, select mitigation techniques or controls to secure an enterprise environment.

Short answer

A Update the CRL to revoke the specially crafted certificates used to gain domain administrator rights during the internal PKI penetration test.

Question

During a penetration test, a flaw in the internal PKI was exploited to gain domain administrator rights using specially crafted certificates. Which of the following remediation tasks should be completed as part of the cleanup phase?
  1. Updating the CRL Correct Answer
  2. Patching the CA
  3. Changing passwords
  4. Implementing SOAR

Key Takeaways

The question tests the boundary between cleanup and eradication: invalidate the rogue certificates with a CRL update as cleanup, then patch the CA to close the root cause.

In a penetration test that abused internal PKI to reach domain administrator rights, the cleanup-phase answer is to update the CRL and revoke the crafted certificates. This page explains why patching the CA is eradication, not cleanup.

Common mistake: Picking B because patching the CA fixes the PKI flaw; that is necessary eradication, but it does not revoke the specially crafted certificates already issued during the test, so it is not the cleanup task asked for.

Expert Analysis

The boundary being tested This item is less about PKI mechanics than about phase placement. The scenario says the flaw was in the internal PKI and that specially crafted certificates were used to reach domain administrator rights. The question asks for a task in the cleanup phase, so the deciding issue is whether the action removes the artifacts created by the exploit or closes the root cause.

Cleanup removes artifacts; eradication fixes root cause In post-exploitation and incident-response practice, cleanup is the restore-and-remove step: delete test or attacker artifacts, revoke rogue credentials and certificates, remove accounts or scheduled tasks, and return the environment to its pre-test state. Eradication is the root-cause fix: patch the vulnerable CA, correct the certificate template or issuance policy, and harden the PKI. Option B, patching the CA, is essential remediation, but it is the eradication fix, not artifact cleanup. A CA patch does not, by itself, make already-issued crafted certificates untrusted.

Why A wins The certificates are the active access artifact. Updating the CRL, or using OCSP, revokes them so domain controllers and other relying parties reject them. That is the cleanup action tied to the exploit's output. Option C is credential rotation and does not invalidate certificate-based authentication; Option D is a broader automation platform and is irrelevant here. Option A is correct: update the CRL to revoke the specially crafted certificates.

Exam caution Both A and B look operationally necessary, and they are. The exam separates them by phase: cleanup invalidates or removes what the test created; eradication patches the flaw. Read the phase word before choosing.

Official Reference

https://www.comptia.org/certifications/security

This link opens the official vendor documentation in a new tab.

Exam Strategy

For phase-based questions, first label the asked phase and then classify each option by what it changes. Cleanup options remove or invalidate artifacts created during the test or incident—rogue certificates, accounts, scheduled tasks, files—while eradication options patch, reconfigure, or close the root cause. Use keyword matching: 'cleanup' pairs with revoke/remove/restore; 'eradication' pairs with patch/fix/harden. When A and B both look valid, do not pick the more technically satisfying fix; pick the one that matches the phase named in the stem.

Frequently Asked Questions

Why isn't patching the CA the cleanup step?

Patching closes the PKI flaw and prevents recurrence, but it does not revoke the specially crafted certificates already trusted. Before or alongside that eradication fix, update the CRL or OCSP so those certificates fail validation.

What artifacts should a pen tester remove after AD CS abuse?

Revoke or delete certificates created during the test, remove any accounts, scheduled tasks, or persistence, and restore changed configurations to their pre-test state.

Does changing domain administrator passwords help after certificate abuse?

It may be part of credential rotation, but it does not invalidate the certificate-based authentication path. Revoke the certificates and patch the CA as separate cleanup and eradication actions.

More SY0-701 FAQ →

Discussion 27 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 27

  1. baronvon 👍 17 Answered B
    B. Patching the CA Here's why: Patching the Certificate Authorities: This involves updating the CA software to address the specific vulnerability that was exploited. Since the attack exploited a flaw in the PKI, patching the CA is crucial to fixing the vulnerability and preventing similar attacks in the future. While the other options are also important in a broader security context, they may not directly address the specific issue with the PKI flaw: -Updating the Certificate Revocation Lists (CRLs): This is important for managing revoked certificates but may not address the root cause of the PKI vulnerability. -Changing passwords: This is a good security practice but would not resolve the underlying issue with the PKI vulnerability. -Implementing SOAR (Security Orchestration, Automation, and Response): SOAR can help with automating responses and managing security operations but does not directly address the specific PKI vulnerability. -Therefore, patching the Certificate Authorities is the most effective and direct remediation task for this situatio
  2. Ty13 👍 13 Answered A
    A. Updating the CRL It's a really bad question because you would do BOTH A and B. The only reason I'm saying A is because the question specifically says "cleanup phase". Patching the CA would TECHNICALLY fall under the Eradication Phase - we're eradicating a threat (patching a vulnerable CA server) - and then cleanup would be updating the CRL.
  3. a4e15bd 👍 5
    A. Update the CRL is correct The first priority is to revoke any compromise certificates. This ensures that those certificates can no longer be used for unauthorized access.
  4. TrebleSmith 👍 4 Answered A
    While patching the Certificate Authority is important to prevent a similar attack in the future, I believe that updating the Certificate Revocation List will apply more directly to the clean-up phase.
  5. 1798e2e 👍 3
    patching the CA is not part of the eradication phase. it is part of the clean up. The part where you update things that are... out of date...
Show 22 more comments
  1. laternak26 👍 2 Answered B
    B. Patching the CA: The flaw in the internal Public Key Infrastructure (PKI) was exploited during the penetration test to gain domain administrator rights, which indicates a vulnerability within the Certificate Authority (CA) system. To prevent similar attacks in the future, the CA should be patched to fix any identified vulnerabilities in the certificate issuance process. This is a critical step in remediating the flaw and securing the PKI system against further exploitation. Why NOT: A. Updating the CRL (Certificate Revocation List): While updating the CRL is important to revoke any compromised or malicious certificates, it addresses only the symptom (the specific certificates) rather than the root cause (the vulnerability in the CA). The flaw that allowed for the exploitation needs to be patched first, as it could enable the attacker to issue more certificates in the future.
  2. Emmyrajj 👍 2 Answered A
    The correct answer is: A. Updating the CRL (Certificate Revocation List) Explanation: When a flaw in the PKI (Public Key Infrastructure) is exploited, especially involving malicious or compromised certificates, the first step in remediation is to revoke the affected certificates to prevent further misuse. This is done by updating the Certificate Revocation List (CRL) or using Online Certificate Status Protocol (OCSP). This ensures that any certificate used in the attack is marked as invalid, mitigating the risk of continued exploitation.
  3. Empath 👍 2 Answered A
    A. Updating the CRL (Certificate Revocation List) Revoking compromised or rogue certificates is critical. Updating the CRL ensures that previously issued malicious certificates are no longer trusted. This directly addresses the abuse of certificates during the attack. B. Patching the CA (Certificate Authority) Also important for long-term remediation (to close the flaw). But patching alone doesn’t immediately mitigate the fact that malicious certificates may already exist and remain valid. This is a prevention step, not cleanup.
  4. 8f23125 👍 2 Answered A
    Option A (Updating the CRL) directly addresses the malicious certificates that were created and used. It cleans up the artifacts and removes the specific means of access gained through the exploit. Option B (Patching the CA) addresses the root cause to prevent recurrence but doesn't invalidate the already existing malicious certificates.
  5. fc040c7 👍 2
    Doesn’t the question say “specially crafted certificates” meaning the attackers made the certificate themselves? Doesn’t say that any previously certified certificates were compromised. So why would you update the CRL if the attackers are able to create their own certificates to bypass whatever you just revoked?
  6. BAM1 👍 2 Answered A
    A. Updating the CRL (Certificate Revocation List) → ✅ This is correct. The CRL is the list of certificates that are no longer valid. Updating it ensures that any compromised certificates cannot be used.
  7. tamdod 👍 2
    This occurred during a penetration test. We should patch the CA first to prevent further exploitation, that ensures no new certificates can be issued using the same flaw. The we would update the CRL.
  8. Ashtom 👍 2 Answered A
    the ca is not a software that can be patched. its an entity/org
  9. zron 👍 2 Answered A
    key words are "clean up phase"
  10. AndyK2 👍 2 Answered B
    B. Patching the CA
  11. BigCGeekn 👍 1 Answered B
    Patching the CA: The root cause of the exploitation was a flaw within the internal Public Key Infrastructure (PKI) system itself. In order to properly remediate the underlying issue and prevent attackers from using specially crafted certificates to escalate privileges in the future, the Certificate Authority (CA) must be patched with software updates, security fixes, or configuration corrections. Explanation of the Incorrect Options Updating the CRL: A Certificate Revocation List (CRL) update is used to invalidate individual certificates that are compromised. While it might be a temporary containment step for specific bad certificates, updating a CRL does not fix the software flaw in the PKI that allowed the certificates to be forged or abused in the first place.
  12. MikelMiguel 👍 1 Answered B
    The cleanup phase in a penetration test refers to the steps taken after the test has been completed to ensure that any changes made during the testing process are reversed, and the environment is restored to its original state. This phase ensures that no trace of the penetration test remains and that any potential security risks introduced during the test are mitigated. In the context of the remediation task in question, the cleanup phase focuses on fixing the vulnerabilities exploited during the penetration test and ensuring the security of the system moving forward. For example, patching the Certification Authority (CA) if it was the root cause of the domain administrator privilege escalation would be a critical task during this phase.
  13. salahsami2002 👍 1
    B. Patching the CA (Certificate Authority) Since the flaw in the internal Public Key Infrastructure (PKI) was exploited to gain domain administrator rights, the primary remediation task should be to patch the Certificate Authority (CA). This will address the vulnerability that allowed the exploitation of the PKI system. Other tasks like updating the Certificate Revocation List (CRL) may be necessary, but patching the CA will directly resolve the issue that led to the compromise.
  14. ramzie 👍 1 Answered A
    Answer is A Update the CRL because Immediately invalidates compromised certificates Prevents further use of malicious certificates Blocks certificate-based authentication attempts Part of proper PKI hygiene after compromise WHy not B Patching the CA Important but secondary to immediate threat Doesn't address already issued certificates Long-term solution rather than immediate cleanup Doesn't stop current compromise
  15. 9149f41 👍 1 Answered B
    CRL is for revocation; this way we can reissue the certificate and resolve the issue as well. But it does not underlying vulnerability in the CA itself. The question tells to cleanup the phase, which is more accurate with just patching the existing CA.
  16. User92 👍 1 Answered B
    Updating the CRL is also important, but it primarily deals with revoking compromised certificates rather than fixing the underlying vulnerability.
  17. 76a662d 👍 1 Answered A
    Answer is A... Attackers already gained access with another certificate,So updating CRL will lock these out.Patching CA might benefit mitigation.
  18. TIS2478 👍 1 Answered A
    For the PEN test, we use a crafted certificate. We don't need it at the end of Pentest, so CRL
  19. fmeox567 👍 1 Answered B
    The correct answer is: B. Patching the CA GPT
  20. 9ef4a35 👍 1
    A. Updating the CRL
  21. cyberWoof 👍 1 Answered A
    Updating the CRL
  22. Murtuza 👍 1 Answered B
    Patching the CA

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide