Wildcard vs Self-Signed Certificates for Many Domains

SY0-701 By islever Editorial Last updated

Explain the importance of using appropriate cryptographic solutions.

Short answer

A Implement a wildcard certificate to secure many subdomains under each company-owned base domain with one CA-issued certificate instead of buying individual certificates.

Question

A security administrator is working to find a cost-effective solution to implement certificates for a large number of domains and subdomains owned by the company. Which of the following types of certificates should the administrator implement?
  1. Wildcard Correct Answer
  2. Client certificate
  3. Self-signed
  4. Code signing

Key Takeaways

The question tests certificate-type selection for cost and coverage, and the main trap is treating a zero-cost self-signed certificate as equivalent to a publicly trusted wildcard.

This SY0-701 item asks which certificate type gives cost-effective coverage for many company domains and subdomains. The answer is A, a wildcard certificate, because it consolidates many subdomain names under a trusted CA-issued certificate.

Common mistake: Choosing C, self-signed, because it has no purchase cost; it fails because self-signed certificates are not trusted by public clients and create warnings unless manually trusted, so they are not the intended cost-effective solution for company domains.

Expert Analysis

Why the cost clue points to A The stem asks for a certificate type that reduces the number of certificates the company must buy and manage across many domains and subdomains. A wildcard certificate such as .example.com covers many hostnames beneath one owned base domain with a single certificate, so the administrator buys and renews one certificate instead of one per subdomain. That is the cost-effective pattern CompTIA expects here, and it is why option A is correct. The wildcard must still come from a trusted CA and be scoped carefully—.example.com does not automatically cover example.com, deeper names such as a.b.example.com, or unrelated base domains—but it is the only listed type designed for broad subdomain coverage.

Why self-signed is the attractive trap Option C sounds compelling because a self-signed certificate has no CA purchase cost: the company can generate certificates for any number of domains and subdomains itself. That satisfies the surface-level “cost-effective” wording and explains why some comments defend C. The point where it stops being correct is trust. A self-signed certificate is not signed by a publicly trusted CA, so browsers and external clients show warnings unless every client imports the certificate into its trust store. For company-owned domains and subdomains, that trust-distribution and operational burden is not a viable certificate deployment. Comments also argue that a wildcard may need one certificate per base domain; that may be true, but it does not make an untrusted self-signed certificate the right answer.

Eliminating B and D A client certificate (B) authenticates a user or device to a service; it does not secure a set of company web domains. A code-signing certificate (D) signs software to prove publisher integrity; it has nothing to do with covering many subdomains. Unless the stem explicitly limits the certificates to an internal environment with a managed trust store, the CA-trusted wildcard is the best answer.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a certificate question emphasizes cost and a large number of subdomains, look for the type that collapses many names into one managed certificate, not the type that merely has a zero purchase price. Eliminate client and code-signing certificates immediately because they serve authentication and software integrity, not web-domain coverage. Then check whether the remaining free option preserves public trust; self-signed fails that check unless the stem explicitly says the environment is internal-only with a managed trust store.

Frequently Asked Questions

Does a wildcard certificate cover multiple unrelated domains?

No. A wildcard such as *.example.com covers hostnames under example.com, not example.net or deeper names such as a.b.example.com; multiple base domains may need separate wildcard or SAN certificates.

Why is a self-signed certificate not the cost-effective answer?

It avoids CA fees, but public clients do not trust it by default and will show warnings unless every client imports it; that operational burden and trust gap make it unsuitable for company domains unless internal-only.

When should client or code-signing certificates be used instead?

Client certificates authenticate users or devices, while code-signing certificates verify software publisher integrity; neither is designed to cover many web domains and subdomains.

More SY0-701 FAQ →

Discussion 13 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 13

  1. ProudFather 👍 5 Answered A
    A wildcard certificate can be used to secure multiple subdomains under a single domain name. This makes it a cost-effective solution for organizations with a large number of subdomains. By purchasing a single wildcard certificate, the organization can secure all subdomains with a single certificate, reducing the need for multiple individual certificates.
  2. f59f364 👍 3 Answered C
    Not sure about wildcard. It can service one domain, and question says "domainS". If you by multiple wildcard certificates, it is not cost effective. I will go with C, self-signed, it doesn't say that service using certificate is public.
  3. baronvon 👍 2 Answered A
    A. Wildcard Wildcard certificates allow you to secure a domain and all of its subdomains with a single certificate. This can be a cost-effective solution for managing certificates for a large number of domains and subdomains.
  4. 7d6fad2 👍 2
    They are not saying is an internal website, the scenario doesn't explicitly say that. It says domains and subdomains owned by the company, like Google or Microsoft. They would get a Wildcard certificate.
  5. Studytime2023 👍 2
    You're right! It is stupid wording. One must hope the actual exam doesn't do this. For multiple domains, a SAN cert is required. Otherwise your choice of self signing which has its own drawbacks.
Show 8 more comments
  1. 28a4776 👍 2
    A wildcard allows for any subdomain on a primary domain to be automatically included. ie: ".domain.com" where the is the "wildcard"
  2. scholi 👍 1
    A wildcard is a character or symbol used in computing to represent one or more characters in a string, allowing for flexible searching, matching, and filtering. Wildcards are commonly used in various contexts such as file searching, pattern matching, and access control. Wildcards are used to search for files or directories that match a certain pattern.
  3. 7d6fad2 👍 1 Answered A
    The wording in this test case is wild. For instance, a Self-Signed certificate has no cost associated when used because it is all internally done. However, the scenario doesn't specify if is internal domainS and subdomainS (plural). Going with a Wildcard certificate is not budget friendly for multiple domains and subdomains.
  4. 7269053 👍 1 Answered C
    The answer has to be C. A wildcard certificate is issued by a trusted CA and is designed to secure multiple subdomains under a single domain. A self signed domain is created and signed by the entity that owns the domain.; a self signing entity can produce and sign their own certificates - domains and subdomains both
  5. scholi 👍 1
    Wildcards are used to search for files or directories that match a certain pattern. (Asterisk): Represents zero or more characters. Example: .txt matches all files with a .txt extension. ? (Question Mark): Represents exactly one character. Example: file?.doc matches file1.doc, fileA.doc, etc.
  6. pchuu 👍 1
    Thats not really what a self signed certificate is. Its a certificate that is not signed by a trusted CA or even by an organizations trusted CA but rather signed by the entity where the CSR was generated. Sel signed certs are not trusted by the browser. So the answer cannot be self signed
  7. 5a11b63 👍 1 Answered A
    Allow a single certificate to secure a domain and all its subdomains (e.g., *.example.com). This makes them cost-effective for large numbers of subdomains, as only one certificate needs to be managed instead of multiple individual certificates.
  8. AndyK2 👍 1 Answered A
    Covers multiple subdomains with single certificate Cost-effective for large number of domains

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide