Question

An IS auditor is reviewing an organization's public key infrastructure (PKI). During testing, the auditor notices that client applications accept digital certificates without querying whether the certificate has been revoked before its expiration date. Which control weakness represents the GREATEST risk in this situation?

Accepted Answer

The applications do not check certificate revocation status against a CRL or OCSP responder

Answer

The certificate authority uses a self-signed root certificate at the top of the trust chain

Answer

The certificates are issued with a validity period of two years

Answer

The private keys are stored in a hardware security module rather than in software