Describe How to Troubleshoot Invalid Certificates F5N4 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   When a client reports a 'certificate chain incomplete' error, what should you check?

   • AThe certificate's SAN entries
   • BThe certificate's signature algorithm
   • CThe certificate's revocation status
   • DThe certificate's issuer and intermediate certificates
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security incident occurred, and a certificate was revoked. The NGINX server is configured with OCSP stapling enabled. After the revocation, some clients still connect without warnings, while others receive errors. The certificate is not expired. What is the most likely explanation?

   • AThe NGINX server is serving a different certificate to some clients.
   • BThe OCSP stapling is not working, so clients do not receive revocation status.
   • CClients that connected before the revocation have cached the certificate and do not re-check.
   • DThe certificate was reissued after revocation.
   Reveal Solution Discussion Select an answer first
4. 23application · easy

   An administrator is troubleshooting a certificate that was reported as revoked. The certificate is not expired and the hostname matches. The administrator runs `openssl s_client -connect example.com:443 -status` and sees `OCSP Response Status: successful` with `Cert Status: good`. What does this indicate?

   • AThe certificate is expired.
   • BThe certificate is currently valid and has not been revoked.
   • CThe certificate has been revoked but the OCSP responder is outdated.
   • DThe OCSP responder is not configured for this certificate.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company uses a private CA to issue certificates for internal services. The root CA certificate is distributed to all employee laptops via group policy. Recently, a new intermediate CA was introduced, and certificates issued by it are showing as untrusted on some laptops but not others. The root CA is present on all laptops. What is the most likely cause?

   • AThe root CA certificate has expired on some laptops.
   • BThe new certificates have a hostname mismatch.
   • CThe intermediate CA certificate is not distributed to all laptops.
   • DThe NGINX server is not sending the intermediate certificate.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company's public website suddenly shows a 'certificate not trusted' error for all users. The certificate was issued by a well-known public CA and is not expired. The NGINX configuration was recently changed to include an additional intermediate certificate. What is the most likely cause?

   • AThe intermediate certificate was appended in the wrong order in the ssl_certificate file.
   • BThe private key was replaced with a new one that does not match the certificate.
   • CThe root CA certificate was removed from the clients' trust stores.
   • DThe certificate was reissued with a different CN.
   Reveal Solution Discussion Select an answer first