220-1102 Question 634
Single answerCertificate warningsA user reports that when visiting the company intranet at https://intranet.contoso.local from a managed Windows 11 laptop, the browser displays a certificate warning stating that the certificate is not trusted. Other users can access the site without warnings. The technician confirms the URL is correct and that the website's certificate has not expired. Which action should the technician take FIRST to resolve the issue securely?
- A
Install the company's internal root CA certificate into the Trusted Root Certification Authorities store on the affected laptop
- B
Tell the user to bypass the warning and add a permanent exception for the website
- C
Replace the web server certificate with a self-signed certificate generated on the intranet server
- D
Disable HTTPS inspection and certificate checking in the user's browser
Show answer and explanation
Correct answer: A
Explanation
This scenario focuses on a common A+ Core 2 support task: responding appropriately to certificate warnings. Because other users can access the intranet without errors, the problem is likely client-specific rather than a server-wide issue. Since the certificate is not expired and the URL is correct, the next most likely cause is that the affected device does not trust the certificate chain. In many organizations, internal websites use certificates issued by an internal PKI or private CA, and client devices must trust that root CA. Best practice is to install the organization's root certificate through proper management methods such as Group Policy, MDM, or manual installation if appropriate for the environment. Users should not be instructed to ignore warnings, and technicians should not disable certificate validation. This aligns with standard PKI and browser security best practices documented by Microsoft and major browser vendors: certificate warnings should be investigated and resolved by establishing valid trust, not bypassed.
- A. Correct.
Correct. If the site uses a certificate issued by the company's internal certificate authority, a single affected computer showing an untrusted certificate warning strongly suggests the internal root CA certificate is missing or not properly installed on that device. Installing the trusted root certificate in the appropriate Windows certificate store allows the system and browsers that rely on that store to validate the certificate chain securely.
- B. Incorrect.
Incorrect. Bypassing the warning or creating an exception is not the proper first step in a business environment because it trains users to ignore security warnings and leaves the system vulnerable to man-in-the-middle risks. This is a common but unsafe workaround rather than a secure fix.
- C. Incorrect.
Incorrect. Replacing the current certificate with a self-signed certificate would usually make trust problems worse, not better, because self-signed certificates are not automatically trusted by clients unless explicitly deployed. This option reflects the misconception that any certificate will remove warnings.
- D. Incorrect.
Incorrect. Disabling certificate validation defeats the purpose of HTTPS and exposes the user to spoofed or intercepted connections. Certificate checking should remain enabled; the correct solution is to establish trust in the issuing CA or correct the certificate chain.