SY0-701 Question 35
Single answerA financial services company is deploying a new internal web application that handles sensitive customer data. The security team must ensure the TLS private keys used by the application are strongly protected, certificate validity can be checked in real time, and administrators can recover certain encrypted business records if an employee leaves unexpectedly. The company already uses a third-party certificate authority for server certificates. Which solution BEST meets these requirements?
- A
Store the web server's private key in a hardware security module (HSM), use OCSP to validate certificate status, and implement key escrow for approved recovery of encryption keys
- B
Use a self-signed certificate for the web application, store the private key on the local server disk, and rely on certificate expiration dates instead of live status checks
- C
Generate all TLS keys in the server's TPM, use a public key to decrypt archived business records, and avoid key escrow because it weakens PKI trust
- D
Use a secure enclave on employee laptops to store the web server's private key, and replace OCSP with manual certificate checks by administrators
Show answer and explanation
Correct answer: A
Explanation
The best answer is the combination of HSM + OCSP + key escrow. In enterprise PKI, private keys for high-value services such as TLS termination should be strongly protected using dedicated hardware where possible; HSMs are designed for this purpose and are commonly used for web servers, CAs, code signing, and other sensitive workloads. OCSP, defined by the IETF in RFC 6960, allows a client or relying party to obtain the revocation status of a certificate from an OCSP responder without waiting for certificate expiration. Key escrow is not used for TLS trust itself, but it can be used for recoverable encryption keys when business, legal, or continuity requirements demand it. By contrast, self-signed certificates reduce trust in production, TPMs are more device/platform-focused than centralized enterprise key custody for web infrastructure, and secure enclaves are not a substitute for centralized HSM-backed server key management. Relevant best-practice references include NIST guidance on key management such as NIST SP 800-57 and public key infrastructure operational guidance, along with RFC 6960 for OCSP.
- A. Correct.
Correct. An HSM is specifically designed to generate, store, and protect highly sensitive cryptographic keys such as server TLS private keys, often with strong tamper resistance and limited key export. OCSP provides near real-time certificate revocation/status checking, which is more responsive than waiting for expiration or relying only on static revocation data. Key escrow is appropriate when an organization has a documented business requirement to recover certain encryption keys, such as for archived business records, legal hold, or continuity of operations. This combination aligns with enterprise PKI best practices.
- B. Incorrect.
Incorrect. A self-signed certificate does not provide the same trust model as a certificate issued by a trusted third-party CA, especially for a production financial application. Storing a private key on local server disk without hardware-backed protection is weaker than using an HSM. Relying only on expiration ignores revocation events such as key compromise; PKI best practice is to check certificate status through mechanisms such as OCSP or CRLs.
- C. Incorrect.
Incorrect. A TPM can protect keys on a specific platform and is useful for device identity, measured boot, and local key protection, but it is not typically the best choice for centrally protecting high-value web server TLS keys in an enterprise environment when an HSM is available. Also, a public key is not used to decrypt business records that were encrypted for confidentiality in standard public key cryptography; the corresponding private key performs decryption. Avoiding key escrow categorically is a misconception because some organizations have valid recovery requirements for certain encryption keys.
- D. Incorrect.
Incorrect. A secure enclave is a hardware-isolated processing/storage environment on endpoint devices and can help protect sensitive operations locally, but storing a centralized web server's private key on employee laptops is operationally and security-wise inappropriate. Manual certificate checks do not scale and do not provide timely automated revocation validation like OCSP. This option fails both the key protection and certificate status requirements.