Comprehensive and Detailed in-Depth
Problem Statement:
The security administrator needs a solution that:
Securesmultiple subdomainsunder asingle domain name.
Simplifiesprivate key management.
UsesX.509 certificates, which are common forTLS/SSLin web environments.
Why the Correct Answer is C (Wildcard certificate):
AWildcard certificateallows thesame certificateto securemultiple subdomainsof a domain.
The format for a wildcard certificate is usually:
CopyEdit
*.example.com
This single certificate can cover:
hr.example.com
payroll.example.com
benefits.example.com
It significantlyreduces administrative overheadsince onlyone certificate and one private keyare needed.
In anX.509 context, a wildcard certificate is commonly used forweb servers that host multiple subdomains.
Key Benefits of Wildcard Certificates:
Cost-Effective:One certificate forall subdomains.
Simplified Management:Oneprivate keyto secure multiple services.
Flexibility:Can addnew subdomainswithout issuing a new certificate.
Compatibility:Widely supported inweb servers and application frameworks.
Why the Other Options Are Incorrect:
A . Certificate revocation list (CRL):
A CRL is used tolist revoked certificatesand ensure they are no longer trusted.
It does notsecure multiple subdomainsormanage private keys.
B . Digital signature:
A digital signature is used toverify the integrity and authenticityof data.
It is not related tomanaging certificates or securing subdomains.
D . Registration authority (RA):
An RA is responsible forvalidating identity and issuing certificates.
It does not directly address theissue of securing multiple subdomains.
E . Certificate pinning:
Certificate pinning ensures that an application only trustsspecific public keysto preventMitM attacks.
It does not providemulti-subdomain supportorsimplify key management.
Real-World Scenario:
An organization runs anHR portalwith multiple subdomains:
login.hr.example.com
docs.hr.example.com
support.hr.example.com
Implementing awildcard certificateallows the company tomanage a single certificatewhile covering all these subdomains.
This reduces themaintenance workloadsince updates or renewals only need to be performed onone certificate.
Example of a Wildcard Certificate in Practice:
Common Name (CN):
CopyEdit
*.hr.example.com
Usage:
Secures all subdomains within thehr.example.comnamespace.
Reduces thenumber of certificates neededfrom one per subdomain to justone wildcard certificate.
Visual Representation:
lua
CopyEdit
+--------------------------+
| Wildcard Certificate |
| (*.hr.example.com) |
+--------------------------+
|
+----------------+----------------+
| |
hr.example.com payroll.hr.example.com
|
benefits.hr.example.com
Asingle wildcard certificatecovers all subdomains underhr.example.com.
Extract from CompTIA SecurityX CAS-005 Study Guide:
TheCompTIA SecurityX CAS-005 Official Study Guideemphasizes thatwildcard certificatesare an efficient solution when securingmultiple subdomains under the same domain. They reduce the complexity ofprivate key managementand streamline thecertificate deployment process.

The company should implement OCSP stapling and HSTS to improve TLS performance and enforce HTTPS. OCSP stapling is a technique that allows a server to provide a signed proof of the validity of its certificate along with the TLS handshake, instead of relying on the client to contact the certificate authority (CA) for verification. This can reduce the latency and bandwidth of the TLS handshake, as well as improve the privacy and security of the certificate status. HSTS stands for HTTP Strict Transport Security, which is a mechanism that instructs browsers to only use HTTPS when connecting to a website, and to reject any unencrypted or invalid connections. This can prevent downgrade attacks, man-in-the-middle attacks, and mixed content errors, as well as improve the performance of HTTPS connections by avoiding unnecessary redirects. Verified Reference:
https://www.techtarget.com/searchsecurity/definition/OCSP-stapling
https://www.techtarget.com/searchsecurity/definition/HTTP-Strict-Transport-Security
https://www.cloudflare.com/learning/ssl/what-is-hsts/

An API gateway is a management tool that sits between a client and a collection of backend services. It acts as a reverse proxy to accept all application programming interface (API) calls, aggregate the various services required to fulfill them, and return the appropriate result. API gateways can enforce policies such as rate limiting and authentication to prevent unauthorized access, making it an effective solution to prevent unauthorized API key sharing. By managing APIs at the gateway level, organizations can ensure that API keys are used as intended and are not shared or misused, addressing the need for secure management of API keys​​.