If the certificate serial number appears on the Certificate Revocation List, what response is expected from the server?

• A. ACTIVE
• B. REVOKED
• C. INVALID
• D. UNKNOWN

Answer: (B)

When a certificate's serial number appears on the Certificate Revocation List (CRL), it indicates that the certificate has been revoked by the issuing authority before its expiration date. In this context, the server's response should indicate the status of the certificate.

Choosing "REVOKED" as the response is appropriate because it directly reflects the state of the certificate's validity. A certificate that is on the CRL is no longer considered trustworthy for secure transactions, as its revocation can stem from various reasons, such as the compromise of the private key, change in associating identity, or the entity no longer being authorized to use the certificate.

Different responses may indicate other states: “ACTIVE” would suggest the certificate is valid and currently in use, “INVALID” might imply that there is some mismatch or error beyond just revocation, and “UNKNOWN” would suggest that the status cannot be determined. In this case, since the certificate is specifically listed as revoked in the CRL, the conclusion must be that its status is "REVOKED," aligning clearly with the security best practices regarding the validation of certificates.