ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
During a post-incident review, your organization finds that several microservices crashed because their mutually authenticated TLS certificates were not renewed in time. As the secure software engineer, which control should you implement to manage the certificates' lifecycle and prevent similar outages while minimizing manual effort?
Disable mutual TLS between microservices and rely on internal network segmentation and firewall rules to mitigate risk of outdated certificates.
Increase certificate validity to five years and track upcoming expirations in a shared spreadsheet reviewed monthly.
Integrate an automated certificate management solution that uses the ACME protocol to request, renew, and revoke short-lived certificates directly from the CI/CD pipeline.
Store all service private keys in a central network share accessible to the DevOps team and perform manual renewals during quarterly maintenance windows.
Automating the full certificate lifecycle is the most reliable way to avoid expiration-related outages. A service that supports the ACME protocol can automatically enroll, renew, and revoke short-lived certificates from the CI/CD pipeline, ensuring continuous availability while enforcing least-privilege access to keys. Simply extending validity periods or using manual spreadsheets still relies on human intervention and increases exposure if a key is compromised. Storing private keys in a shared location violates least-privilege and creates additional risk. Disabling mutual TLS or certificate validation removes a critical security control rather than solving the lifecycle problem.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is the ACME protocol and how does it work?
Open an interactive chat with Bash
What is mutual TLS, and why is it important for microservices?
Open an interactive chat with Bash
Why are short-lived certificates preferred for automated management systems?
Open an interactive chat with Bash
What is the ACME protocol and why is it used in certificate management?
Open an interactive chat with Bash
Why are short-lived certificates preferred over long-lived ones?
Open an interactive chat with Bash
How do CI/CD pipelines enhance certificate management automation?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)