Which of the following MUST be updated immediately when an employee is terminated to prevent
unauthorized access?

A.
Registration

B.
CA

C.
CRL

D.
Recovery agent

Explanation:
Certificates or keys for the terminated employee should be put in the CRL.
A certificate revocation list (CRL) is created and distributed to all CAs to revoke a certificate or key.
By checking the CRL you can check if a particular certificate has been revoked.
Incorrect Answers:
A: The registration of any certificates or keys for the terminated employee should be revoked. These keys
and certificates should be put in the CRL.
B: More specifically, it is not the CA that need to be updated, just the CRL.D: A recovery agent is an entity that has the ability to recover a key, key components, or plaintext
messages as needed. A recovery is not affected when a user is terminated.

Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, 6th Edition, Sybex, Indianapolis,
2014, pp. 262, 279-280, 280-281, 285