What is the certificate deployment and management behavior when the security level is set to High?

The "High" security level on a Cohesity cluster is designed to enforce the most stringent security controls. This configuration restricts automatic certificate deployment to only "known hosts"—those that have been previously registered with the cluster—to prevent unauthorized systems from obtaining a certificate. To ensure that compromised certificates are rapidly identified and invalidated, the Certificate Revocation List (CRL) is refreshed at a high frequency of every hour. This combination of restricted deployment and frequent validation maintains a robust security posture.

A: The CRL refresh interval for the High security level is 1 hour, not 4 hours. The 4-hour interval is associated with the Medium security level.

B: At the High security level, certificates are deployed automatically only to "known hosts," not to "all hosts," as a measure to enhance security.

D: Certificate deployment is automatic for known hosts, not token-based for all hosts, and the CRL refresh interval is incorrect for the High level.

1. Cohesity Security Guide (Version 7.x): In the "Security Management" chapter

the section "Configuring Cluster Security Level" details the specific parameters for each setting. It explicitly states that the "High" level configures automatic certificate deployment for known hosts and sets the CRL refresh interval to 1 hour.

2. Cohesity Administration Foundations Courseware (COH-285 Module 3: Security): The lesson on "Cluster Security Hardening" describes the three security levels. The material confirms that the "High" setting limits certificate issuance to known hosts and increases the CRL check frequency to hourly to minimize the window of exposure from a compromised certificate.