Question: In an NDS/AF compliant environment, what is the expected action when a Network Entity (NE) or Security Gateway (SEG) has no valid cached Certificate Revocation List (CRL) available?
Option 1: The NE or SEG shall send an IKEv2 CERTREQ for a CRL to the peer entity.
Option 2: The NE, SEG, or TLS entity shall fetch a new CRL from the CRL Distribution Point.
Option 3: The NE or SEG can proceed with tunnel establishment using the last known configuration.
Option 4: The NE or SEG shall request a delta CRL to minimize network traffic.
Explanation: According to NDS/AF specifications, if no valid cached CRL is available, the NE, SEG, or TLS entity must fetch a new full CRL from the designated CRL Distribution Point to ensure security and compliance. This action is mandated to verify the revocation status of certificates before proceeding with secure tunnel establishment.