Question: What is a mandatory requirement for the Key Usage extension in TLS certificates, as per Network Domain Security (NDS) guidelines, specifically for certificates not using Diffie-Hellman key exchange?
Option 1: At least **keyEncipherment** or **digitalSignature** shall be set.
Option 2: Only **keyAgreement** shall be set.
Option 3: Both **dataEncipherment** and **keyCertSign** must be included.
Option 4: **CRLSign** is the sole required usage.
Explanation: According to the NDS guidelines for TLS entity certificate profiles, for certificates not specifically mentioned as using Diffie-Hellman (where keyAgreement is required), at least one of **digitalSignature** or **keyEncipherment** must be set in the Key Usage extension. This ensures the certificate can properly facilitate secure communication, whether through signing digital messages or encrypting keys.