Question: When a Security Gateway (SEG) Certification Authority (CA) is removed from a telecom network, what action MUST be taken for its unexpired certificates issued to SEGs or Transport Layer Security (TLS) entities?
Option 1: Immediately revoke all associated IP addresses
Option 2: Update the network's firewall rules to block incoming requests
Option 3: Conduct a full network security audit before taking any action
Option 4: List them in Certificate Revocation Lists (CRLs) or Online Certificate Status Protocol (OCSP) servers
Explanation: When a SEG CA is removed, to maintain network security and prevent potential misuse of certificates that have not yet expired, it's crucial to inform all relying parties about the revocation. Listing these certificates in CRLs or OCSP servers ensures that entities attempting to use them for authentication or encryption will be notified of their invalidity, thus preventing unauthorized access. This action aligns with best practices for certificate management and security in telecom networks.