Which action is associated with the revocation process when a token expires?

• A. Revocation request to RA office
• B. Reissue without revocation
• C. Ignore expiration
• D. Reset PIN only

Answer: (A)

When a token expires, the proper step is to initiate a revocation request to the Registration Authority (RA) office. This formally notifies the issuer to invalidate the token, updating revocation records (like a CRL or OCSP response) so the expired credential can no longer be used for authentication. The goal is to prevent any continued access with a token that should no longer be trusted.

Reissuing without revocation would leave the old token considered valid, defeating the purpose of revocation. Ignoring expiration is unsafe and undermines security. Resetting a PIN only affects local access controls and does not invalidate the token within the system.