Which statement is true about storing an unenrolled token?

• A. It can be stored unsecured
• B. It must be stored securely and is not allowed unsecured
• C. It should be mailed to the RA
• D. It can be left on the desk for convenience

Answer: (B)

Unenrolled tokens are sensitive credentials that could grant access before they’re bound to a user, so they must be kept in secure storage to prevent loss, theft, or tampering. Treating them as secure material preserves the integrity of the enrollment process and reduces risk. Leaving a token unsecured or in an easily accessible place like a desk creates opportunities for misuse, and mailing it to a registration authority adds transmission risks and potential interception. Therefore, the proper practice is to store the token securely and not unsecured.