A large enterprise is designing a PKI to issue certificates for both internal applications and employee smart-card authentication. The security team wants to protect the root CA from compromise while keeping the issuing CA available for daily operations. Which design best meets these requirements?

Keep the root CA offline and use an intermediate CA for issuing certificates.

Use self-signed certificates for each application and smart card.

Use a single online root CA to issue all certificates directly.

Use a public CA for all internal and smart-card certificates.

A security analyst notices that a recently compromised employee's client certificate is still being accepted by the company's VPN gateway. The certificate was issued by the internal CA and is not set to expire for another six months. What is the most immediate action to prevent further use of this certificate?

Disable the employee's user account in Active Directory

Renew the certificate with a new key pair

Wait for the certificate to expire naturally

Add the certificate's serial number to the CA's certificate revocation list (CRL)

A company's web server certificate is about to expire. The administrator renews the certificate with the same key pair. Which security consideration is most important to address?

Ensure the renewed certificate is installed before the old one expires to avoid service interruption.

Revoke the old certificate immediately after renewal.

Generate a new key pair to ensure the certificate is secure.

Change the certificate's validity period to one year.

A security administrator is configuring a web server's TLS certificate. The certificate is about to expire, and the administrator wants to replace it without causing downtime. The CA requires proof of domain ownership before issuing a new certificate. Which process should the administrator follow?

Generate a new key pair, submit a certificate signing request (CSR) to the CA, complete the domain validation challenge, and install the new certificate before the old one expires

Wait until the certificate expires and then request a new one from the CA

Use a self-signed certificate with the same subject name as the expiring certificate

Reuse the existing private key and submit the same CSR to the CA to get a new certificate with the same key

CiscoCertified CyberOps Associate

Domain 2Objective 10

symmetric) 200-201 Practice Questions (Page 2)

Part of the 2.0 Security Monitoring domain, which accounts for 25% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–2 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

5concepts

25%of the exam

Questions 6–10

6expert · hard
A large enterprise is designing a PKI to issue certificates for both internal applications and employee smart-card authentication. The security team wants to protect the root CA from compromise while keeping the issuing CA available for daily operations. Which design best meets these requirements?
Select an answer first
7application · medium
A security analyst notices that a recently compromised employee's client certificate is still being accepted by the company's VPN gateway. The certificate was issued by the internal CA and is not set to expire for another six months. What is the most immediate action to prevent further use of this certificate?
Select an answer first
8application · medium
A company's web server certificate is about to expire. The administrator renews the certificate with the same key pair. Which security consideration is most important to address?
Select an answer first
9foundation · easy
When a client connects to a secure website using TLS, which key is used to encrypt the session key that is sent to the server?
Select an answer first
10application · medium
A security administrator is configuring a web server's TLS certificate. The certificate is about to expire, and the administrator wants to replace it without causing downtime. The CA requires proof of domain ownership before issuing a new certificate. Which process should the administrator follow?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

2.10 Describe the Impact of Certificates on Security (includes PKI, Public/private Crossing the Network, Asymmetric/symmetric) 200-201 Practice Questions (Page 2)

Questions 6–10

A large enterprise is designing a PKI to issue certificates for both internal applications and employee smart-card authentication. The security team wants to protect the root CA from compromise while keeping the issuing CA available for daily operations. Which design best meets these requirements?

A company's web server certificate is about to expire. The administrator renews the certificate with the same key pair. Which security consideration is most important to address?

When a client connects to a secure website using TLS, which key is used to encrypt the session key that is sent to the server?

A security administrator is configuring a web server's TLS certificate. The certificate is about to expire, and the administrator wants to replace it without causing downtime. The CA requires proof of domain ownership before issuing a new certificate. Which process should the administrator follow?

Keep studying — 2.0 Security Monitoring