Which OpenSSL command generates a new private key and a self-signed certificate in a single step?

openssl x509 -in cert.pem -text -noout

openssl s_client -connect example.com:443

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365

openssl genrsa -out key.pem 2048

A client application is failing to connect to a server over HTTPS, and the error message indicates an 'unable to get local issuer certificate' error. The server's certificate chain is correctly configured and the server certificate is valid. What is the most likely cause of this error?

The server is using an unsupported TLS protocol version

The server certificate has expired

The client does not have the root CA certificate in its trust store

The server is not sending the intermediate certificate

An organization is setting up a new internal service that will be accessed via the hostname service.internal.example.com. The service will be used by internal clients, and the organization wants to use a certificate issued by its internal CA. The administrator has already generated a private key. What is the next step?

Install the private key on the server and enable HTTPS

Submit the private key to the internal CA for signing

Generate a self-signed certificate and use it for the service

Create a CSR with the hostname service.internal.example.com and submit it to the internal CA

Why is it important to renew an SSL certificate before it expires?

To update the server's IP address

To increase the encryption key length automatically

To avoid service interruptions and security warnings for clients

To change the certificate's serial number

A company has a web application that uses an SSL certificate expiring in 30 days. The operations team wants to automate the renewal process to avoid manual intervention. The certificate is issued by a CA that supports automated validation. Which approach should the team implement?

Create a cron job that copies the existing certificate to the server every day

Disable certificate validation in the application to avoid expiration issues

Manually generate a new CSR and submit it to the CA every 30 days

Use a certificate management tool like Certbot with the appropriate DNS or HTTP challenge to automatically renew and deploy the certificate

CiscoCertified DevNet Professional

Domain 4Objective 9

Configure Application Specific SSL Certificates 350-901 Practice Questions (Page 4)

Part of the 4.0 Application Deployment and Security domain, which accounts for 20% of the 350-901 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

8concepts

20%of the exam

Questions 16–20

16foundation · easy
Which OpenSSL command generates a new private key and a self-signed certificate in a single step?
Select an answer first
17expert · hard
A client application is failing to connect to a server over HTTPS, and the error message indicates an 'unable to get local issuer certificate' error. The server's certificate chain is correctly configured and the server certificate is valid. What is the most likely cause of this error?
Select an answer first
18application · medium
An organization is setting up a new internal service that will be accessed via the hostname service.internal.example.com. The service will be used by internal clients, and the organization wants to use a certificate issued by its internal CA. The administrator has already generated a private key. What is the next step?
Select an answer first
19foundation · easy
Why is it important to renew an SSL certificate before it expires?
Select an answer first
20application · medium
A company has a web application that uses an SSL certificate expiring in 30 days. The operations team wants to automate the renewal process to avoid manual intervention. The certificate is issued by a CA that supports automated validation. Which approach should the team implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-901

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-901” is a trademark of its owner, used for identification only.