2.2 Cisco IOS CA for VPN Authentication CCIE-SECURITY Practice Questions (Page 10)

Questions 46–49

1. 46application · medium

   A network engineer is setting up a Cisco IOS CA for a small enterprise. The CA will be used to issue certificates to VPN routers. The engineer wants to ensure that the CA's own certificate is not vulnerable to compromise. Which practice is most important when configuring the CA server?

   • AStore the CA configuration in a public location for backup.
   • BUse a strong RSA key pair (e.g., 2048-bit or higher) for the CA and protect the private key.
   • CSet the CA server to automatically renew its certificate every 30 days.
   • DEnable SCEP enrollment without any authentication to simplify the process.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A company uses a Cisco IOS CA to issue certificates to remote access VPN clients. Recently, a laptop was stolen, and its certificate must be revoked. The administrator revokes the certificate and publishes a new CRL. However, a test shows that the stolen laptop can still establish a VPN connection. What is the most likely reason?

   • AThe VPN gateway is not configured to check the CRL during certificate validation.
   • BThe CRL has not been regenerated after revocation.
   • CThe certificate has not expired, so it is still valid.
   • DThe VPN gateway is using a different trustpoint than the CA.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A network administrator is enrolling a new VPN router with a Cisco IOS CA using SCEP. The router generates its RSA key pair and sends a certificate request. The administrator notices that the router's certificate is not being issued. The CA logs show that the request is pending. What is the most likely reason?

   • AThe router's clock is not synchronized with the CA.
   • BThe SCEP shared secret is incorrect.
   • CThe router's key pair is too weak (e.g., 512-bit).
   • DThe CA is configured to require manual approval of certificate requests.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A security engineer is configuring a site-to-site IPsec VPN between two Cisco routers. They want to use certificates from their internal Cisco IOS CA for authentication. The engineer has configured the trustpoint on both routers and enrolled them. However, the VPN tunnel fails to establish. The debug output shows 'certificate validation failed'. What is a likely cause?

   • AThe routers are using the same certificate.
   • BThe routers have not been configured with a pre-shared key.
   • CThe routers' clocks are synchronized.
   • DThe routers' certificates were issued by different CAs.
   Reveal Solution Discussion Select an answer first