2.2 Cisco IOS CA for VPN Authentication CCIE-SECURITY Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which alternative to CRL can be used to check certificate revocation status in real time?

   • ARADIUS
   • BSCEP
   • COCSP
   • DLDAP
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In an IPsec VPN using certificates for authentication, what is used to map a certificate to a peer identity?

   • AThe pre-shared key
   • BThe certificate subject name or alternative name
   • CThe peer's IP address only
   • DThe CA's serial number
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A network engineer is setting up a Cisco IOS router as a Certificate Authority for a small remote-access VPN. The router's hostname is currently 'Router' and the domain name is unset. To ensure the CA issues certificates with a proper subject name and that SCEP enrollment works, which two configuration steps must be performed first?

   • ASet the hostname to a unique name and configure the domain name, then enable the CA server.
   • BGenerate an RSA key pair and then enable the CA server.
   • CConfigure a CRL distribution point and then enable the CA server.
   • DSet the domain name only and enable the CA server.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A network architect is planning to deploy a Cisco IOS CA for a VPN with multiple remote sites. The CA will be hosted on a router that also performs other routing functions. What is a key consideration to ensure the CA is reliable?

   • AUse a pre-shared key for the CA's own authentication.
   • BEnsure the router has sufficient CPU and memory to handle certificate signing and CRL generation.
   • CDisable the CA server during peak hours to save resources.
   • DUse the same router as the VPN gateway to reduce latency.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company has a Cisco IOS CA and multiple VPN gateways. Recently, a VPN gateway started rejecting all certificate-based connections with 'certificate revoked' errors, even though the certificates are valid. The CA's CRL is published at a URL, and the gateways are configured to fetch it. The CA's clock is correct. What is the most likely cause?

   • AThe VPN gateway's clock is skewed, causing it to misinterpret the CRL's nextUpdate field.
   • BThe VPN gateway is configured to use OCSP but the CA only supports CRL.
   • CThe CRL is not being updated on the CA; it still contains old revoked certificates.
   • DThe CA's certificate has expired, causing the CRL to be invalid.
   Reveal Solution Discussion Select an answer first