2.2 Cisco IOS CA for VPN Authentication CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard · select all that apply

   A Cisco IOS CA is used for VPN authentication. The administrator wants to ensure that revoked certificates are immediately rejected. Which methods can be used to achieve this? (Select all that apply.)

   • ADisable CRL checking to avoid delays.
   • BConfigure the VPN gateways to use CRL with a very short cache lifetime.
   • CManually distribute the CRL to each gateway after each revocation.
   • DConfigure the VPN gateways to use OCSP.
   Check answers Discussion Select an answer first
2. 22expert · hard

   A Cisco IOS CA is being configured, but the engineer is unsure about the CA's certificate validity period. The default validity period is too short for the company's needs, and the engineer wants to set it to 10 years. Which command should be used?

   • Acrypto pki cert-request cs-label lifetime 10
   • Bcrypto pki server cs-label lifetime years 10
   • Ccrypto pki trustpoint cs-label enrollment lifetime 10
   • Dcrypto pki server cs-label grant auto
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A remote VPN peer is trying to enroll with a Cisco IOS CA using SCEP, but the enrollment request times out. The peer's IP address is reachable from the CA, and the CA server is running. What is the most likely cause and fix?

   • AThe peer's clock is not synchronized; use NTP to sync time before enrollment.
   • BThe peer's hostname is not resolvable; add a DNS entry.
   • CThe CA's SCEP port (80) is blocked by an ACL; allow TCP port 80 to the CA.
   • DThe CA's certificate is expired; regenerate the CA certificate.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A VPN gateway is configured to use certificates for authentication, but the administrator wants to restrict access to only peers whose certificates have a specific subject alternative name (SAN) of type email. Which configuration is required?

   • AUse a CRL to filter certificates by email.
   • BCreate a certificate map that matches the email field in the SAN and apply it to the ISAKMP profile.
   • CConfigure the CA to issue certificates only with that email in the SAN.
   • DSet the ISAKMP policy to require a specific pre-shared key.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A VPN administrator is using a Cisco IOS CA to authenticate IPsec peers. A user's laptop was stolen, and the administrator revokes the laptop's certificate. However, the VPN gateway still accepts the stolen certificate. What is the most likely reason?

   • AThe certificate was not actually revoked; the administrator forgot to save the configuration.
   • BThe VPN gateway is not configured to check the CRL during certificate validation.
   • CThe VPN gateway's clock is incorrect, causing the CRL to be considered invalid.
   • DThe CA server is down, so the CRL cannot be retrieved.
   Reveal Solution Discussion Select an answer first