A remote VPN peer is located in a DMZ and cannot reach the Cisco IOS CA via SCEP because the CA is on an internal network. The peer can reach the internal network via a management VPN. What is the recommended method for the peer to enroll?

Use manual enrollment: generate a key pair, create a certificate request, and copy the signed certificate back to the peer.

Copy the CA certificate to the peer and use it as a pre-shared key.

Use a pre-shared key instead of certificates.

Use SCEP over the management VPN by allowing port 80 through the firewall.

A network engineer is setting up a small branch office VPN where remote routers will authenticate using certificates. The engineer decides to use a Cisco IOS router as the Certificate Authority. After configuring the hostname and domain name, what is the next required step to enable the CA server function?

Configure a CRL distribution point using 'crypto pki crl' before enabling the server.

Issue the 'crypto pki server' command and then 'no shutdown' in the server configuration mode.

Generate a self-signed root certificate using 'crypto key generate rsa' before enabling the server.

Set the enrollment URL on the router itself using 'crypto pki enrollment' before starting the server.

A VPN administrator is troubleshooting a certificate-based IPsec tunnel that fails to establish. The router logs show 'certificate not yet valid' during IKE authentication. What is the most likely cause?

The certificate has been revoked.

The router's clock is set to a time before the certificate's validity start date.

The router's hostname does not match the certificate subject.

The certificate was issued by a different CA.

A network architect is designing a PKI for a multi-site VPN. They plan to use a Cisco IOS router as the CA. The architect wants to ensure that the CA is highly available and can issue certificates even if the primary CA fails. What is the best approach?

Use the same CA certificate on multiple routers.

Configure the VPN routers to use a public CA instead.

Back up the CA configuration and restore it on a new router when needed.

Set up a second Cisco IOS router as a subordinate CA and configure cross-certification.

An organization uses a Cisco IOS CA to issue certificates to VPN clients. They want to ensure that if a client certificate is compromised, it can be quickly revoked and the revocation information is available to VPN gateways in real-time. Which solution should they implement?

Set the certificate's validity period to a very short duration.

Configure OCSP on the CA and enable OCSP checking on the VPN gateways.

Manually notify each VPN gateway to reject the certificate.

Use a CRL that is updated daily and distributed via HTTP.

CCIE Security

Domain 2Objective 2

2.2 Cisco IOS CA for VPN Authentication CCIE-SECURITY Practice Questions (Page 7)

Part of the 2.0 Secure Connectivity and Segmentation domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

6concepts

20%of the exam

Questions 31–35

31application · medium
A remote VPN peer is located in a DMZ and cannot reach the Cisco IOS CA via SCEP because the CA is on an internal network. The peer can reach the internal network via a management VPN. What is the recommended method for the peer to enroll?
Select an answer first
32application · medium
A network engineer is setting up a small branch office VPN where remote routers will authenticate using certificates. The engineer decides to use a Cisco IOS router as the Certificate Authority. After configuring the hostname and domain name, what is the next required step to enable the CA server function?
Select an answer first
33application · medium
A VPN administrator is troubleshooting a certificate-based IPsec tunnel that fails to establish. The router logs show 'certificate not yet valid' during IKE authentication. What is the most likely cause?
Select an answer first
34application · medium
A network architect is designing a PKI for a multi-site VPN. They plan to use a Cisco IOS router as the CA. The architect wants to ensure that the CA is highly available and can issue certificates even if the primary CA fails. What is the best approach?
Select an answer first
35application · medium
An organization uses a Cisco IOS CA to issue certificates to VPN clients. They want to ensure that if a client certificate is compromised, it can be quickly revoked and the revocation information is available to VPN gateways in real-time. Which solution should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.