2.2 Cisco IOS CA for VPN Authentication CCIE-SECURITY Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company is deploying a Cisco IOS CA on a router that also serves as a VPN gateway. The router has limited CPU and memory. The CA will issue certificates to about 200 remote VPN clients. The security team requires that the CA's private key be stored securely and that the CA be able to issue certificates even if the router is rebooted. Which configuration approach best meets these requirements?

   • AGenerate the CA key pair on the router and export it to a TFTP server for backup.
   • BUse a software-based CA with the private key stored in NVRAM and enable automatic backup of the configuration.
   • CUse a hardware security module (HSM) or a USB token for the CA private key, and configure the CA to use it.
   • DUse a public CA to issue certificates to the VPN clients.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A VPN administrator is enrolling a new router with a Cisco IOS CA using SCEP. The router is behind a NAT and uses a private IP address. The CA is configured with a certificate policy that requires the subject name to include the router's hostname. The enrollment fails with 'subject name mismatch'. What is the most likely cause?

   • AThe router's hostname is not resolvable by the CA.
   • BThe router's certificate request includes the private IP address in the subject name instead of the hostname.
   • CThe CA's clock is not synchronized with the router.
   • DThe SCEP shared secret is incorrect.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company has a Cisco IOS CA and multiple VPN gateways. They want to use certificate-based authentication for site-to-site VPNs. The security team requires that if a VPN gateway's certificate is compromised, it can be revoked and the revocation information propagated quickly to all other gateways. The company has limited bandwidth and wants to minimize the overhead of revocation checking. Which approach is most appropriate?

   • ADisable revocation checking to reduce overhead.
   • BUse OCSP with a local responder on each VPN gateway to cache responses.
   • CUse a CRL that is downloaded once per day from the CA.
   • DUse a CRL with a very short lifetime and require all gateways to fetch it frequently.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A VPN tunnel between two routers using certificates from a Cisco IOS CA fails to establish. The debug output shows 'certificate validation failed' and 'unable to get local issuer certificate'. The routers are configured with the same trustpoint and have enrolled successfully. What is the most likely cause?

   • AThe routers' certificates have expired.
   • BThe CA certificate is not installed in the trustpoint on one of the routers.
   • CThe routers are using different key pairs.
   • DThe routers' clocks are not synchronized.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A network engineer is setting up a Cisco IOS CA on a router that also runs BGP and OSPF. The router has limited CPU. The CA will issue certificates to 50 VPN peers. The engineer wants to minimize the impact of the CA on the router's routing performance. Which configuration is most appropriate?

   • AIncrease the router's CPU priority for the CA process.
   • BDisable routing protocols on the router to free CPU for the CA.
   • CUse a separate, dedicated router for the CA to offload certificate processing.
   • DUse a lower RSA key size (e.g., 1024-bit) for the CA to reduce CPU usage.
   Reveal Solution Discussion Select an answer first