2.2 Cisco IOS CA for VPN Authentication CCIE-SECURITY Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A security administrator is managing a Cisco IOS CA. A VPN gateway's certificate has been revoked, but the gateway continues to establish VPN tunnels. The administrator has verified that the gateway is configured to check the CRL. What is a possible reason the revoked certificate is still accepted?

   • AThe certificate was not actually revoked; the administrator revoked the wrong certificate.
   • BThe CRL is cached on the gateway and has not expired yet, so the gateway uses the stale CRL.
   • CThe gateway is using a different trustpoint.
   • DThe gateway's clock is set to a time before the revocation.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company is deploying a Cisco IOS CA and wants to automate certificate enrollment for a large number of VPN routers. They plan to use SCEP with a shared secret. However, the security team is concerned about the shared secret being compromised. What is the best way to mitigate this risk?

   • ADisable SCEP and use a public CA instead.
   • BUse a different shared secret for each router.
   • CUse a strong, randomly generated shared secret and rotate it regularly.
   • DUse manual enrollment for all routers to avoid using a shared secret.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company is deploying a new remote-access VPN for teleworkers. The VPN gateway uses a Cisco IOS CA to issue certificates to client devices. The teleworkers' devices are not always online, and the IT team wants to minimize manual steps. Which enrollment method should be configured on the clients?

   • AManual enrollment via copy-paste of certificate requests
   • BEnrollment through TFTP download of a pre-generated certificate
   • CEnrollment using a pre-shared key (PSK) for authentication
   • DSCEP enrollment using a shared secret
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A network architect is designing a PKI for a large enterprise with multiple regional offices. They plan to use a single Cisco IOS CA at headquarters. However, the WAN links to some remote offices are unreliable, and certificate enrollment may fail. What is the best approach to ensure that remote routers can still obtain certificates?

   • ASet up a subordinate CA at each regional office to issue certificates locally.
   • BPre-generate certificates for all remote routers and distribute them via secure courier.
   • CUse a public CA for remote routers and the internal CA for headquarters.
   • DUse manual enrollment via email for remote routers.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A VPN administrator is troubleshooting why a remote router cannot complete certificate enrollment with the Cisco IOS CA. The router generates a key pair and sends a certificate request, but the CA does not issue a certificate. The CA logs show 'certificate request rejected'. What is the most likely cause?

   • AThe router's clock is not synchronized with the CA, causing the request to be considered invalid.
   • BThe router's certificate request does not include the correct subject name that matches the CA's policy.
   • CThe CA server is not configured with a CRL distribution point, so it rejects all requests.
   • DThe router is using the wrong enrollment URL, so the request never reaches the CA.
   Reveal Solution Discussion Select an answer first