Examkin

Question

Difficulty: HardPassword Security Policies, MFA, and Certificates

A network engineer is configuring digital certificate authentication for Cisco Identity Services Engine (ISE) and enterprise network infrastructure. To ensure proper certificate deployment and validation, the engineer must correctly identify the operational function of each Public Key Infrastructure (PKI) element. Match each PKI component on the left to its corresponding primary function on the right.

  • Certificate Signing Request (CSR)Contains an entity's public key and identity details sent to an issuing authority to generate a signed certificate.
  • Root Certificate Authority (CA) CertificateServes as the trusted anchor installed on client devices to validate the authenticity of issued server certificates.
  • Subject Alternative Name (SAN)Allows multiple domain names or IP addresses to be secured by a single X.509 digital certificate.
  • Online Certificate Status Protocol (OCSP)Enables real-time verification of an individual certificate's revocation status without downloading full revocation lists.

Answer

Certificate Signing Request (CSR) matches the description of containing public key and identity details sent to an issuing authority; Root CA Certificate matches serving as the trusted anchor on client devices; Subject Alternative Name (SAN) matches allowing multiple domain names or IP addresses on a single certificate; Online Certificate Status Protocol (OCSP) matches enabling real-time verification of certificate revocation status.
Each PKI component plays a distinct role in digital certificate lifecycle management and authentication: CSRs initiate certificate issuance by bundling public keys and subject identity; Root CA certificates establish client-side trust anchors; SAN extensions allow single certificates to cover multiple FQDNs/IPs; and OCSP provides real-time revocation checks.

Step-by-Step Solution

1
Analyze the role of a Certificate Signing Request (CSR).
Identify that a CSR is generated prior to certificate issuance and holds the public key and subject attributes submitted to a CA.
CSR generation is the initial step in obtaining an identity certificate from a public or private PKI.
2
Analyze the function of a Root CA Certificate.
Identify that the Root CA Certificate acts as the implicit root of trust configured in device trust stores.
Without a trusted Root CA certificate, network entities cannot complete TLS handshakes because certificate signature chains cannot be validated.
3
Evaluate the X.509 extension Subject Alternative Name (SAN).
Identify that SAN extends the certificate capability to cover multiple IP addresses or hostnames beyond the primary Common Name (CN).
Modern enterprise applications like Cisco ISE require SAN entries for dual-node deployment FQDNs and management IP addresses.
4
Evaluate certificate validation using Online Certificate Status Protocol (OCSP).
Identify that OCSP sends specific certificate status queries to an online responder rather than downloading complete Certificate Revocation Lists (CRLs).
OCSP avoids the bandwidth overhead associated with parsing large, periodically published CRL files.

Key Concept

Public Key Infrastructure (PKI) components and certificate validation mechanisms in network access control
Rate this question

Topics

Password Security Policies, MFA, and Certificates

More questions from this topic