Examkin

Question

Difficulty: MediumPassword Security Policies, MFA, and Certificates

A network security engineer is configuring digital certificate enrollment on a Cisco IOS router to establish secure IPsec VPN tunnels. Before submitting a Certificate Signing Request (CSR) to an enterprise Certificate Authority (CA), which item must be generated directly on the local router?

  1. An asymmetric public and private key pairAnswer
  2. B
    The Certificate Revocation List (CRL)
  3. C
    The Root CA public certificate
  4. D
    The signature hash of the CA server

Answer

An asymmetric public and private key pair must be generated on the local router prior to creating and submitting the Certificate Signing Request (CSR).
In Public Key Infrastructure (PKI) enrollment, an endpoint must generate its own asymmetric public/private key pair locally. The private key is securely stored in local memory/NVRAM and never transmitted, while the public key is packaged into the Certificate Signing Request (CSR) sent to the Certificate Authority (CA) for signing.

Step-by-Step Solution

1
Identify the initial step in the Public Key Infrastructure (PKI) enrollment workflow on a Cisco device.
The router must generate an RSA or ECDSA asymmetric key pair locally.
The private key must never leave the local device to maintain security integrity.
2
Construct the Certificate Signing Request (CSR).
The router embeds its newly generated public key and identity information (Subject Name/SAN) into the CSR structure.
The CA requires the public key to embed it into the signed X.509 identity certificate.
3
Submit the CSR to the Certificate Authority (CA).
The CA validates identity details and issues the final signed identity certificate back to the router.
The CA signs the public key and identity data using its own private key to establish trust.

Key Concept

PKI Certificate Signing Request (CSR) and Local Key Pair Generation
Rate this question

Topics

Password Security Policies, MFA, and Certificates

More questions from this topic