Examkin

Question

Difficulty: HardPassword Security Policies, MFA, and Certificates

A network security administrator configures mutual certificate-based authentication (EAP-TLS) for remote access VPN endpoints. During initial validation testing, client endpoints successfully verify the identity of the VPN gateway. However, the VPN gateway fails to authenticate the client certificates. Detailed inspection reveals that the gateway is configured for mandatory certificate status checking using the Online Certificate Status Protocol (OCSP), but outbound HTTP requests sent to the Uniform Resource Identifier (URI) listed in the Authority Information Access (AIA) extension are being dropped by a perimeter security policy. Which statement correctly identifies the cause of the failure and the necessary resolution?

  1. The gateway is unable to verify client certificate revocation status because egress filtering blocks OCSP traffic on port 80; allowing outbound HTTP to the OCSP responder resolves the authentication failure.Answer
  2. B
    The EAP-TLS negotiation fails because RADIUS payload encryption requires TACACS+ protocol fallback to securely transmit the OCSP revocation query.
  3. C
    The security gateway fails to process the client's Certificate Signing Request (CSR) payload because an implicit deny clause on the ingress interface blocks incoming EAP-TLS handshakes.
  4. D
    The client certificate status check fails because the administrator neglected to execute the copy running-config startup-config command after generating the client RSA keys.

Answer

The gateway is unable to verify client certificate revocation status because egress filtering blocks OCSP traffic on port 80; allowing outbound HTTP to the OCSP responder resolves the authentication failure.
The correct answer identifies that OCSP queries rely on HTTP (TCP port 80) to reach the responder address indicated in the client certificate's AIA extension. When an egress firewall drops outbound HTTP connections to that IP/domain, the security gateway cannot verify whether the client certificate has been revoked, causing the authentication process to fail under strict revocation policy settings.

Step-by-Step Solution

1
Analyze the certificate revocation checking mechanism
OCSP is used for real-time certificate status queries sent to the responder URI specified in the certificate's AIA extension.
When strict revocation checking is enabled, failing to contact the OCSP responder causes the validating party to treat the certificate as untrusted/unverified.
2
Identify the transport protocol used by OCSP
OCSP requests and responses travel over standard HTTP (TCP port 80).
If an egress security policy or ACL blocks outbound HTTP requests to the target OCSP server, status checks fail.
3
Determine the necessary remediation step
Permit outbound TCP port 80 traffic destined for the OCSP responder address.
Restoring reachability allows the gateway to receive valid OCSP responses and complete EAP-TLS client authentication.

Key Concept

Digital Certificates and Revocation Checking (OCSP vs CRL)
Rate this question

Topics

Password Security Policies, MFA, and Certificates

More questions from this topic