Examkin

Soru

Zorluk: OrtaPassword Security Policies, MFA, and Certificates

A network security engineer is configuring digital certificate enrollment on a Cisco IOS router to establish secure IPsec VPN tunnels. Before submitting a Certificate Signing Request (CSR) to an enterprise Certificate Authority (CA), which item must be generated directly on the local router?

  1. An asymmetric public and private key pairCevap
  2. B
    The Certificate Revocation List (CRL)
  3. C
    The Root CA public certificate
  4. D
    The signature hash of the CA server

Cevap

An asymmetric public and private key pair must be generated on the local router prior to creating and submitting the Certificate Signing Request (CSR).
In Public Key Infrastructure (PKI) enrollment, an endpoint must generate its own asymmetric public/private key pair locally. The private key is securely stored in local memory/NVRAM and never transmitted, while the public key is packaged into the Certificate Signing Request (CSR) sent to the Certificate Authority (CA) for signing.

Adım Adım Çözüm

1
Identify the initial step in the Public Key Infrastructure (PKI) enrollment workflow on a Cisco device.
The router must generate an RSA or ECDSA asymmetric key pair locally.
The private key must never leave the local device to maintain security integrity.
2
Construct the Certificate Signing Request (CSR).
The router embeds its newly generated public key and identity information (Subject Name/SAN) into the CSR structure.
The CA requires the public key to embed it into the signed X.509 identity certificate.
3
Submit the CSR to the Certificate Authority (CA).
The CA validates identity details and issues the final signed identity certificate back to the router.
The CA signs the public key and identity data using its own private key to establish trust.

Anahtar Kavram

PKI Certificate Signing Request (CSR) and Local Key Pair Generation
Bu soruyu puanla

Konular

Password Security Policies, MFA, and Certificates

Bu konudan daha fazla soru