050-V66-SERCMS02 · Question #10
Which of the following components are required when implementing RSA OneStep? (Choose three)
The correct answer is A. httpd.conf file C. OneStep CGI program E. OneStep HTML files (such as the such as the error HTML template file). See the full explanation below for the reasoning.
Question
Which of the following components are required when implementing RSA OneStep? (Choose three)
Options
- Ahttpd.conf file
- Bxudad.conf file
- COneStep CGI program
- Dcertificate file (cert0.crt)
- EOneStep HTML files (such as the such as the error HTML template file)
How the community answered
(50 responses)- A82% (41)
- B6% (3)
- D12% (6)
Community Discussion
9
Prof. SaraJan 29, 2026The correct answers are A, C, and E. Think of RSA OneStep as a three-legged stool: the httpd.conf file tells Apache how to load and protect resources using the OneStep module, the OneStep CGI program is the actual authentication engine that processes credentials and communicates with RSA Authentication Manager, and the HTML template files (error pages, login prompts) are the user-facing layer that makes the flow functional for real users. Pull out any one of those legs and the whole implementation collapses. Option B (xudad.conf) is pure noise, a fabricated filename not found anywhere in RSA OneStep documentation, and exam writers love slipping in plausible-sounding config files to catch candidates who are memorizing names rather than understanding architecture. Option D (cert0.crt) trips up students who conflate TLS certificate requirements with OneStep-specific deployment requirements. A certificate may exist in your broader environment, but it is not a required OneStep component on the exam blueprint. The mnemonic that locks this in is H-C-H: Httpd config, CGI engine, HTML templates. Those are your three pillars every time this question surfaces, regardless of how the stem is worded.
Dervla O.Feb 8, 2026B sounds official but is a trap, and D is auth not setup, go A, C, E.
Mateus R.Feb 9, 2026Solid call, and the reason D fools people is the same reason you would not call your landlord to flip your own breaker, authorization and initial provisioning sit next to each other on the diagram but they absolutely do not share a front door.
Wesley A.Feb 4, 2026I initially had B in my pick because xudad.conf sounded like it could be a daemon config that ties the whole RSA flow together, and I wasted time on that on my first attempt. What brought me back to reality was thinking about what the OneStep deployment actually needs to function end to end: Apache has to know where to route the request (httpd.conf), something has to process the authentication transaction server-side (the CGI program), and the user needs pages to land on when things go wrong or need input (the HTML template files). The certificate file in D is a distractor because RSA OneStep handles its own session tokens differently from SSL cert auth, so cert0.crt is not a required component of the OneStep setup itself. Lock in A, C, E and do not let the xudad.conf option trick you the way it tricked me.
Dervla O.Feb 5, 2026The end-to-end function test you described is the right instinct, and it is worth naming it explicitly as a habit: when a stem lists components, ask what breaks if you remove each one, and anything that survives removal is a distractor.
Brenda K.Jan 10, 2026The cert file in D is a classic trap because any SSL setup needs one somewhere, so test-takers assume it lands here, but RSA OneStep specifically requires you to configure the httpd.conf file, deploy the CGI program, and have the HTML template files in place, not a cert file as a named component of OneStep itself. Flag B if you need to, but A, C, E is your answer and you should know it in under 30 seconds if you drilled the OneStep architecture.
Wesley A.Jan 13, 2026The cert file trap is even sneakier because it sounds like it belongs with the CGI setup, so drilling the three-layer architecture, httpd.conf plus CGI program plus HTML templates, is what gets you past the decoy fast.
Mateus R.Jan 15, 2026No cert file, no trust handshake. cert0.crt has to be there.
Prof. SaraJan 16, 2026Mateus, that reasoning applies if the scenario requires mutual TLS, but the question specifies one-way authentication, so the server certificate is validated by the client without the client presenting cert0.crt, which is why A, C, and E cover the correct conditions for that handshake to succeed. The cert file becomes mandatory only when the configuration explicitly enforces client certificate authentication on the server side.