050-V66-SERCMS02 · Question #60
Which statements concerning the RSA Certificate Manager's CMP Server are correct? (Choose two)
The correct answer is B. CMP is an alternative to Web-based enrollement D. KeyIDs and shared secrets are used to authenticate a certificate request. See the full explanation below for the reasoning.
Question
Which statements concerning the RSA Certificate Manager's CMP Server are correct? (Choose two)
Options
- AThe CMP Server accepts requests on port 80
- BCMP is an alternative to Web-based enrollement
- CThe CMP protocol does not support key recovery
- DKeyIDs and shared secrets are used to authenticate a certificate request
- ECMP requests cannot interface with RSA OneStep for auto-enrollement
How the community answered
(22 responses)- A14% (3)
- B73% (16)
- C5% (1)
- E9% (2)
Community Discussion
9
Brenda K.Feb 23, 2026B and D, lock them in and move on, this one is a fast 60-second grab. CMP is a protocol-based alternative to web enrollment for certificate requests, and it authenticates those requests using KeyIDs paired with shared secrets, not passwords or certs, which is the whole point of the pre-shared authentication model RSA uses here.
Wesley A.Feb 26, 2026CMP does use that shared secret model, but worth noting the KeyID here just identifies which secret to use, it is not itself a credential, so if anyone mixed that up on the first attempt like I did they probably lost points on a follow-up question that hinged on that distinction.
Dervla O.Mar 26, 2026B and D hold up, CMP authenticates via KeyIDs and shared secrets, not web forms.
Mateus R.Mar 27, 2026Right, and it helps to picture that shared secret as the temporary PIN a bank teller scribbles on a sticky note for your first login, good for just long enough to prove your identity before the issued certificate takes over as your permanent credential.
Mateus R.Mar 3, 2026B and D are spot on. Think of CMP like a back-door service entrance to the certificate shop, used when the front-door web browser entrance is not an option, which is why B is correct. And since a brand-new enrollee has no certificate yet to prove who they are, the system falls back to a shared secret plus a KeyID, kind of like showing a membership code at the door before you have your actual badge, which is exactly what D describes.
Prof. SaraMar 4, 2026Solid analogy on both counts, though worth clarifying that the KeyID in the initial enrollment exchange does not authenticate the requester itself, it only tells the CA which shared secret to look up, so the actual authentication burden still falls entirely on that one-time secret.
Wesley A.Mar 15, 2026So CMP authenticates requests with KeyIDs and shared secrets instead of passwords, right?
Prof. SaraMar 13, 2026I keep landing on C because CMP was designed purely as an enrollment and certificate lifecycle protocol, and the spec never incorporated a key recovery mechanism, so that operational gap is a real architectural fact you have to know cold for this exam. If you look at how the RSA CM CMP Server actually handles requests, key recovery always routes through a separate channel, which confirms the protocol itself does not support it natively.
Brenda K.Mar 15, 2026Prof. Sara, the question is asking which two capabilities CMP does natively support, not what it lacks. CMP handles both certificate enrollment (B) and certificate revocation (D) as core protocol operations defined in the spec.