156-215.80 · Question #225
You want to establish a VPN, using certificates. Your VPN will exchange certificates with an external partner. Which of the following activities sh you do first?
The correct answer is B. Exchange exported CA keys and use them to create a new server object to represent your. When establishing a certificate-based VPN with an external partner, the foundational first step is to exchange CA key material and use it to define a trusted server object representing the partner.
Question
You want to establish a VPN, using certificates. Your VPN will exchange certificates with an external partner. Which of the following activities sh you do first?
Options
- ACreate a new logical-server object to represent your partner's CA
- BExchange exported CA keys and use them to create a new server object to represent your
- CManually import your partner's Certificate Revocation List.
- DManually import your partner's Access Control List.
How the community answered
(57 responses)- A9% (5)
- B70% (40)
- C5% (3)
- D16% (9)
Why each option
When establishing a certificate-based VPN with an external partner, the foundational first step is to exchange CA key material and use it to define a trusted server object representing the partner.
You cannot meaningfully create a logical server object for the partner's CA before you have received and imported the actual CA key material from your partner.
Exchanging exported CA (Certificate Authority) keys with your partner and importing them is the required first step in certificate-based VPN setup, because without establishing mutual CA trust neither side can validate the certificates presented during IKE negotiation. Using the imported CA data to create a server object in your management system formally represents the partner as a trusted entity. All subsequent VPN configuration steps depend on this trust anchor being in place.
Importing a Certificate Revocation List (CRL) is a downstream step that is only relevant after mutual CA trust has already been established by exchanging certificates.
An Access Control List (ACL) is a network access control mechanism unrelated to certificate trust establishment and is not part of the VPN certificate exchange process.
Concept tested: Certificate-based VPN setup with external CA trust
Source: https://sc1.checkpoint.com/documents/R80/CP_R80_VPN_AdminGuide/html_frameset.htm
Topics
Community Discussion
No community discussion yet for this question.