156-215.81 · Question #682
What is required for a certificate-based VPN tunnel between two gateways with separate management systems?
The correct answer is D. Mutually Trusted Certificate Authorities. This answer is correct because for a certificate-based VPN tunnel, both gateways need to have a certificate issued by a certificate authority (CA) that they trust. A CA is a trusted entity that verifies the identity of the gateways and signs their certificates. The gateways can…
Question
What is required for a certificate-based VPN tunnel between two gateways with separate management systems?
Options
- AShared Secret Passwords
- BUnique Passwords
- CShared User Certificates
- DMutually Trusted Certificate Authorities
How the community answered
(48 responses)- A4% (2)
- B8% (4)
- C15% (7)
- D73% (35)
Explanation
This answer is correct because for a certificate-based VPN tunnel, both gateways need to have a certificate issued by a certificate authority (CA) that they trust. A CA is a trusted entity that verifies the identity of the gateways and signs their certificates. The gateways can either use the same CA or different CAs, as long as they trust each other's CA. This way, the gateways can authenticate each other using their certificates and establish a secure VPN tunnel. The other answers are not correct because they are either irrelevant or incompatible with certificate- based VPN tunnel. Shared secret passwords and unique passwords are used for pre-shared key (PSK) authentication, which is a different method than certificate authentication. PSK authentication is less secure and more vulnerable to brute force attacks than certificate authentication. Shared user certificates are not used for gateway authentication, but for user authentication, which is a different level of authentication than gateway authentication. User authentication is optional and can be used in addition to gateway authentication to provide more granular access control.
Topics
Community Discussion
4
Orla P.Jun 27, 2026D is your answer here. When the two gateways are managed separately, neither side shares a common internal CA, so each gateway has to trust a certificate authority that the other side also trusts, which is exactly what mutually trusted CAs give you, a common anchor of trust that lets each gateway validate the other's certificate without any shared secret or unified management.
Eitan E.Jun 19, 2026D is the only one that works here, and the reason is simple: two gateways under different management domains have no shared IKE database to exchange identities through, so each gateway must be able to independently validate the other's certificate against a CA it already trusts, which means both sides need to anchor their trust to the same CA or to cross-certified CAs. I remember sitting in Prometric with this exact question and almost second-guessing myself toward C until I recalled the courseware phrase "mutually trusted CA hierarchy," which snapped me back, because shared user certs solve nothing if neither gateway trusts the issuer on the other side.
Bahar F.Jun 22, 2026Right, and worth adding for anyone running cross-domain CloudGuard deployments under Maestro, the Security Management Object on each side has to have that trusted CA explicitly imported into its certificate store, because a perfectly valid peer cert is still going to fail phase 1 if the SMO cannot trace the chain to a recognized root during CRL or OCSP validation.
Bahar F.Jun 27, 2026The question is straightforward but option C is the real trap because "shared user certificates" sounds plausible if you are thinking about site-to-site IKE identity, yet what actually matters is not sharing a certificate but sharing trust in the CA that signed each gateway's certificate. When the two management domains each have their own CA, you cross-import the root CAs so each side can validate the other's gateway certificate, which is exactly what D describes.