nerdexam
Cisco

300-445 · Question #42

Refer to the exhibit. An engineer configures an HTTP server test to an internally hosted website. An 'SSL self-signed certificate' is in the test results. What must be configured for the test to work?

The correct answer is D. Install the certificate chain on the agent. Installing the certificate chain on the agent (D) is correct because the monitoring agent performing the HTTP test doesn't inherently trust self-signed certificates - they aren't issued by a recognized CA, so the agent flags the test as having an SSL error. Adding the…

Data Collection Implementation

Question

Refer to the exhibit. An engineer configures an HTTP server test to an internally hosted website. An 'SSL self-signed certificate' is in the test results. What must be configured for the test to work?

Options

  • AEnable Client Certificate.
  • BValidate the Agent Proxy configuration.
  • CChange the SSL Version configuration.
  • DInstall the certificate chain on the agent.

How the community answered

(36 responses)
  • A
    3% (1)
  • B
    8% (3)
  • C
    17% (6)
  • D
    72% (26)

Explanation

Installing the certificate chain on the agent (D) is correct because the monitoring agent performing the HTTP test doesn't inherently trust self-signed certificates - they aren't issued by a recognized CA, so the agent flags the test as having an SSL error. Adding the certificate chain directly to the agent's trusted store allows it to validate the server's certificate and complete the test successfully.

Why the others are wrong:

  • (A) Enable Client Certificate - Client certificates are used for mutual TLS, where the client authenticates itself to the server. The problem here is the agent not trusting the server's certificate, which is a different issue entirely.
  • (B) Validate Agent Proxy - Proxy misconfiguration causes connectivity failures, not SSL trust errors. A self-signed cert warning is a PKI trust problem, not a routing problem.
  • (C) Change SSL Version - SSL/TLS version governs the protocol used (e.g., TLS 1.2 vs 1.3), not whether the certificate is trusted. Changing the version won't resolve a trust chain error.

Memory tip: "Self-signed = no trusted CA." The fix always lives where the verifier (the agent) checks trust - so you must install the cert on the agent, not reconfigure the connection method.

Topics

#SSL/TLS Certificate Validation#Self-Signed Certificates#Agent Configuration#HTTP Testing

Community Discussion

No community discussion yet for this question.

Full 300-445 Practice