CAS-003 · Question #638
An enterprise is configuring an SSL client-based VPN for certificate authentication. The trusted root certificate from the CA is imported into the firewall, and the VPN configuration in the firewall…
The correct answer is A. In the firewall, compatible cipher suites must be enabled. During a TLS/SSL handshake, the client and server negotiate a mutually supported cipher suite. If the firewall has no compatible cipher suites enabled that match what the VPN clients offer, the handshake fails after a brief negotiation attempt-which explains the 'brief period'…
Question
An enterprise is configuring an SSL client-based VPN for certificate authentication. The trusted root certificate from the CA is imported into the firewall, and the VPN configuration in the firewall is configured for certificate authentication. Signed certificates from the trusted CA are distributed to user devices. The CA certificate is set as trusted on the end-user devices, and the VPN client is configured on the end-user devices. When the end users attempt to connect however, the firewall rejects the connection after a brief period. Which of the following is the MOST likely reason the firewall rejects the connection?
Options
- AIn the firewall, compatible cipher suites must be enabled
- BIn the VPN client, the CA CRL address needs to be specified manually
- CIn the router, IPSec traffic needs to be allowed in bridged mode
- DIn the CA. the SAN field must be set for the root CA certificate and then reissued
How the community answered
(30 responses)- A57% (17)
- B23% (7)
- C13% (4)
- D7% (2)
Explanation
During a TLS/SSL handshake, the client and server negotiate a mutually supported cipher suite. If the firewall has no compatible cipher suites enabled that match what the VPN clients offer, the handshake fails after a brief negotiation attempt-which explains the 'brief period' before rejection. Answer B (CRL address in VPN client) would cause certificate revocation validation failures, typically presenting as a certificate error rather than a timeout-style rejection. Answer C (IPSec in bridged mode) is irrelevant to an SSL/TLS-based VPN. Answer D (SAN field on the root CA certificate) is incorrect because SAN fields are required on end-entity (leaf) certificates, not root CA certificates, and a missing SAN would produce a certificate validation error, not a post-brief-period rejection.
Topics
Community Discussion
No community discussion yet for this question.