When IPSec uses certificate authentication, it is necessary to verify the legitimacy of the peer certificate. Which of the following is not a factor that needs to be considered to verify the…

Question

Options

• AWhether the certificate is applied for in the same way
• BWhether the certificate is within the validity period
• CWhether the certificate is located in the CRL repository
• DWhether the certificate is issued by the same CA

• A
  4% (1)
• B
  16% (4)
• C
  4% (1)
• D
  76% (19)

Explanation

Option D is correct because IPSec certificate verification requires only that a peer's certificate be issued by a trusted CA - not necessarily the same CA as your own. Two peers can hold certificates from different CAs as long as both CAs are mutually trusted; enforcing the same CA would unnecessarily restrict valid PKI deployments.

Why the other options are wrong (i.e., they ARE required checks):

• A - The certificate's application method/purpose matters because a certificate issued for one use (e.g., email signing) should not be accepted for IPSec authentication; its intended usage must match.
• B - Validity period is a fundamental check; an expired certificate is no longer trustworthy regardless of its other attributes.
• C - Checking the CRL (Certificate Revocation List) confirms the certificate hasn't been revoked before its expiration date, which is essential for detecting compromised credentials.

Memory tip: Think of it this way - you verify what the certificate is (validity, purpose, revocation status), not who else holds a certificate from the same issuer. A police officer from a different city is still valid authority; they just need to be from a recognized department, not the same department as yours.

No community discussion yet for this question.