Exam 350-401 topic 1 question 394 discussion

love questions about topics not covered in blueprint and OCG. another answer to remebmer. thats why dumps are 100% justified. thank you examtopics.

1. generate an RSA key 2. Create a trust point. 3. Enter the command "Crypto PKI enroll"

C is correct

Can someone explain what's the point of using this command?

Core-Switch(config)# crypto pki trustpoint Core-Switch Core-Switch(ca-trustpoint)# enrollment terminal Core-Switch(config)# crypto pki enroll Core-Switch

Since the question asks about generating CSRs and not importing a signed cert, you can eliminate A, B, and D because those have commands to assign a valid certificate with key pair to HTTPS. Can't do that until you have the certificate signing complete.

definitely C https://www.cisco.com/c/en/us/td/docs/ios/ios_xe/sec_secure_connectivity/configuration/guide/convert/sec_pki_xe_3s_book/sec_cert_enroll_pki_xe.html

Tested in GNS3, C is correct. Last command of option C generates certificate, but last command of option D does not generate any certificate.

A. Core-Switch(config)#crypto pki enroll Core-Switch Core-Switch(config)#ip http secure-trustpoint Core-Switch B. Core-Switch(config)#ip http secure-trustpoint Core-Switch Core-Switch(config)#crypto pki enroll Core-Switch C. Core-Switch(config)#crypto pki trustpoint Core-Switch Core-Switch(ca-trustpoint)#enrollment terminal Core-Switch(config)#crypto pki enroll Core-Switch D. Core-Switch(config)#crypto pki trustpoint Core-Switch Core-Switch(ca-trustpoint)#enrollment terminal Core-Switch(config)#ip http secure-trustpoint Core-Switch

c seems to be the best

C folks

https://community.cisco.com/t5/vpn/certificate-signing-request-csr-guideline/td-p/2778928 1. generate an RSA key 2. Create a trust point. 3. Enter the command "Crypto PKI enroll"

Reference: https://www.cisco.com/c/en/us/td/docs/ios/ios_xe/sec_secure_connectivity/configuration/guide/convert/sec_pki_xe_3s_book/sec_cert_enroll_pki_xe.html