Câu 69: 400-251: CCIE Security Written Exam

Which three statements about PKI on Cisco IOS Software are true? (Choose three.)

1. A. The match certificate and allow expired-certificate commands are ignored unless the router clock is set.
2. B. OCSP enables a PKI to use a CRL without time limitations.
3. C. Different OCSP servers can be configured for different groups of client certificates. — đáp án hiện tại
4. D. OCSPis well-suited for enterprise PKIs in which CRLs expire frequently. — đáp án hiện tại
5. E. Certificate-based ACLs can be configured to allow expired certificates if the peer is otherwise valid. — đáp án hiện tại
6. F. If a certificate-based ACL specifies more than one field, any one successful field-to-value test is treated as a match.