XK0-006 Security Practice Question
A technician needs to create a self-signed certificate and private key for a web server. Which OpenSSL command should be used?
⚠ Common exam trap
Test-takers frequently confuse the `req -new` command (which creates a CSR) with the `req -x509` command (which creates a self-signed certificate), leading them to choose Option A, which only produces a CSR, not a usable certificate for a web server.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes
The `openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes` command generates a new RSA 2048-bit private key and immediately creates a self-signed X.509 certificate in a single step. The `-x509` flag tells OpenSSL to output a self-signed certificate instead of a certificate signing request (CSR), and `-nodes` ensures the private key is not encrypted with a passphrase, which is typical for a web server that must start without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
openssl genrsa -out key.pem 2048 && openssl req -new -key key.pem -out cert.pem
Why it's wrong here
This generates a CSR, not a self-signed certificate.
- ✗
openssl x509 -req -in req.pem -signkey key.pem -out cert.pem
Why it's wrong here
This signs a CSR with a private key, but does not generate a key.
- ✓
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes
Why this is correct
This command creates a self-signed certificate valid for 365 days.
- ✗
openssl ca -in req.pem -out cert.pem
Why it's wrong here
This requires a CA setup, not self-signed.
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
One of 979 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.