XK0-006 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes

  Why this is correct

  Combines key generation and self-signing in a single invocation: -newkey rsa:2048 creates the 2048-bit RSA private key, -x509 emits a self-signed certificate rather than a CSR, -days 365 sets validity, and -nodes omits key encryption.

• ✗

  openssl x509 -req -in req.pem -signkey key.pem -out cert.pem -days 365

  Why it's wrong here

  This signs an existing CSR, so it cannot create the private key and certificate in one step as required; it presumes key.pem and req.pem already exist. It is tempting because x509 -req is the standard way to sign a CSR with a self-signed key, which is correct when a CSR has already been generated separately.

• ✗

  openssl ca -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365

  Why it's wrong here

  The ca subcommand signs certificate requests against an existing CA database and configuration, so it cannot generate a fresh self-signed key pair in one step. It is tempting because ca does issue certificates, and it would be correct when signing a CSR with a pre-existing certificate authority rather than creating a standalone self-signed pair.

• ✗

  openssl genrsa -out key.pem 2048 && openssl req -new -x509 -key key.pem -out cert.pem -days 365

  Why it's wrong here

  This runs two separate commands chained together, so it does not create the key and certificate in one step as the question requires. It is tempting because the resulting key and certificate are technically valid, and it would be correct if the task allowed multiple sequential OpenSSL invocations.