Which commands on the core switch generate a certificate signing request (CSR) to obtain a corporate CA–signed certificate for HTTPS access?

The correct answer defines a trustpoint, specifies terminal enrollment, and then initiates the enrollment process to generate the CSR. The crypto pki trustpoint Core-Switch command creates a trustpoint named "Core-Switch" to associate with the certificate. enrollment terminal configures the trustpoint to display the CSR on the console for manual submission to the CA. Finally, crypto pki enroll Core-Switch triggers the actual generation of the CSR based on the defined trustpoint. The other options are incorrect because they either reverse the order of enrollment and trustpoint definition, or they incorrectly use ip http secure-trustpoint in place of crypto pki enroll for CSR generation. ip http secure-trustpoint is used to bind the trustpoint to the HTTPs service after the certificate has been obtained and installed, not to generate the CSR itself.