Question 1

Hash values are used to sign the CA certificate and certificates issued by the CA,as well as to verify that the original data hasn't been changed.

Accepted Answer

Hash values are commonly used for digital signatures and for verifying data integrity. Signing the CA certificate and certificates issued by the CA with hash values provides added security and authenticity to the certificates. Verifying the original data hasn't been changed is another important use case for hash values.

Question 2

Which of the four CA roles can approve requests for certificate enrollment and revocation?
A)CA Administrator
B)Certificate Manager
C)Backup Operator
D)Auditor

Accepted Answer

B

Question 3

CA Autoenrollment can only be enabled on enterprise CAs.

Accepted Answer

CA autoenrollment is a feature that can only be enabled on enterprise CAs. Standalone CAs do not support this feature.

Question 4

What answer below is the term used to describe a list of certificates revoked since the last base,or complete,CRL was published?
A)Delta CRL
B)Certificate revocation list
C)Incremental CRL
D)Partial CRL

Accepted Answer

Delta CRL is the correct term used to describe a list of certificates that have been revoked since the last base, or complete, Certificate Revocation List (CRL) was published. It provides updates to the base CRL, allowing for more efficient distribution and checking of revoked certificates.

Question 5

If a certificate isn't configured for autoenrollment,a user may be able to request the certificate by using the Certificates snap-in,so long as they are accessing a standalone CA.

Accepted Answer

The answer of If a certificate isn't configured for autoenrollment,a...

Question 6

Which description best fits the CA Administrator role?
A)Approves requests for certificate enrollment and revocation
B)Manages auditing logs
C)Configures and maintains CA servers,and can assign all other CA roles and renew the CA certificate
D)Able to back up and restore files and directories

Accepted Answer

The CA Administrator role is responsible for configuring and maintaining CA servers, assigning all other CA roles, and renewing the CA certificate.

Option A refers to the Certificate Manager role, which involves approving requests for certificate enrollment and revocation.

Option B refers to the Auditor role, which involves managing auditing logs.

Option D refers to the Backup Operator role, which involves backing up and restoring files and directories.

Question 7

If a smart card no longer has any space to contain a new key,what can you enable to prevent a renewal failure?
A)"Clear previous smart card keys" option
B)"Reserve space on smart card for new keys" option
C)"Disable automatic smart card renewal unless adequate space is available for a new key" option
D)"For automatic renewal of smart card certificates,use the existing key if a new key cannot be created" option

Accepted Answer

Option D, "For automatic renewal of smart card certificates, use the existing key if a new key cannot be created," allows the smart card to continue functioning by reusing the existing key for renewal, thus preventing a failure due to lack of space for a new key.

Question 8

Select the answer below that is not a service a public key infrastructure provides to a network:
A)Confidentiality
B)Integrity
C)Nonrepudiation
D)Secure tunneling

Accepted Answer

Secure tunneling is not typically a service provided by a public key infrastructure. PKI services typically focus on securing data through encryption, ensuring message integrity, and providing nonrepudiation. Secure tunneling is typically provided by other security technologies such as virtual private networks (VPNs).

Question 9

If a certificate has a validity period of 1 year and a renewal period of 1 month,when must a certificate that was issued on December 12th,2009 be renewed?
A)Once every month throughout the validity period
B)Between November 12,2010 and December 12,2010
C)Between December 12,2010 and January 12,2011
D)Between December 12,2010 and January 11

Accepted Answer

The renewal period starts one month before the certificate's expiration date. Since the certificate was issued on December 12, 2009, and has a validity period of 1 year, it expires on December 12, 2010. Therefore, the renewal period is between November 12, 2010, and December 12, 2010.

Question 10

The Network Device Enrollment Service (NDES)allows network devices,such as routers and switches,to obtain certificates by using a special Cisco proprietary protocol known as...
A)Simple Certificate Enrollment Protocol (SCEP)
B)Special Device Certificate Protocol (SDCP)
C)Secured Network Device Protocol (SNDP)
D)Special Certificate Enrollment Protocol (SCEP)

Accepted Answer

The correct protocol used by NDES to enable network devices such as routers and switches to obtain certificates is the Simple Certificate Enrollment Protocol (SCEP). This protocol was developed by Cisco and enables devices running Cisco IOS software to obtain digital certificates from a Certificate Authority (CA). Thus, option A is the correct choice. The other options, namely SDCP, SNDP, and Special Certificate Enrollment Protocol (SCEP), are not valid protocols used by NDES.

Question 11

What component of a PKI is held by a person or system and is unknown to anyone else?
A)Public key
B)Ciphertext
C)Secret key
D)Private key

Accepted Answer

The private key is held by a person or system and is used to decrypt messages that have been encrypted with the corresponding public key. It is unknown to anyone else and is used to prove one's identity during digital transactions.

Question 12

Windows Server 2008 supports three versions of certificate templates.What version or versions of templates can be issued only from Windows Server 2008 enterprise CAs and can only be used on Windows Server 2008 and Vista clients?
A)Version 1
B)Version 2
C)Version 3
D)All of the above

Accepted Answer

Version 3 certificate templates can only be issued from Windows Server 2008 Enterprise Certification Authorities (CAs) and are designed to be utilized by Windows Server 2008 and Windows Vista clients.

Question 13

When using HTTPS,after the web client finds that a CA is trusted and the signature on a certificate is verified,the web client sends additional parameters to the server that are encrypted with the server's....
A)Private key
B)Public key
C)Secret key
D)Ciphertext

Accepted Answer

The web client encrypts additional parameters with the server's public key, ensuring that only the server, which holds the corresponding private key, can decrypt and access the information. This is a fundamental aspect of the HTTPS protocol, leveraging asymmetric encryption for secure communication.

Question 14

What snap-in under Server manager will provide a wizard-based backup utility that will allow you to backup the CA's certificate and private key,as well as the certificates issued by the CA?
A)Active Directory Certificate Backup Utility
B)Active Directory CA Backup and Restore
C)Active Directory Certificate Services
D)Active Directory Certificate Backup and Restore

Accepted Answer

Active Directory Certificate Services (AD CS) provides a framework for creating and managing certificates, including the functionality to back up and restore a CA's certificate and private key, as well as the certificates issued by the CA. This is part of the management tools in the Server Manager for handling certificate services.

Question 15

Which of the following is not true in relation to enterprise CAs?
A)Must operate online
B)Certificates published in Active Directory
C)No certificate templates available
D)CA's certificate distributed to clients automatically

Accepted Answer

This statement is not true as enterprise CAs do have certificate templates available to issue certificates.

Question 16

A user's employment was recently terminated due to suspicions of corporate espionage.As part of a security audit,you have been assigned to investigate any files related to the user that was terminated.Unfortunately,due to unknown circumstances,the user's profile was lost.However,you have found several files believed to have been created by the user,that have been encrypted via EFS.Because your environment runs on Windows Server 2008 Enterprise edition,you are counting upon automatic key archival to gain access to the encrypted files.
Once the certificate manager locates the key in the CA database,what kind of user must be contacted in order to decrypt the key?
A)A data recovery agent
B)A key recovery agent responsible for the key
C)An administrator with permissions to the encrypted file that is also a member of the Data Recovery Operators group
D)No user can accomplish this task;Microsoft support must be contacted and the key sent to a designated Microsoft Special Situations Auditor (MSSA)for decryption

Accepted Answer

In order to decrypt the key, a key recovery agent responsible for the key must be contacted. This agent is responsible for managing the recovery of keys when necessary, and should have access to the necessary tools to decrypt the encrypted files. A data recovery agent is responsible for recovering lost data and would not necessarily have the ability to decrypt the key. An administrator with permissions to the encrypted file that is also a member of the Data Recovery Operators group may have some increased privileges, but a key recovery agent is still required for decryption. Contacting Microsoft support and sending the key to a designated MSSA is not necessary in this situation, as the key should be able to be recovered through the use of a key recovery agent.

Question 17

If setting up a standalone certificate authority,Active Directory is required.

Accepted Answer

Active Directory is not required for setting up a standalone certificate authority. However, it can be used for integrating the certificate authority with an existing Active Directory infrastructure.

Question 18

Which of the following answers is not an element contained in a certificate practice statement?
A)Identification of the CA
B)Types of certificates used
C)Configuration of Active Directory information
D)Certificate lifetimes

Accepted Answer

Configuration of Active Directory information is not typically included in a certificate practice statement. The other options, such as identification of the CA, types of certificates used, and certificate lifetimes, are commonly found in a certificate practice statement.

Question 19

What must be done to allow a user to be able to access a file encrypted with EFS over a network connection?
A)Certificate autoenrollment must be configured
B)The user must be given the correct permissions
C)The user's SID must be exported to the remote machine
D)This can not be accomplished

Accepted Answer

The answer of What must be done to allow a...

Question 20

Before you can restore a CA database from a backup,the CA service must be stopped.

Accepted Answer

This is true because if the CA service is running while restoring the database from a backup, it could cause conflicts and potentially corrupt the restored data. Therefore, it is recommended to stop the CA service before restoring a CA database from a backup.

Quiz 11: Active Directory Certificate Services

Hash values are used to sign the CA certificate and certificates issued by the CA,as well as to verify that the original data hasn't been changed.

Which of the four CA roles can approve requests for certificate enrollment and revocation?

CA Autoenrollment can only be enabled on enterprise CAs.

What answer below is the term used to describe a list of certificates revoked since the last base,or complete,CRL was published?

If a certificate isn't configured for autoenrollment,a user may be able to request the certificate by using the Certificates snap-in,so long as they are accessing a standalone CA.

Which description best fits the CA Administrator role?

If a smart card no longer has any space to contain a new key,what can you enable to prevent a renewal failure?

Select the answer below that is not a service a public key infrastructure provides to a network:

If a certificate has a validity period of 1 year and a renewal period of 1 month,when must a certificate that was issued on December 12th,2009 be renewed?

The Network Device Enrollment Service (NDES) allows network devices,such as routers and switches,to obtain certificates by using a special Cisco proprietary protocol known as...

What component of a PKI is held by a person or system and is unknown to anyone else?

Windows Server 2008 supports three versions of certificate templates.What version or versions of templates can be issued only from Windows Server 2008 enterprise CAs and can only be used on Windows Server 2008 and Vista clients?

When using HTTPS,after the web client finds that a CA is trusted and the signature on a certificate is verified,the web client sends additional parameters to the server that are encrypted with the server's....

What snap-in under Server manager will provide a wizard-based backup utility that will allow you to backup the CA's certificate and private key,as well as the certificates issued by the CA?

Which of the following is not true in relation to enterprise CAs?

If setting up a standalone certificate authority,Active Directory is required.

Which of the following answers is not an element contained in a certificate practice statement?

What must be done to allow a user to be able to access a file encrypted with EFS over a network connection?

Before you can restore a CA database from a backup,the CA service must be stopped.