Ad Cs

Front 1

Certificate Authority Web Enrollment

Back 1

Users can request certificates via the Web using

Front 2

shared secret key

Back 2

One alternative to public key cyrptography is to us a

Front 3

certutil

Back 3

You can manage many facets of the AD Certificate Services server role from the command line by using the __________________ utility

Front 4

default administrator and administrator

Back 4

Configure certificate revocation by logging in to the CA as the

Front 5

autoenrollment

Back 5

PKI feature supported by Windows Server 2003 and later that allows users and computers to automatically enroll for certificates based on one or more certificate templates, as well as use Group Policy settings in Active Directory

Front 6

Revocation Configuration

Back 6

Each server that functions as a CA must be configured with a?

Front 7

Security Group Membership

Back 7

You can restrict enrollment agents so that they can only request certificates on behalf of specific users or computers based on:

Front 8

o Certification Authority (CA)
o Web enrollment
o Online responder
o Network Device Enrollment Service (NDES)

Back 8

The Windows Server 2008 Active Directory Certificate Services includes the following features:

Front 9

Online Responder

Back 9

is a service that responds to requests from clients concerning the revocation status of a particular certificate, returning a digitally signed response indicating the certificate’s current status.

Front 10

This tab of the Certificates Template > Manage box contains options that specify the amount of user input during certificate enrollment, including "Prompt the user during enrollment" that forces user to enter a PIN for the smart card.

Back 10

Request Handling tab

Front 11

The "Archive Subject's encryption private key" on the Request Handling tab does what?

Back 11

Allows AES

Front 12

"Authorize additional service accounts to access the private key" on the Requests Handling tab of Cert Templates > Manage box, does what?

Back 12

Allows a custom ACL to be specified on the private keys of computer certs.

Front 13

The Certificates Templates snap in can be accessed with what command?

Back 13

Certmpl.msc

Front 14

Auto-enroll is available in what version cert template?

Back 14

V2/3

Front 15

What are the minimum permissions are needed for Auto-enrollment?

Back 15

Read, Enroll, Autoenroll

Front 16

What server version is needed to issue v2/3 certificate templates?

Back 16

Enterprise

Front 17

What utility would a Key Recovery Agent use to recover a key?

Back 17

Certutil.exe

They need to know the 20 digit hex serial # of the archived key

Front 18

This new role service in 2008 allows users to autoenroll and obtain new or renewed certs across an internet connection.

Back 18

Certification Authority Web Enrollment

Front 19

This CS role allows network devices like routers to enroll for x.509 certs.

Back 19

NDES

Front 20

MSCEP is an alias of what?

Back 20

NDES.
Microsoft Simple Cert Enrollment Protocol is an alias of NDES

Front 21

What kind of server is needed for Autoenrollment?

Back 21

Server 2008 enterprise or Datacenter

Front 22

How would a user request a cert using the Cert Authority Web Enrollment service?

Back 22

Navigate to http://CA_servername/certsrv

Front 23

This device stores public and private keys and can be used in a domain or for remote access logins.

Back 23

Smart Card

Front 24

What utility would you use to setup a smart card?

Back 24

certmgr.msc

Front 25

This is a user that can grant permission to enroll certificates on behalf of other users.

Back 25

Enrollment agent

Front 26

If you want to limit the users that an enrollment agent enrolled, what must you do?

Back 26

You must use Security Groups, not containers in A.D.

Front 27

What is the alternate method to CRLs for revoking certs?

Back 27

OCSP.

Front 28

This is a list of certs that have been revoked since the last publication of a full CRL

Back 28

Delta CRL.

Note - They are published differentially. Each delta CRL includes ALL revoked certs since the last full CRL was published. Note, the interval for Delta CRLs 1 day, for CRLs 1 weeks

Front 29

This is the location on the network from which apps can locate the most recent base and delta CRLs to check for cert validity.

Back 29

The CRL Distribution Point (CDP)

Front 30

Which tab of the CA's properties box allows you to add, remove or modify the CDP?

Back 30

Extensions tab

Front 31

2008 provides what that is used to generate certificates used by computers configured as Online Responders?

Back 31

OCSP Response Signing Certificate

Front 32

A revocation configuration includes what 3 things?

Back 32

CA certificate
Signing certificate
source of the revocation information

Front 33

This is an extension that can be applied to certificates issued by the CA that points to the URLs where you can retrieve the issuing CA's cert.

Back 33

Authority Information Access (AIA)

Front 34

For the OR to work properly, you must include the ____ for the online responder in the IA extension of certificates issued by the CA

Back 34

URL

Front 35

If you're a user requesting a user cert by means of web-based cert enrollment and want to use a 4096 bit key size, what do you need to choose from the web page?

Back 35

Advanced Certificate Request.
Select Create and submit a request to this CA, select Create new key set option
Choose 4096

Front 36

Would you edit the Enrollment tab or Security tab of the certificate server's Properties box to define a restricted user policy?

Back 36

In the Enrollment Agents tab of the cert server's Properties box, remove the Everyone group.
Then ad the user/group.

Front 37

If you want to enable smart cards in your network, what is the easiest way to do this?

Back 37

Use Group Policy. GP allows you to use smart cards by enabling "interactive logon: Require Smart Card" policy setting.

Note: You could manually choose "Smart card is required for interactive logon"

Front 38

To support an Online Responder what 2 things must you do?

Back 38

Enable the use of the OCSP Response Signing Certificate template.
Choose a URL for the online responder and select "include in the AIA extension of issued certs" and "Include in the OCSP extension"

Front 39

What major benefit does the Online Responder have?

Back 39

The requesting system doesn't need to obtain a full CRL and can submit validation requests for specific certificates.
Remember, OR's are an alternative to CRLs

Front 40

Low level devices like routers can participate in a PKI using what protocol?

Back 40

Simple Certificate Enrollment Protocol (SCEP).
Allows devices without AD accounts.

Front 41

What are the 3 new features for AD CS in 2008 R2?

Back 41

*Cert Enrollment and Cert Enrollment Policy Web Services
*Cert enrollment across forests
*Better support for high-volume CAs

Front 42

What are the requirements for AD CS Web services?

Back 42

Forest Func level of 2008 R2
Enterprise CA running 2008 R2, 2008 or 2003
Win 7 clients

x

Front 43

What are the requirements for Cross-forest enrollment?

Back 43

Two way trust relationship
Forest Func level of 2003 for ISSUING certs
Forest Func level of 2008 R2 for enrollment

Front 44

What is non-persistent certificate processing?

Back 44

When a server does not store the request record or the issued certificates.

Note that servers store both by default.

Front 45

What major downside is there to enabling Non-persistent certificate processing?

Back 45

You can no longer revoke issued certs.
IE., you cannot manage CRLs after enabling this high-volume feature.

Front 46

What 3 main steps are there when configuring a Revocation Configuration?

Back 46

*Specify CRL distribution points
*Configure CRL and Delta CRL overlap
*Schedule the publication of CRLs

Front 47

If you will use wireless networks, what type of template would you create?

Back 47

Network Policy Server (NPS)

Front 48

How do you configure Enrollment?

Back 48

Through Group Policy. The policy must be assigned to all members of domain, so use Default Domain Policy.

Front 49

How do you backup your CA?

Back 49

In server manager, expand Roles\Active Directory Certificate Services\CA <server name>. Right click the server > All Tasks > Back Up CA

Front 50

This is a protected area of registry on ALL server and client computers.

Back 50

Certificate Store.
within the store is a series of sub-stores that include certificates for various purposes.

Front 51

What 3 ways can you back up Certificate Services?

Back 51

Wbadmin.exe to perform Critical volumes backup
Wbadmin.exe to perform a System State backup
Cert Authority Snap-in > right click the CA and choose
All Tasks > Back up CA

Front 52

Which AD CS role can you delegate to approve certification enrollment and revocation requests?

Back 52

Certification Manager

Front 53

Which AD CS role can you delegate to backup and recover the CA database, configuration and database?

Back 53

Backup Operator

Front 54

If you want to grant permission to request retrieval of private keys, what would you do?

Back 54

Make the user a Private Key Manager

Front 55

Looking at the CA server's Properties box, what permission do Authenticated users have by default?

Back 55

"Request Certificates." NOT "read". "Read" is for admins.

You don't need Read rights on the CA to obtain certs.