MCTS 70-640 Technology & Digital Applications 2 — Questions and Answers
Question 1: An administrator is deploying an Enterprise CA using AD Certificate Services. What is a prerequisite for installing an Enterprise CA?
- The server must be joined to a workgroup
- Active Directory Domain Services must be installed and accessible (Correct answer)
- Internet Information Services must be disabled
- A standalone CA must be installed first
Correct answer: Active Directory Domain Services must be installed and accessible
An Enterprise CA requires access to AD DS to publish certificates and CRLs to the directory.
Question 2: Which AD CS role service allows users to request certificates through a web browser without requiring the CA to be directly accessible?
- Online Responder
- Certificate Enrollment Policy Web Service
- Certification Authority Web Enrollment (Correct answer)
- Network Device Enrollment Service
Correct answer: Certification Authority Web Enrollment
Certification Authority Web Enrollment provides a web interface (certsrv) so clients can request and retrieve certificates via HTTP.
Question 3: What is the primary purpose of a Certificate Revocation List (CRL) in a PKI deployment?
- To list all issued certificates and their expiry dates
- To publish certificates that are no longer trusted before their expiry (Correct answer)
- To store private keys for certificate recovery
- To enumerate all trusted root CAs in the forest
Correct answer: To publish certificates that are no longer trusted before their expiry
A CRL is a signed list of certificate serial numbers that have been revoked and should no longer be trusted.
Question 4: A company needs devices like routers to automatically obtain certificates without human interaction. Which AD CS role service supports this via SCEP?
- Online Responder
- Network Device Enrollment Service (NDES) (Correct answer)
- Certificate Enrollment Web Service
- CA Web Enrollment
Correct answer: Network Device Enrollment Service (NDES)
NDES implements the Simple Certificate Enrollment Protocol (SCEP), enabling network devices to enroll for certificates automatically.
Question 5: Which certificate template version (v1, v2, v3) is required to support key archival and recovery in Windows Server 2008 AD CS?
- Version 1 only
- Version 2 or higher (Correct answer)
- Version 3 only
- All versions support key archival
Correct answer: Version 2 or higher
Version 2 (Windows Server 2003) and Version 3 (Windows Server 2008) templates support key archival; Version 1 templates are read-only and do not.
Question 6: What technology does the Online Responder role service in AD CS implement to provide real-time certificate status without downloading a full CRL?
- LDAP certificate queries
- Online Certificate Status Protocol (OCSP) (Correct answer)
- Kerberos certificate validation
- SCEP revocation checking
Correct answer: Online Certificate Status Protocol (OCSP)
The Online Responder implements OCSP, allowing clients to query the revocation status of a single certificate in real time.
Question 7: An administrator wants users to automatically receive computer certificates without any manual request process. Which Group Policy setting should be configured?
- Certificate Services Client – Certificate Enrollment Policy
- Software Restriction Policies
- Public Key Policies – Autoenrollment Settings (Correct answer)
- Account Policies – Kerberos Policy
Correct answer: Public Key Policies – Autoenrollment Settings
The Autoenrollment Settings policy under Public Key Policies automates certificate enrollment and renewal for users and computers.
MCTS 70-640 Technology & Digital Applications 2
An administrator is deploying an Enterprise CA using AD Certificate Services.
What is a prerequisite for installing an Enterprise CA?