Chapter 10 - Implement Identity Federation and Access Solutions Flashcards
You are the administrator for your company network. Your network contains an Active Directory domain. The domain contains a domain controller named Server1. You recently restored a backup of the Active Directory database from Server1 to an alternate location. The restore operation did not interrupt the Active Directory services on Server1. What tool should you use if you need to make the Active Directory data in the backup accessible by using Lightweight Directory Access Protocol (LDAP)? A. Active Directory Administrative Center B. Active Directory Users and Computers C. Dsacls D. Dsadd quota E. Dsamain F. Dsmod G. Group Policy Management Console H. Ntdsutil
E. The Dsamain tool exposes Active Directory data that is stored in a snapshot or backup as an LDAP server. Dsamain.exe is available if you have the Active Directory Domain Services (AD DS) or Active Directory Lightweight Directory Services (AD LDS) server role installed. To use Dsamain, you must run it from an elevated command prompt.
You are the administrator for your company network. You and a colleague are discussing the Federation Proxy services. The Federation Proxy services are installed through which of the following?
A. A separate Active Directory Federation Proxy install download
B. Server Manager ➢Remote Access ➢Web Proxy
C. Server Manager ➢Active Directory Federation Services ➢Active Directory Proxy services
D. PowerShell ➢Install-Windows-Feature Web Proxy
B. Federation Proxy services are installed under Remote Access as a Web Application Proxy (WAP) server in Windows Server 2016. A domain controller can contain Active Directory information for only one domain. If you want to use a multidomain environment, you must use multiple domain controllers configured in either a tree or a forest setting.
You are the administrator for your company network. You and a colleague are discussing different authentication capabilities offered when using Active Directory Federation Services (AD FS) authentication. One of the features offered with AD FS is the ability to allow users to enter their credentials only once but then be authenticated to all supported published applications. What is this feature called? A. Multi-Factor Authentication (MFA) B. Multi-Factor Access Control C. Single Sign-On D. Workplace Join
C. The Single Sign-On (SSO) feature allows users to enter their credentials only once to be authenticated to all supported published applications. SSO is a feature that is used heavily when connecting your corporate network to another network (like the cloud). Users sign in once but have access to both networks.
You are the administrator for your company network. You and a colleague are discussing the Certification Authority role. What should you consider if you want the configuration modifications of the Certification Authority role service to be logged? (Choose all that apply.) A. Enabling auditing of system events B. Enabling logging C. Enabling auditing of object access D. Enabling auditing of privilege use E. Enabling auditing of process tracking
B, C. To log modifications of the Certification Authority role service, you will need to enable AD FS auditing. You must check the boxes for Success Audits and Failure Audits on the Events tab of the Federation Service Properties dialog box. You must also enable Object Access Auditing in Local Policy or Group Policy.
You are the administrator for your company network. Company management asks you to implement a new Windows Server 2016 system. Which of the following will you need to implement if you want to use federated identity management? A. Active Directory DNS Services B. Active Directory Federation Services C. Active Directory IAS Services D. Active Directory IIS Services
B. You will need to use Active Directory Federation Services (AD FS) in order to implement federated identity management. Federated identity management is a standards-based and information technology process that will enable distributed identification, authentication, and authorization across organizational and platform boundaries. The AD FS solution in Windows Server 2016 helps administrators address these challenges by enabling organiza- tions to share a user’s identity information securely.
You are the administrator for your company network. You have a Windows Server 2016 server named Server1 that has the Windows Application Proxy role service installed.
You need to publish Microsoft Exchange ActiveSync services by using the Publish New Application Wizard. The ActiveSync services must use preauthentication. How should you configure Server1’s preauthentication method and preauthentication type?
A. Configure the Active Directory Federation Services (AD FS) preauthentication method and the Oath2 preauthentication type.
B. Configure the pass-through preauthentication method and the Web/MS-OFBA preau- thentication type.
C. Configure the pass-through preauthentication method and the HTTP Basic preauthen- tication type.
D. Configure the Active Directory Federation Services (AD FS) preauthentication method and the HTTP Basic preauthentication type
C. The pass-through preauthentication method is when users are not required to enter credentials before they are allowed to connect to published web applications. The HTTP Basic preauthentication type is the authorization protocol used by many protocols, includ- ing ActiveSync, to connect to smartphones or to your Exchange mailbox. Publishing an app using HTTP Basic provides support for ActiveSync clients in Web Application Proxy (WAP) by caching the token that is received from AD FS and serving it from the cache. In this way, WAP enables the HTTP app to receive a non-claims Relying Party Trust for the application to the Federation Service.
You are the administrator for your company network. Your network contains an Active Directory forest, which contains a member server named Server1 that runs Windows Server 2016. Server1 is located in the perimeter network. You install the Active Directory Federa- tion Services (AD FS) server role on Server1. You create an AD FS farm by using a certifi- cate that has a subject name of adfs.abc.com. What inbound TCP ports should you open on the firewall if you need to enable certificate authentication from the Internet on Server1? (Choose two.) A. 389 B. 443 C. 3389 D. 8531 E. 49443
B, E. AD FS provides features such as Single Sign-On (SSO). SSO allows you to log in one time with a set of credentials and use that set of credentials to access the applications over and over. To use a Web Application Proxy (WAP), you should set your firewall to allow for ports 443 and 49443.
You are the administrator for your company network. You have a Windows Server 2016 server named Server1 that has the Web Application Proxy (WAP) role service installed. You publish an application named App1 by using the WAP. What cmdlet should you run if you need to change the URL that users use to connect to App1 when they work remotely?
A. Set-WebApplicationProxyConfiguration
-ID 874A4543-77A3-1E6D-1163E7419AC1 -ADFSUrl https://abc.com/
B. Set-WebApplicationProxySslCertificate
-ID 874A4543-77A3-1E6D-1163E7419AC1 -BackendServerUrl https://abc.com/
C. Set-WebApplicationProxyApplication
-ID 874A4543-77A3-1E6D-1163E7419AC1 -ExternalUrl https://abc.com/
D. Set-WebApplicationProxy -ID 874A4543-77A3-1E6D-1163E7419AC1 -InternalUrl https://abc.com/
C. The Set-WebApplicationProxyApplication cmdlet modifies settings of a web application published through Web Application Proxy. Specify the web application to modify by using its ID. The -ID parameter specifies the GUID of a web application. The -ExternalUrl parameter specifies the external address, as a URL, for the web applica- tion. Include the trailing slash (/).
You are the administrator for your company network. Your network contains an Active Directory domain. What should you use if you need to create a Central Store for Group Policy Administrative Template files?
A. Server Manager
B. File Explorer
C. dcgpofix.exe
D. Group Policy Management Console (GPMC)
B. Administrative Template files are divided into .admx files and .adml files for use by Group Policy administrators. Windows uses a Central Store to store Administrative Tem- plates files. To create a Central Store for .admx and .adml files, create a new folder named PolicyDefinitions in File Explorer.
You are the administrator for your company network. You have a Windows Server 2016 server named Server1. You need to configure Server1 as a Web Application Proxy (WAP). Which server role or role service should you install on Server1? A. Active Directory Federation Services B. DirectAccess and VPN (RAS) C. Remote Access D. Web Server (IIS)
C. To use the WAP, you must install the Remote Access role. One of the advantages of using the Remote Access role service in Windows Server 2016 is the WAP. Normally, your users access applications on the Internet from your corporate network. The WAP reverses this feature, and it allows your corporate users to access applications from any device out- side the network.
You are the administrator for your company network. Your network contains an Active Directory domain. You plan to deploy a Windows 2016 Active Directory Federation Ser- vices (AD FS) farm that will contain eight federation servers. You need to identify which technology or technologies must be deployed on the network before you install the federa-
tion servers. Which technology or technologies should you identify?
A. Microsoft Forefront Identity Manager 2010
B. Microsoft SQL Server 2016
C. Network Load Balancing (NLB)
D. Windows Internal Database feature
E. The Windows Identity Foundation 3.5 feature
B. The AD FS configuration database stores all of the configuration data. It contains infor- mation that a federation service requires to identify partners, certificates, attribute stores, claims, and so forth. You can store this configuration data in either a Microsoft SQL Server or the Windows Internal Database feature that is included with Windows Server 2008/2008 R2, Windows Server 2012/2012 R2, and Windows Server 2016. The Windows Internal Database supports only up to five federation servers in a farm.
You are the administrator for your company network. Your network contains an Active Directory forest. Your company has a custom application named CustomApp1. CustomApp1 uses an Active Directory Lightweight Directory Services (AD LDS) server named Server1
to authenticate users. You have a Windows Server 2016 member server named Server2.
You install the Active Directory Federation Services (AD FS) server role on Server2 and create an AD FS farm. What two cmdlets should you run if you need to configure AD FS
to authenticate users from the AD LDS server? (Choose two.)
A. You should run the Add-AdfsRelyingPartyTrust and Set-AdfsEndpoint cmdlets.
B. You should run the New-AdfsLdapServerConnection and
Add-AdfsLocalClaimsProviderTrust cmdlets.
C. You should run the Set-AdfsEndpoint and Enable-AdfsRelyingPartyTrust
cmdlets.
D. You should run the Enable-AdfsRelyingPartyTrust and
New-AdfsLdapServerConnection cmdlets.
B. The New-AdfsLdapServerConnection cmdlet creates a connection object that represents the Lightweight Directory Access Protocol (LDAP) folder that serves as a claims provider
trust. The Add-AdfsClaimsProviderTrust cmdlet adds a new claims provider trust to the Federation Service. In order for AD FS to authenticate users from an LDAP directory, you must connect this LDAP directory to your AD FS farm by creating a local claims provider trust. A local claims provider trust is a trust object that represents an LDAP directory in
your AD FS farm. So to configure a connection to your LDAP directory, you would use the New-AdfsLdapServerConnection cmdlet. Then you must register the LDAP store with AD FS as a local claims provider trust by using the Add-AdfsLocalClaimsProviderTrust cmdlet.
You are the administrator for your company network. You are deploying a web application named WebApp1 to your internal network. WebApp1 is hosted on a Windows Server
2016 server named Web1. You deploy an Active Directory Federation Services (AD FS) infrastructure and a Web Application Proxy (WAP) to provide access to WebApp1 for remote users. What should you do if you need to ensure that Web1 can authenticate the remote users?
A. Publish WebApp1 by using pass-through preauthentication.
B. Publish WebApp1 by using AD FS preauthentication.
C. Publish WebApp1 by using client certificate preauthentication.
D. Publish WebApp1 as a Remote Desktop Gateway (RD Gateway) application in the Web Application Proxy.
A. When using pass-through preauthentication, users are not required to enter credentials before they are allowed to connect to published web applications. Pass-through will let WAP act like a reverse proxy
You are the administrator for your company network. The network contains an Active Directory domain. The domain contains an Active Directory Federation Services (AD FS) server named Server1. On a stand-alone server named Server2, you install and configure the Web Application Proxy (WAP). You have an internal web application named WebApp1. AD FS has a relying party trust for WebApp1. You need to provide external users with access
to WebApp1. What tool should you use to publish WebApp1 if authentication to WebApp1 must use AD FS preauthentication?
A. On Server1, use AD FS Management.
B. On Server1, use Remote Access Management.
C. On Server1, use Routing and Remote Access.
D. On Server2, use AD FS Management.
E. On Server2, use Remote Access Management.
E. AD FS preauthentication requires the user to authenticate directly with the AD FS server. After the AD FS authentication happens, WAP then redirects the user to the pub- lished web application. This guarantees that traffic to your published web applications is authenticated before a user can access them. You will do this using the Remote Access Management console.
You are the administrator for your company network. You and a colleague are discussing certificates for AD FS. You store AD FS servers in an OU named Federation Servers. You want to auto-enroll the certificates used for AD FS. Which certificates should you add to the GPO?
A. The Certificate Authorities (CA) certificate of the forest
B. The SSL certificate assigned to the AD FS servers
C. The third-party (VeriSign, Entrust) Certificate Authorities (CA) certificate
D. The Token Signing certificate assigned to the AD FS servers
A. The Certificate Authorities (CA) certificate of the forest should be added to the GPO. The Forest Certificate Authorities (CA) certificate is the only certificate that is automatically trusted; it does not require user interaction or a digital signature, and it does not change in this scenario. CAs issue certificates, revoke certificates they’ve issued, and publish certifi- cates for their clients.
You are the administrator for your company network. You have an internal web server that hosts websites. The websites use HTTP and HTTPS. You deploy a Web Application Proxy (WAP) to your perimeter network. You need to ensure that users from the Internet can access the websites by using HTTPS only. What actions should you perform if you want Internet access to the websites to use the WAP? (Choose two.)
A. Publish the websites from the Remote Access Management console. Configure pass- through authentication and select Enable HTTP to HTTPS redirection.
B. Using Oauth2, configure the WAP to perform preauthentication.
C. Create DNS entries that point to the private IP address of the web server on the exter-
nal DNS name servers.
D. Enable HTTP Redirect on the WAP server from the web server.
E. Create DNS entries that point to the public IP address of the WAP on the external DNS name servers.
A, E. For your users to gain access, you need to allow them to have access and set up DNS so that they can find the access point. So, you would publish the websites from the Remote Access Management console. Configure Pass-Through Authentication and select Enable HTTP to HTTPS redirection. You would also create DNS entries that point to the public IP address of the WAP on the external DNS name servers.
You are the administrator for your company network. You use Application Request Routing (ARR) to make internal web applications available to the Internet by using NTLM authentication. What server role should you deploy first if you need to replace ARR by using Web Application Proxy (WAP)?
A. Active Directory Lightweight Directory Services (AD LDS) B. Active Directory Rights Management Services (AD RMS) C. Active Directory Federation Services (AD FS)
D. Active Directory Certificate Services (AD CS)
C. To install WAP, you must first install Active Directory Federation Service (AD FS). AD FS is Microsoft’s claims-based identity solution providing browser-based clients (internal or external to your network) with transparent access to one or more protected Internet-facing applications. WAP functions as an AD FS federation server proxy. WAP provides reverse proxy functionality for web applications inside your corporate network to enable users on any device to access them from outside the corporate network.
You are the administrator for your company network. Your network contains an Active Directory domain. The domain contains an Active Directory Federation Services (AD FS) server named ADFS1, a Web Application Proxy (WAP) server named WAP1, and a web server named Web1. You need to publish a website on Web1 by using the WAP. Users will authenticate by using OAuth2 preauthentication. What should you do first? A. Add site bindings on Web1. B. Add a claims provider trust on ADFS1. C. Add handler mappings on Web1. D. Enable an endpoint on ADFS1
B. A claims provider is a federation server that processes trusted identity claims requests. A federation server processes requests to issue, manage, and validate security tokens. Security tokens consist of a collection of identity claims, such as a user’s name or role or an anony- mous identifier.
You are the administrator for your company network. Your network contains an Active Directory forest. You have an Active Directory Federation Services (AD FS) farm. The farm contains a Windows Server 2012 R2 server named Server1. You add a Windows Server 2016 server named Server2 to the farm. You remove Server1 from the farm. What cmdlet should you run if you need to ensure that you can use role separation to manage the farm? A. Invoke-AdfsFarmBehaviorLevelRaise B. Set-AdfsProperties C. Set-AdfsFarmInformation D. Update-AdfsRelyingPartyTrust
A. To upgrade the farm behavior level from Windows Server 2012 R2 to Windows Server 2016, use the Invoke-AdfsFarmBehaviorLevelRaise cmdlet. This raises the behavior level of an Active Directory Federation Services (AD FS) farm to enable the new features that are available in later versions of the Windows operating system. AD FS for Windows Server 2016 introduces the ability to have role separation between server administrators and AD FS service administrators. After upgrading an AD FS server
to Windows Server 2016, the last step is to raise the Farm Behavior Level using the Invoke-AdfsFarmBehaviorLevelRaise PowerShell cmdlet.
You are the administrator for your company network. Your network contains an Active Directory forest that contains an Active Directory Federation Services (AD FS) deployment. The AD FS deployment contains the following:
You create a Microsoft Office 365 tenant named abc.onmicrosoft.com.
You use Microsoft Azure Active Directory Connect (AD Connect) to synchronize all of the users and the UPNs from the contoso.com forest to Office 365.
You need to configure federation between Office 365 and the on-premises deployment of
Active Directory. Which commands should you run from Server1? (Choose all that apply.)
A. Connect-MsolService
B. Convert-MsolDomainToFederated -DomainName abc.com
C. Convert_MsolDomainToFederated -DomainName adfs.abc.com D. Enter-PSSession -Name Office365
E. Set-MsolADFSContext -Computer server1.abc.com
F. Set-MsolADFSContext -Computer abc.com
A, B, E. You would do them in this order: A, E, B.
The Connect-MsolService cmdlet attempts to initiate a connection to Azure Active Directory. The Set-MsolADFSContext cmdlet sets the credentials to connect to Microsoft Online and to the Active Directory Federation Services (AD FS) server.
The -Computer parameter specifies the computer name of the primary AD FS server. The Convert-MSOLDomainToFederated cmdlet converts the specified domain from standard authentication to Single Sign-On. The -DomainName parameter specifies the name of the domain to convert to Single Sign-On.
You are the administrator for your company network. You need to see all of the location sets for the CRL Distribution Point (CDP). What PowerShell cmdlet would you use? A. Add-CACrlDistributionPoint B. Get-CACrlDistributionPoint C. See-CACrlDistributionPoint D. View-CACrlDistributionPoint
B. Administrators can use the Get-CACrlDistributionPoint cmdlet to view all the locations set for the CRL distribution point (CDP). The Get-CACRLDistributionPoint cmdlet gets all the locations set on the CDP extension of the certification authority (CA) properties.
You are the administrator for your company network. The network contains an Active Direc- tory domain. A previous administrator implemented a Proof of Concept installation of Active Directory Rights Management Services (AD RMS) on a server named Server1. After the Proof of Concept was complete, the AD RMS server role was removed. You attempt to deploy AD RMS. During the configuration you receive an error message indicating that an existing AD RMS Service Connection Point (SCP) was found. What should you do if you need to ensure
that clients will only attempt to establish connections to the new AD RMS deployment?
A. Increase the priority of the DNS records for the new deployment of AD RMS from DNS.
B. Remove the computer object for Server1 from Active Directory.
C. Remove the records for Server1 from DNS.
D. Remove the SCP from Active Directory.
D. The AD RMS Service Connection Point (SCP) is an object in Active Directory that holds the web address of the AD RMS certification cluster. AD RMS–enabled applications use the SCP to discover the AD RMS service; it is the first connection point for users to dis- cover the AD RMS web services. Only one SCP can exist in your Active Directory forest.
If you try to install AD RMS and an SCP already exists in your forest from a previous AD RMS installation that was not properly removed, the new SCP will not install properly. The pre-existing SCP must be removed before you can establish the new SCP.
You are the administrator for your company network. The network contains an Active Directory domain. The domain contains an Active Directory Rights Management Services (AD RMS) cluster and a certification authority (CA). What should you do if you need to ensure that all the documents that are protected by using AD RMS can be decrypted if the account used to encrypt the documents is deleted?
A. Configure super users in the AD RMS deployment.
B. Manually configure the AD RMS cluster key password.
C. On the CA, configure key archival.
D. Using Windows Server Backup, back up the AD RMS–protected files.
A. The AD RMS super user group is a special group that has full control over all rights- protected content managed by the cluster. Its members are granted full owner rights in all use licenses that are issued by the AD RMS cluster on which the super users group is configured.
You are the administrator for your company network. You deploy a new Enterprise Certifi- cation Authority (CA) named CA1. You plan to issue certificates based on the User certifi- cate template. What should you do first if you need to ensure that the issued certificates are valid for two years and support auto-enrollment?
A. Add a new certificate template for CA1 to issue.
B. Duplicate the User certificate template.
C. Modify the Request Handling settings for the CA.
D. Run the certutil.exe command and specify the resubmit parameter.
B. Since you are planning to issue certificates based on a User certificate template, you need to first copy that template so that you can alter it to the new settings. The built-in templates support auto-enrollment. You need to duplicate the template and then modify the permis- sions on the new template.
You are the administrator for your company network. You need to ensure that clients check at least every 30 minutes as to whether a certificate has been revoked. Which of the follow- ing should you configure to accomplish this goal? A. Certificate templates B. CRL publication interval C. Delta CRL publication interval D. Key recovery agent
C. A Delta CRL is a Certificate Revocation List (CRL) that contains all non-expired cer- tificates that have been revoked since the last base CRL was published. You can set a time interval for how often the servers check the CRL. This is referred to as the Delta CRL pub- lication interval.
You are the administrator for your company network. You install and configure four Windows Server 2016 servers as an AD FS server farm. The AD FS configuration database is stored in a Microsoft SQL Server database. You need to ensure that AD FS will continue to function in the event of an AD FS server failure. You also need to ensure that all four servers in the AD FS farm will actively perform AD FS functions. What should you include in your solution? A. Network Load Balancing B. Windows Failover Clustering C. Windows Identity Foundation 3.5 D. Web Proxy Server
A. Network Load Balancing (NLB) is the only supported Microsoft solution for providing high availability across an AD FS server farm. Windows Failover Clustering does not cur- rently support AD FS, as one master server is allowed to write to the configuration database per farm.
You are the administrator for your company network. Which of the following CA types would you deploy if you wanted to deploy a CA at the top of a hierarchy that could issue signing certificates to other CAs and then would be taken offline if not issuing, renewing, or revoking signing certificates? A. Enterprise root B. Enterprise subordinate C. Stand-alone root D. Stand-alone subordinate
C. You can take a stand-alone root CA offline and it functions as the top of a CA hierar- chy. A stand-alone root CA is also the topmost CA in the certificate chain. A stand-alone root CA is not dependent on Active Directory and can be removed from the network. This makes a stand-alone root CA the solution for implementing a secure offline root CA.
You are the administrator for your company network. Your network contains an Active Directory domain. Domain users use smartcards to sign in to their client computers. Several users report that it takes a long time to sign in to their computers and that the logon attempt times out, so they must restart the sign-in process. You discover that the issue is with check- ing the Certificate Revocation List (CRL) of the smartcard certificates. What should you do if you need to resolve the issue without reducing the security of the smartcard logons?
A. Implement an Online Certification Status Protocol (OCSP) responder.
B. Modify the Request Handling settings from the properties of the smartcard’s certifi-
cate template.
C. Modify the Issuance Requirements settings from the properties of the smartcard’s cer- tificate template.
D. On the computers, deactivate certificate revocation checks.
A. Online Certificate Status Protocol (OCSP) is a lightweight HTTP protocol that responds more quickly and efficiently than downloading a traditional CRL. An online responder is
a trusted server that receives and responds to individual client requests for the status of a certificate. An OCSP responder retrieves CRLs and provides digitally signed real-time cer- tificate revocation status responses to clients based on a given certificate authority’s CRL.
You are the administrator for your company network. You and a colleague are discussing Active Directory Rights Management Services (AD RMS). How many AD RMS root clus- ters can you have per Active Directory forest? A. 1 B. 2 C. 5 D. Unlimited
A. There can be only one Active Directory Rights Management Services (AD RMS) root cluster per Active Directory forest. After a root cluster is deployed, there is the option of installing addi- tional licensing-only clusters, which issue licenses to clients for publishing their content.
You are the administrator for your company network. You have an Enterprise Certification Authority (CA) named CA1. Recovery agents are configured for CA1. You duplicate the User certificate template and name it Temp_User. You plan to issue the certificates based on Temp_User to provide users with the ability to encrypt email messages and files. What should you use if you need to ensure that the recovery agents can access any user-encrypted files and email messages if the users lose their certificates?
A. Configure the Key Recovery Agent template as a certificate template to issue on CA1.
B. Issue a certificate based on a Key Recovery Agent certificate.
C. Modify the Recovery Agents settings for CA1.
D. Modify the Request Handling settings for Temp_User.
D. The Request Handling tab in the Certificate Templates Management console has the Renew With Same Key Certificate Template Configuration option. This certificate template option becomes visible in the user interface when you configure the Certification Authority and Certificate Recipient options to Windows Server 2016 and Windows 8/8.1, and Windows 10, respectively.
You are the administrator for your company network. You have a server that is configured as a hosted BranchCache server. You discover that a Service Connection Point (SCP) is missing for the BranchCache server. What should you run to register the SCP? A. Enable-BCHostedServer B. ntdsutil.exe C. Reset-BC D. setspn.exe
A. To configure the computer as a hosted cache server after the BranchCache feature is installed, and to register an SCP in AD DS, use the Enable-BCHostedServer PowerShell cmdlet. The Enable-BCHostedServer cmdlet configures BranchCache to operate in hosted cache server mode.
You are the administrator for your company network. Your network contains an Active Directory forest. The forest contains an Active Directory Federation Services (AD FS) farm. You install Windows Server 2016 on a server named Server2. What cmdlets should you run if you need to configure Server2 as a node in the federation server farm?
A. Install-AdfsFarm and New-AdfsOrganization
B. Install-WindowsFeature and Install-AdfsFarm
C. Install-Package and Set-AdfsFarmInformation
D. Install-AdfsFarm and Set-AdfsProperties
B. The Install-WindowsFeature installs one or more roles, role services, or features on either the local or a specified remote server that is running Windows Server 2016. The Install-AdfsFarm cmdlet creates the first node of a new federation server farm.
You are the administrator for your company network. You and a colleague are discussing Active Directory Certificate Services (AD CS). AD CS role provides six role services to issue and manage public key certificates in an enterprise environment. Which one retrieves revo- cation status requests for specific certificates and the status of these certificates, and then returns a signed response with the requested certificate status information?
A. Certificate Authority (CA)
B. Certificate Enrollment Web Services (CES)
C. Online Responder
D. Web Enrollment
C. The Online Responder service retrieves revocation status requests for specific certifi- cates and the status of these certificates, and it returns a signed response with the requested certificate status information. Online Responders are used to validate requests sent by network users. Instead of downloading huge CRLs, a user will send a request to the local Online Certificate Status Protocol (OCSP) service to verify the authenticity of an entity. You can deploy one Online Responder to verify the revocation status for one or multiple CAs.
You are the administrator for your company network. You have an Enterprise Certification Authority (CA) named CA1 that has a certificate template named CertTemplate that
is based on a User certificate template. Domain users are configured to auto-enroll CertTemplate. A user named User1 has an email address defined in Active Directory and a user named User2 does not. You discover that User1 was issued a certificate based on the template automatically. A request by User2 for a certificate based on the template fails. You need to ensure that all users can auto-enroll for certificates based on the template. What setting should you configure from the properties on the CertTemplate certificate template?
A. Cryptography
B. Issuance Requirements
C. Request Handling
D. Subject Name
D. If you want to enable automatic certificate approval and automatic user certificate enrollment, use enterprise CAs to issue certificates. You would need to open the template properties and select the Subject Name tab. If the Email name field is populated in the Active Directory user object, that email name will be used for user accounts. The email name is required for user certificates. If the email name is not populated for a user in AD DS, the certificate request by that user will fail.
