Title: Quiz 7
Course: CTS 2392 Configuring Advanced Windows 2012 Services > Section: Module 7

Q: Which of the following components of Active Directory Federaation Services is the application or web service that accepts claims?
- Federation server proxy
- Claims provider
- Relying party
- Claim
A: Relying party
If right: The Relying party is the application or web service that accepts claims from the claims provider.
If wrong: The Relying party is the application or web service that accepts claims from the claims provider.

Q: Which of the following components of Active Directory Federaation Services is the server that issues claims and authenticates users?
- Federation server proxy
- Claims provider
- Relying party
- Claim
A: Claims provider
If right: The claims provider is the server that issues claims and authenticates users.
If wrong: The claims provider is the server that issues claims and authenticates users.

Q: Which of the following commands would be the best option to use to configure a new AD FS farm using the Windows Internal Database?
- fsconfig.exe StandAlone
- fsconfig.exe CreateFarm
- fsconfig.exe CreateSQLFarm
- fsconfig.exe JoinFarm
A: fsconfig.exe CreateFarm
If right: You will need to use the fsconfig.exe CreateFarm command to configure a new AD FS farm using the Windows Internal Database.
If wrong: You will need to use the fsconfig.exe CreateFarm command to configure a new AD FS farm using the Windows Internal Database.

Q: The AD FS proxy server is located in the __________ network and communicates using TCP port __________ over the Internet.

Q: Which of the following components of Active Directory Federation Services is responsible for forwarding packets from external hosts to internal federation servers?
- Federation server proxy
- Claims provider
- Relying party
- Claim
A: Federation server proxy
If right: The Federation server proxy is an optional component that is usually deployed in a perimeter network such as DMZ that can receive externally and forward the packets to the internal federation server.
If wrong: The Federation server proxy is an optional component that is usually deployed in a perimeter network such as DMZ that can receive externally and forward the packets to the internal federation server.

Q: Which of the following components of Active Directory Federation Services is a statement made by a trusted entity and includes information identifying the entity?
- Federation server proxy
- Claims provider
- Relying party
- Claim
A: Claim
If right: Claims are statements made by a trusted entity about an object such as a user that includes key information identifying the user.
If wrong: Claims are statements made by a trusted entity about an object such as a user that includes key information identifying the user.

Q: Federation servers require _________ to prevent attackers from altering or counterfeiting security tokens in an attempt to gain unauthorized access to federated resources.

Q: What command-line command can be used to configure the AD FS server?

Q: What is the function of the relying party trust?

Q: What other software is required to be installed before installing the Windows Identity Foundation SDK 4.0?

Q: Which of the following statements is untrue regarding configuration of attribute stores for AD FS?
- When using AD DS as the attribute store, no connection string is required
- When using AD LDS as the attribute store, no connection string is required
- When using SQL as the attribute store, a connection string is required to be configured
- All of the above statements are true
A: When using AD LDS as the attribute store, no connection string is required
If right: If you decide to use AD LDS or an SQL database, you need to specify a connection string.
If wrong: If you decide to use AD LDS or an SQL database, you need to specify a connection string.

Q: What step(s) will you need to perform while configuring a claims provider trust that you will not need to perform while configuring a relying party trust? (Choose all that apply)
- Map attributes
- Specify the application
- Edit claims rules
- Provide a URL for the partner federation server
A: Map attributes; Edit claims rules
If right: Mapping attributes is a step of editing and configuring claims rules, which is performed when configuring a claims provider trust, but not a relying party trust.
If wrong: Mapping attributes is a step of editing and configuring claims rules, which is performed when configuring a claims provider trust, but not a relying party trust.

Q: Which PKI role in AD CS can be used to issue certificates to routers and switches?
- CA
- Online Responder
- Network Device Enrollment Service
- CA Web Enrollment
A: Network Device Enrollment Service
If right: The Network Device Enrollment Service component can be used to assign certificates to routers, switches, and other network devices.
If wrong: The Network Device Enrollment Service component can be used to assign certificates to routers, switches, and other network devices.

Q: Which PKI role in AD CS issues certificates and manages certificate validity?
- CA
- Online Responder
- Network Device Enrollment Service
- CA Web Enrollment
A: CA
If right: The CA issues certificates to users and computers, and services and manages certificate validity.
If wrong: The CA issues certificates to users and computers, and services and manages certificate validity.

Q: Which PKI role in AD CS is used to allow non-Windows operation system users to request certificates?
- CA
- Online Responder
- Network Device Enrollment Service
- CA Web Enrollment
A: CA Web Enrollment
If right: The CA Web Enrollment component provides a method to issue and renew certificates for users, computers, and devices that are not joined to the domain, are not connected directly to the network, or are for users of non-Windows operating systems.
If wrong: The CA Web Enrollment component provides a method to issue and renew certificates for users, computers, and devices that are not joined to the domain, are not connected directly to the network, or are for users of non-Windows operating systems.

Q: Which PKI role in AD CS is used to validate certificates?
- CA
- Online Responder
- Network Device Enrollment Service
- CA Web Enrollment
A: Online Responder
If right: The Online Responder provides the Online Certificate Status Protocol (OCSP), which is used to validate certificates.
If wrong: The Online Responder provides the Online Certificate Status Protocol (OCSP), which is used to validate certificates.

Q: What is the best way to fully back up the CA without backing up more than necessary?
- System state backup
- Full system backup
- CA backup using Certification Authority console
- Bare metal recovery
A: System state backup
If right: To get a full CA backup, you really need to back up the system state, as this includes the CA database, the registry and the IIS metabase. In practice, many CA administrators just script the backup of the CA database and perform a one-time (or periodic) backup of the system state, as that information (IIS metabase and registry for the CA) typically doesnt change. Youll want to include your CAPolicy.inf file as well as a listing of all published templates in your backup plans.
If wrong: To get a full CA backup, you really need to back up the system state, as this includes the CA database, the registry and the IIS metabase. In practice, many CA administrators just script the backup of the CA database and perform a one-time (or periodic) backup of the system state, as that information (IIS metabase and registry for the CA) typically doesnt change. Youll want to include your CAPolicy.inf file as well as a listing of all published templates in your backup plans.

Q: Why would you want to consider making the Root CA an offline CA?
- This improves certificate issuing speed
- This improves security of the root CA and its private keys
- This reduces the number of CAs you actively need to manage
- This prevents requests from inadvertently being sent to the Root CA
A: This improves security of the root CA and its private keys
If right: If a CA is compromised, all certificates issued by the CA and any subordinate CAs that are under the compromised CA (and corresponding issued certificates) are also considered compromised. To maximize the security of the root CA, the root CA can be disconnected from the network, and subordinate CAs are used to issue certificates to other subordinate CAs or to end users.
If wrong: If a CA is compromised, all certificates issued by the CA and any subordinate CAs that are under the compromised CA (and corresponding issued certificates) are also considered compromised. To maximize the security of the root CA, the root CA can be disconnected from the network, and subordinate CAs are used to issue certificates to other subordinate CAs or to end users.

Q: What is the benefit of using asymmetric encryption instead of symmetric encryption?
- Asymmetric encryption is faster to encrypt and decrypt
- Asymmetric encryption does not require out-of-band key exchange
- Asymmetric encryption does not require a complex infrastructure to manage private keys
- Asymmetric encryption does not require the usage of a digital certificate for the public keys
A: Asymmetric encryption does not require a complex infrastructure to manage private keys
If right: Unlike symmetric key algorithms, this method does not require a secure initial exchange of one or more secret keys to both sender and receiver. Instead, you can make the public key known to anyone and use the other key to encrypt or decrypt the data. The public key can be sent to someone or can be published within a digital certificate through a CA.
If wrong: Unlike symmetric key algorithms, this method does not require a secure initial exchange of one or more secret keys to both sender and receiver. Instead, you can make the public key known to anyone and use the other key to encrypt or decrypt the data. The public key can be sent to someone or can be published within a digital certificate through a CA.

Q: What will you find in the certificate revocation list (CRL)?

Q: How do you configure a junior administrator to have the backup operator role for your CA?

Q: A __________ is a policy that is defined by the issuing organization's responsibilities when issuing the certificates, including identifying the organization issuing the certificates, what the certificates will be used for, the process used when assigning the certificates, how the certificates are revoked, and how the certificates are protected.

Q: Why should you consider configuring delta CRLs on your CA?

Q: To use a CAPolicy.inf file, what must you do?

Q: By default, how are requests processed that are submitted to a Standalone CA?