Title: Quiz 8
Course: CTS 2392 Configuring Advanced Windows 2012 Services > Section: Module 8

Q: What are the contents of the certificate chain?
- It is a list of all trusted root certificates
- It is a list of certificate authorities that can be used to authenticate an entity certificate
- It is a list of all trusted root certificate authorities
- It is a list of certificates that can be used to authenticate an entity certificate
A: It is a list of certificates that can be used to authenticate an entity certificate
If right: The certificate chain, also known as the certification path, is a list of certificates used to authenticate an entity. It begins with the certificate of the entity and ends with the root CA certificate.
If wrong: The certificate chain, also known as the certification path, is a list of certificates used to authenticate an entity. It begins with the certificate of the entity and ends with the root CA certificate.

Q: By default, how often are group policies refreshed for domain members?

Q: To configure key archival on a certificate template, what option will you need to enable?

Q: What is the function of an enrollment agent?

Q: What PKI related service is used for network devices such as switches and routers to enroll for an X.509 digital certificate from a CA?

Q: Which of the following represents the correctly formatted command to recover the keys from the CA database?
- certutil –getkey 2BD06947947609FEF46B8D2E40A6F7474D7F085E c:\outfile
- certutil –recover jdoe@contoso.local c:\outfile
- certutil –exportBlob 2BD06947947609FEF46B8D2E40A6F7474D7F085E c:\outfile
- certutil –getkey E491A9091F91DB1E4750EB05ED5E79842DEB36A2574C55EC8B1989DEF94B6CF507AB223002E8183EF85009D37F41A898F9D1CA669C246B11D0A3BBE41B2AC31F959E7A0CA4478B5BD4163733CBC40F4DCE1469D1C91972F55D0ED57F5F9BF22503BA558F4D5D0DF1643523154B15591DB394F7F69C9ECF50BAC15850678F08B420F7CBAC2C206F70B63F01308CB743CF0F9D3DF32B49281AC8FECEB5B90ED95E1CD6CB3DB53AADF40F0E00920BB121162E74D53C0DDB6216ABA37192475355C1AF2F41B3F8FBE370CDE6A34C457E1F4C6B50964189C474620B10834187338A81B13058EC5A04328C68B38F1DDE6573FF675E65BC49D8769F331465A17794C92D c:\outfile
A: certutil –getkey 2BD06947947609FEF46B8D2E40A6F7474D7F085E c:\outfile
If right: You will need to use the certutil –getkey <serial number> c:\outfile command to perform the initial export from the CA database. The other option that has the correct command is actually using the public key of the certificate, not the serial number of the certificate.
If wrong: You will need to use the certutil –getkey <serial number> c:\outfile command to perform the initial export from the CA database. The other option that has the correct command is actually using the public key of the certificate, not the serial number of the certificate.

Q: In what folder of the Certificates MMC snap-in would you find the certificate belonging to your Enterprise Subordinate CA?

Q: When performing key recovery as a KRA, in what format will you retrieve the key from the database?
- Base64-encoded X.509
- DER-encoded binary X.509
- Personal Information Exchange (PKCS #12)
- Cryptographic Message Syntax Standard (PKCS #7)
A: Cryptographic Message Syntax Standard (PKCS #7)
If right: When you need to recover a certificate key, you will first retrieve the PKCS #7 BLOB from the database and then convert the file to a PKCS #12 (.pfx).
If wrong: When you need to recover a certificate key, you will first retrieve the PKCS #7 BLOB from the database and then convert the file to a PKCS #12 (.pfx).

Q: To recover a key from the CA database using the certutil utility, what information will you need to know about the certificate?
- The password for the private keys
- The certificate serial number
- The certificate subject name
- The certificate key length
A: The certificate serial number
If right: You will need to locate the certificate serial number for the certificate using the Certification Authority console.
If wrong: You will need to locate the certificate serial number for the certificate using the Certification Authority console.

Q: As a security precaution, what should you do immediately after you have configured a CA to issue a KRA certificate?
- Configure the ACL on the template with the specific security principals who will be designated KRAs
- Perform a backup of the CA database
- Perform a backup of the server’s system state
- Publish a new Certificate Revocation List (CRL)
A: Configure the ACL on the template with the specific security principals who will be designated KRAs
If right: When you have configured CA to issue a KRA certificate, any user with Read and Enroll permission on the KRA certificate template can enroll and become a KRA. You should assign the KRA certificate to trusted users only.
If wrong: When you have configured CA to issue a KRA certificate, any user with Read and Enroll permission on the KRA certificate template can enroll and become a KRA. You should assign the KRA certificate to trusted users only.

Q: What must you do immediately after issuing the first KRA certificate to a trusted user to enable key archival and recovery on the CA? (Choose all that apply)
- Restart the CA
- Configure key archival on the CA properties
- Archive the keys for the issued KRA certificate
- Perform a backup of the CA database
A: Configure key archival on the CA properties; Archive the keys for the issued KRA certificate
If right: If you hadnt configured key archival ahead of time, you need to do that immediately (before you forget and before disaster strikes!), then youll possibly also need to manually archive the keys for the KRA certificate(s) you just issued. Going forward, the CA will automatically archive the keys once the configuration has been made.
If wrong: If you hadnt configured key archival ahead of time, you need to do that immediately (before you forget and before disaster strikes!), then youll possibly also need to manually archive the keys for the KRA certificate(s) you just issued. Going forward, the CA will automatically archive the keys once the configuration has been made.

Q: In addition to the permissions required on the certificate templates used for autoenrollment, what other requirements must be met to support autoenrollment in your organization? (Choose all that apply)
- The certificate template must be a version 3 or higher
- The issuing CA must be a standalone CA
- DNS must be configured to support autoenrollment
- Group Policy must be configured to support autoenrollment
A: The issuing CA must be a standalone CA; Group Policy must be configured to support autoenrollment
If right: Most certificates will be assigned through autoenrollment and are deployed using group policies. Autoenrollment can be applied only to enterprise CA (not standalone CA), and you have to deploy schema template version 2 or higher.
If wrong: Most certificates will be assigned through autoenrollment and are deployed using group policies. Autoenrollment can be applied only to enterprise CA (not standalone CA), and you have to deploy schema template version 2 or higher.

Q: What is the name of the objects that are used to enforce the rights a user or group has on rights-protected content?
- Protections policy templates
- Rights policy templates
- Restrictions policy templates
- Rights protection templates
A: Rights policy templates
If right: Rights policy templates, also known as RMS templates, are used to enforce the rights that a user or group has on rights-protected content.
If wrong: Rights policy templates, also known as RMS templates, are used to enforce the rights that a user or group has on rights-protected content.

Q: To enable mobile devices running Windows Mobile 6 and above operating systems to obtain certificates and licenses for their users, you will need to edit the NTFS permissions of a file. What file must you edit the permissions for?
- MobileDeviceConfiguration.asmx
- WindowsMobileADRMSConfiguration.asmx
- MobileDeviceParticipate.asmx
- MobileDeviceCertification.asmx
A: MobileDeviceCertification.asmx
If right: You will need to grant the user account object of the AD RMS-enabled mobile application and the AD RMS Service Group “Allow Read and Read & Execute” permissions on the MobileDeviceCertification.asmx file located in the C:\Inetpub\wwwroot\_wmcs\Certification folder.
If wrong: You will need to grant the user account object of the AD RMS-enabled mobile application and the AD RMS Service Group “Allow Read and Read & Execute” permissions on the MobileDeviceCertification.asmx file located in the C:\Inetpub\wwwroot\_wmcs\Certification folder.

Q: What is configured so that servers in an AD RMS cluster can grant use licenses to another forest or organization?
- A trusted user domain
- A trusted publishing domain
- A trusted cross certification domain
- A trusted foreign domain
A: A trusted publishing domain
If right: By default, servers in an AD RMS cluster can issue use licenses only against the publishing licenses issued by servers in the cluster. If your organization has another AD RMS root cluster located in another forest or in another separate organization, you can set up a trust relationship between AD RMS clusters so that it can grant use licenses to the other forest or organization. Trust relationships are created by configuring a trusted publishing domain (TPD).
If wrong: By default, servers in an AD RMS cluster can issue use licenses only against the publishing licenses issued by servers in the cluster. If your organization has another AD RMS root cluster located in another forest or in another separate organization, you can set up a trust relationship between AD RMS clusters so that it can grant use licenses to the other forest or organization. Trust relationships are created by configuring a trusted publishing domain (TPD).

Q: What tools provided in Windows Server 2012 allow you to view the SCP configuration in Active Directory? (Choose all that apply)
- Active Directory Users and Computers
- ADSI Edit
- LDP
- SCP Edit
A: ADSI Edit; LDP
If right: An SCP can be viewed using ADSI Edit or LDP.
If wrong: An SCP can be viewed using ADSI Edit or LDP.

Q: Instead of setting up trusted publishing domains or trusted user domains, what other method could you use to allow foreign users to use your AD RMS environment?
- Federated RMS Identity
- Forefront Identity Manager
- AD RMS External Trustees
- Federated Identity Support
A: Federated Identity Support
If right: Federated Identity Support allows user accounts to use credentials established by a federated trust relationship using Active Directory Federation Services (AD FS) instead of setting up trusted publishing domains or trusted user domains. When used with AD FS, users obtain rights account certificates from an AD RMS cluster.
If wrong: Federated Identity Support allows user accounts to use credentials established by a federated trust relationship using Active Directory Federation Services (AD FS) instead of setting up trusted publishing domains or trusted user domains. When used with AD FS, users obtain rights account certificates from an AD RMS cluster.

Q: Why is it generally recommended to not delete an RMS template that has previously been used to assign rights to documents?
- The documents will revert to the default permissions for their location
- The documents will revert to the permissions they had before RMS was applied
- The documents will become inaccessible to all users except the super users group
- The documents will become accessible to all users, including those who previously had no rights
A: The documents will become inaccessible to all users except the super users group
If right: It is recommended that you do not delete templates. If you do delete a template, any document that uses the template will become inaccessible to everyone except the members of the super users group.
If wrong: It is recommended that you do not delete templates. If you do delete a template, any document that uses the template will become inaccessible to everyone except the members of the super users group.

Q: Generally speaking, what could be considered the absolute minimum rights that a user could be granted via AD RMS that would allow the user to still consume the document?
- View
- Edit
- Save
- Extract
A: View
If right: The View right allows the user the ability to view the document, which is the most restrictive you can get while still allowing the user some ability to use and consume the document.
If wrong: The View right allows the user the ability to view the document, which is the most restrictive you can get while still allowing the user some ability to use and consume the document.

Q: Which AD RMS template right would be required to allow a user the ability to use part of the contents of the protected document in a new document?
- Export (Save As)
- Save
- Extract
- Edit
A: Extract
If right: Extract allows the user to copy data from the file. If this right is not granted, the user cannot copy data from the file.
If wrong: Extract allows the user to copy data from the file. If this right is not granted, the user cannot copy data from the file.

Q: How many AD RMS root certification clusters can exist within the Active Directory forest?

Q: What is the default validity period of the Server licensor certificate?

Q: What is the default validity period of Rights Account Certificates?

Q: A Temporary Rights Account Certificate has a validity period of how long?
- 15 minutes
- 1 hour
- 4 hours
- 1 day
A: 15 minutes
If right: A temporary RAC has a validity time of 15 minutes.
If wrong: A temporary RAC has a validity time of 15 minutes.

Q: What happens if a user has not been assigned AD RMS rights?