DRAG DROP
Your network contains an Active Directory domain named adatum.com. The domain contains three
servers. The servers are configured as shown in the following table.
Server1 is configured as shown in the exhibit. (Click the Exhibit button.)
Template1 contains custom cryptography settings that are required by the corporate security team.
On Server2, an administrator successfully installs a certificate based on Template1.
The administrator reports that Template1 is not listed in the Certificate Enrollment wizard on
Server3, even after selecting the Show all templates check box.
You need to ensure that you can install a server authentication certificate on Server3. The certificate
must comply with the cryptography requirements.
Which three actions should you perform in sequence?
To answer, move the appropriate three actions from the list of actions to the answer area and
arrange them in the correct order.
Answer: See the explanation
Explanation:
Box 1:
Box 2:
Box 3:
Note:
Duplicate an existing template, modify the Compatibility Settings (to Windows Server 2008), and
modify the Request Handling settings.
Box1 – OK, Box2 – OK, Box3 – WRONG
Box3 – From Certification authority, click NEW, and the Certificate template to issue.
1- Duplicate Certificate
2- Modify Compatibility to 2008
3- Issue new Certificate
Also, if you duplicate base template, modify COMPATIBILITY to:
CA:2012R2 and Cer.recipient:Win8.1/WinServ2012R2,
and APPLY those settings, you CAN’T lower compatibility settings lower than:
CA:WinSer2012 and Cer.recipient:Win8/WinServ2012.
So, there’s no way to use existing template to make it available to WinServ2008R2 (no way to do it), unless you do DUPLICATE TEMPLATE of that or any other template, suitable for your needs.
Those saying that REQUEST HANDLING should me modified, I’d like them to explain what setting should me modified so template appear as a choice on Windows Server2008/2008R2.
BTW, tested in lab all settings, answer is like I stated above.
1
0
Agreed. You have to issue the certificate otherwise it’s just another object in the certificate templates mmc, no user can enroll unless you issue it.
0
0