PrepAway - Latest Free Exam Questions & Answers

Which four actions should you perform in sequence?

DRAG DROP
You network contains an Active Directory domain named contoso.com.
The domain contains an enterprise certification authority (CA).A user named Admin1 is a member of the Domain Admins group.
You need to ensure that you can archive keys on the CA. The solution must use Admin1 as a key recovery
agent.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of
actions to the answer area and arrange them in the correct order.
Select and Place:

PrepAway - Latest Free Exam Questions & Answers

Answer:

29 Comments on “Which four actions should you perform in sequence?”

  8. b0b says:

    – From the Certificate Templates console, modify the security of a certificate template
    – From the Certificate Authority console, add a certificate template to issue
    – From the Certificate console, request a certificate
    – From the Certificate Authority console, add a Key Recovery Agent Certificate




    16



    8
    1. Chris says:

      I agree with this one. Get the template, add the security account to match Admin1, ready your new template in the CA to be issued, Admin1 logs on and requests the certificate, then the certificate, once issued, is assigned as a KRA.




      1



      1
  11. battista says:

    I think should be:

    1. From the CA console, add a certificate template to issue
    2. From the Certificate console, request a certificate
    3. From the CA console, issue a pending request
    4. From the Ca console, add a KRA certificate




    6



    1
  12. davidcertifier says:

    I want to offer yet another solution after reading this page:
    https://social.technet.microsoft.com/wiki/contents/articles/7573.active-directory-certificate-services-pki-key-archival-and-management.aspx#Enrolling_a_Key_Recovery_Agent

    UNder the header “Enrolling a User with a KRA Certificate” it states these two things:
    1. A user may enroll for a certificate with a CA by using … or (though not recommended) via auto-enrollment.
    2. The KRA template is marked to be “pended” by the CA, which means that the certificate request must first be approved by a CA Administrator or a Certificate Manager before the KRA certificate is issued.

    Based on that, my solution would be:
    1. From the Certificate Templates console, modify the security of a certificate template.
    Why? Because we need to give Admin1 read & enroll permission (at least).
    2. From the Certification Authority console, add a certificate template to issue.
    Why? Next, we need to make the certificate available to request.
    3. From the Certificates Console, request a certificate.
    Why? Now Admin1 needs to request that certificate.
    4. From the Certification Authority console, issue a pending request.
    Why? Since we only edited the security of the template, it would still be “pended”, which means it still requires manual approval. Also, it’s a best practice, and Microsoft Exams are all about best practices.




    19



    1

Leave a Reply