DRAG DROP
Yournetwork contains an Active Directory domain named adatum.com. The domain contains three
servers. The servers are configured as shown in the following table.
Server1 is configured as shown in the exhibit. (Click the Exhibit button.)
Template1 contains custom cryptography settings that are required by the corporate security team.
On Server2, an administrator successfully installs a certificate based on Template1.
The administrator reports that Template1 is not listed in the Certificate Enrollment wizard on
Server3, even after selecting the Show all templates check box.
You need to ensure that you can install a server authentication certificate on Server3. The certificate
must comply with the cryptography requirements.
Which three actions should you perform in sequence?
To answer, move the appropriate three actions from the list of actions to the answer area and
arrange them in the correct order.
Answer: See the explanation
Explanation:
<map><m x1=”3″ x2=”395″ y1=”61″ y2=”122″ ss=”0″ a=”0″ /><m x1=”2″ x2=”396″
y1=”133″ y2=”190″ ss=”0″ a=”0″ /><m x1=”9″ x2=”393″ y1=”202″ y2=”258″ ss=”0″ a=”0″ /><m
x1=”5″ x2=”393″ y1=”266″ y2=”321″ ss=”0″ a=”0″ /><m x1=”3″ x2=”394″ y1=”334″ y2=”394″ ss=”0″
a=”0″ /><m x1=”4″ x2=”394″ y1=”400″ y2=”462″ ss=”0″ a=”0″ /><m x1=”413″ x2=”807″ y1=”46″
y2=”126″ ss=”1″ a=”0″ /><m x1=”414″ x2=”805″ y1=”140″ y2=”229″ ss=”1″ a=”0″ /><m x1=”415″
x2=”806″ y1=”241″ y2=”322″ ss=”1″ a=”0″ /><c start=”4″ stop=”0″ /><c start=”2″ stop=”1″ /><c
start=”1″ stop=”2″ /></map>
Box 1:
Box 2:
Box 3:
Note:
Duplicate an existing template, modify the Compatibility Settings (to Windows Server 2008), and
modify the Request Handling settings.
Answer is not compl,etely correct.
Box 1 : correct
Box 2 : correct
Box 3 : incorrect. If you Duplicate a template, you must Issue the new template. So correct answer here would be : From Certification Authority, click New and then click Certificate to Issue.
3
0
I agree with Franc , Box 3 should be Certificate to Issue
0
0
you already have this certificate template.
so you do not need to duplicate it .
you just edit its properties .
you do not need to issue again !!!
you only need to change compatibility 0f template
0
1
WRONG.
“Template1 is not listed in the Certificate Enrollment wizard on Server3, even after selecting the Show all templates check box.”
This is most likely because there’s a compatibility set on the cert to be for 2012 or higher, which is why the 2008 server can’t request the cert. You have to duplicate it, then issue it.
0
0
df may be right with just changing the compatibility level, BUT: I don’t see appropriate given actions around this possible solution when you want to use the same template!
that’s why Franc’s solution is right (and given answer Box 3 is wrong!)
1
0
I am leaning towards the provided answer.
Template1 has already been issued to the CA (since Server2 can install it).
Duplicate, change compatibility, and issue to CA.
I don’t see any need to change request handling.
The simplest solution would be a pick 1 which would be just to adjust compatibility on the template.
1
1
Looking into this via my server lab with an enterprise Root CA, I really had to think this through logically.
First of all, you cannot change any settings in the CA itself, you have to go into the Certificate Templates to change the compatibility settings (at least in this case). So the third step HAS to be “From the CA, click NEW and then click Certificate Template to Issue”. Any changes to the templates must be reissued.
Here’s where it got tricky for me. If it were me, I would just go into the templates and modify Template1 as it is, modify the Compatibility settings and then reissue it. But that’s only two steps (delete current certificate is not an option here, otherwise that would make the third step in my scenario).
So thinking about it, what if Microsoft’s intention here is that you need as much of the template as possible in Server 2012 R2 mode, and you need another certificate for the 2008 R2 mode which doesn’t have as much as Server 2012 R2 mode?
So going with that, I would think the intention here is to duplicate Template1, name it something like “Template1-2008R2” for the 2008R2 webserver, and then change the compatibility mode and issue that certificate. So on Server 1 and 2, you have Template1 and on Server3 you have Template1-2008R2.
My answer would be:
1) duplicate template
2) change compatibility settings
3) New – Certificate Template to Issue
3
0
Correction, only Server 2 is getting “Template1”, not Server1 and 2. I got a little carried away lol
0
0