Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

70-640 exam > Section 6 - Chapter 15 > Flashcards

Section 6 - Chapter 15 Flashcards

1
Q

AD CS Role Services

A

Certificate Authority - issues and manages certs
CA Web Enrollment - allows users to: request and renew certs, retrieve CRLs, enroll for smart card certs
Online Responder - makes cert revocation data accessible
Network Device Enrollment Service - certs for routers and other hardware
Cert Enrollment Web Services - enroll and renew certs when computer does not belong to domain or is outside security boundary
Cert Enrollment Web Policy Service - policy based auto enroll cert enroll web service users, provides policies not certs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Comparison

Publish CA config to AD DS

A

Stand Alone - optional

Enterprise - mandatory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Comparison

CA Cert Data Integration w/ AD DS Forests

A

Stand Alone - optional, manual process

Enterprise - mandatory and automatic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Comparison

CRL publication in AD DS Forest

A

Stand Alone - optional, manual process

Enterprise - mandatory and automatic, includes delta CRLs and cross certificates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Comparison

AD DS Forest pub assigned per template level as an attribute of the template

A

Stand Alone - n/a

Enterprise - supported

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Comparison

Web Enrollment for cert requests and validation

A

Stand Alone - supported

Enterprise - supported

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Comparison

Cert MMC for request and validation

A

Stand Alone - n/a

Enterprise - supported

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Comparison

Cert requests thru http or https

A

Stand Alone - supported

Enterprise - supported

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Comparison

Cert requests thru RPC and DCOM

A

Stand Alone - n/a

Enterprise - default mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Comparison

V1 templates with custom object identifiers (OID) as source of certs

A

Stand Alone - Default

Enterprise - n/a

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Comparison

V2 & V3 templates - can be customized and duplicated

A

Stand Alone - n/a

Enterprise - default

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Comparison

User input during cert requests

A

Stand Alone - manual

Enterprise - retrieved from AD DS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Comparison

Supported enrollment methods

A

Stand Alone - automatic or pending for all templates

Enterprise - automatic or pending, applied on a per template basis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Comparison

Cert approval process

A

Stand Alone - manual

Enterprise - manual or auto thru AD DS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Comparison

Cert Publishing

A

Stand Alone - manually to client or CA, AD DS thru custom policy module

Enterprise - depends on cert type and setting, can be auto enrolled in clients cert store and pub’d in AD DS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Comparison

Cert Publishing and manangement thru AD DS

A

Stand Alone - n/a

Enterprise - supported

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Deployment Options

A

Stand Alone - DC, Member Server or Stand Alone Server

Standard, Enterprise or Datacenter

Enterprise - DC or Member Server

Enterprise or Datacenter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

CPS - Certificate Policy Statement

A

Clear definition of who your company is
A list of your certificate policies
A general statement of proceedures used to issue, assign and revoke certs
A description of methods used to protect CAs
Revocation policy used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

AD CS New Features 2008 r2

A

Certificate Enrollment and Certificate Enrollment Policy Web Services

Certificate enrollment across forests

Better support for high-volume CAs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

AD CS Web Services

A

Cert enroll over http/https

Proxy between client and CA

Direct communication unnecessary

Allows enroll over internet and across forests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Functional Levels Needed for AD CS Web Services

A

Forest Functional Level 2008 r2

CA running 2003 and above

Client Computers Win 7

Cross Forest Enroll - CA running Enterprise or Datacenter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Cross Forest Enrollment

A

Two Way Trust

Forest Functional Level 2003

Issue Certs - forest functional level 2003

Enrollment - forest functional level 2008 r2

Clients do not need an update

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

High Volume CAs

A

Windows Server Network Access Protection (NAP) may require

Non persistant cert processing

Bypasses certain CA database operations - not storing each request record and issued cert

Improves performance and reduces CA operational costs

Can no longer revoke certs or manage CRLs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

AD CS Hosting Server Config

A

Multiple processors

Minimal RAM

Seperate disks for store on Root

Another disk for logs on Issuing

Medium key lengths

RAID balanced for reliability and performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Stand Alone Root CA - Installation

A

AD CS only role needed

Create new private key or use existing

Chose CN - name will be embedded in every subordinate cert issued by the chain, cannot change once installed

Set Validity Period

Select cert db and cert db log file paths

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Create a new private key

A

Only for internal networks

Select Cryptographic Service Provider (CSP)

Key Character Length

Hash Algorithm

Allow Admin Interaction When Private Key is Accessed by the CA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Using An Existing Key

A

Reinstalling Machine

Chained to 3rd Party, must be pre-installed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Roles That Can Be Installed AD CS

A

Certificate Authority

CA Web Enrollment

Online Responder

Network Device Enrollment Service

Certificate Enrollment Web Service

Certficate Enrollment Policy Web Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

CA Properties

General Tab

A

Name, cryptography, hash setting, view cert

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

CA Properties

Policy Module Tab

A

Properties - Request Handling

Pending, Admin Must Install
Follow Settings in Template or Automatic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

CA Properties

Exit Module

A

Windows Default - publishes certs when issued

Properties - allow certs to be pub’d to file system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

CA Properties

Extensions

A

CRL Distribution Point (CDP)
Authority Information Access (AIA)

Specify locations from which users can obtain a CRL

Publishing options

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

CA Properties

Storage

A

Shows if AD DS integrated

Paths to db and db logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

CA Properties

Certificate Managers

A

Can restrict Administrators, Domain Admins and Enterprise Admin rights or others who have been added thru the Security Tab

Allow or Deny

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

CA Properties

Auditing Options

A 
Back up and Restore
Changes to Configuration
Changes to Security Settings
Issue and Manage Cert Requests
Revoke Certs and Publish CRLs
Store and Retrieve Archive Keys
Start and Stop AD CS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

CA Properties

Security

A

Permissions

Read
Issue and Manage Certs (Local, Domain & Enterprise Admins)
Manage CA (Local, Domain and Enterprise Admins)
Request Certs (authenticated users)

Can added users or groups that can then be allowed or denied management rights on Certificate Management tab

37
Q

certutil

A
  • viewstore = verifies publication
  • dspublish = publishes a cert or CRL to AD
  • resubmit = resubmit a pending request
  • revoke = revoke a cert
  • CRL = publishes a new CRL
  • pulse = pulse autoenroll events
38
Q

Enterprise Issuing CA Install

A

CA and OR

Automatically adds: IIS and RSAT

Do not select Allow Admin Interaction - must be able to interact with all users needing certs

Make request for cert or save request and do manually, save to docs folder

39
Q

Adding Root CA cert to Issuing CA

A

On Root - rc Contoso-Root-CA, all tasks, submit new request, specify file location

rc Pending Requests, all tasks, Issue

rc, Issued Cert, Details tab, copy to > opens export wizard, chose format

40
Q

Export File Formats

A

DER encoded binary x.509 (.cer) - non Windows computers

Base-64 encoded x.509 (.cer) - support S/MIME, usually used for non-windows on servers

Cryptograph Message Syntax Standard - PKCS #7 - (.p7b) - transfers certs and their chained paths

Personal Info Exchange - PKCS #12 - (pfx) - transfers certs and their chained paths and transfer of private key as well as public

Microsoft Serialized Cert Store - transfers root certs from one computer to another

41
Q

Import Cert and Start Service on Issuing

A

rc Issuing-CA, all tasks, install CA cert

rc Issuing-CA. all tasks, start service

42
Q

CA Properties

Additional Tabs On Enterprise CAs

A

Enrollment Agents - can restrict enroll agents to certain certs and give allow or deny access

Recovery Agents - archive or do not archive when cert request includes key archival

43
Q

Prep for Install NDES

A

Create a service account identity

Server Manager, Config, Local Users and Groups, IIS_IURs Group > add service account identity

44
Q

Install NDES

A

Cannot be install at the same time as AD CS

rc AD CS, add role services

IIS automatically added

Specify service account identity as user

RA (registration authority) Setup - will assign and manage certs assigned to network devices

Config cryptography

Adds additional web files

45
Q

Credentials for AD CS Installation

A

Local Admin

46
Q

ORs

A

Responds to specific cert validation requests thru Online Cert Status Protocol (OCSP)

Relies on PKI

Does not need full CRL

Can request validation for a specific cert

OR decodes validation request sending back encrypted response

47
Q

Finalizing the Config of Issuing CA

A

Create certificate revocation config

Config and personalize cert templates

Config enrollment and issuance options

48
Q

Personalizing Templates

A

EFS - involves planning recovery agent

Wireless Networks - enforces strong authentication and encrypts all communications

Smart Cards - supports two-factor authentication

Website and Enabled e-commerce - web server certs, also can protect DCs and encrypt communication to and from

49
Q

Create Revocation Config for CA

A

Specify Cert Revocation List (CRL) distribution points

Config CRL and Delta CRL overlap periods

Schedule pub of CRLs

50
Q

CRL Distribution Point

A

Issuing CA, Properties, Extention Tab

drop down list set to CDP, publish CRLs and publish Delta CRLs to this lcoation check boxes

51
Q

Config CRL and Delta CRL Overlap Periods

A

certutil -setreg ca\CRLOverlapUnits value
certutil -setreg ca\CRLOverlapPeriod units
certutil -setreg ca\CRLDeltaOverlapUnits value
certutil -setreg ca\CRLDeltaOverlapPeriod units

52
Q

Config Pub of the CRLs

A

Issuing CA, Revoked Certificates, Properties

Set Pub Intervals CRL 1 week, Delta 1 day

For high throughput and high availibility decrease values

53
Q

Cert Templates Pub to AD DS

A

Must be connected to DC while working with the templates

54
Q

Working with Cert Templates

A

Select source template, rc, duplicate and select version of Windows

Name Template

Customize Template

Save Template

55
Q

Basic EFS Templates

A

Request Handling Tab

Archive Subject’s Encryption Private Key
Use Advanced Symmetric Algorithm to Send the Key to the CA

Subject Name Tab

Adds Alternative Subject Name Values

56
Q

EFS Recovery Agent Template

A

Publish Cert in AD

Use same settings on other tabs that were used on Basic EFS duplicate

57
Q

Network Policy Server (NPS) Template

A

Used for wireless networks

Create and config for autoenrollment

RAS and IAS Server Templates as source for NPS Template

Publish in AD

Security Tab - select RAS and IAS Servers group to assign Autoenroll and Enroll permissions

58
Q

Smartcard Logon and Smartcard User Templates

A

Name and publish in AD

Do not use autoenrollment for these, use smart card enrollment stations to distribute cards

59
Q

Web Server and Domain Controller Authentication Templates

A

Do not use DC template - made for earlier versions of OS

Name and publish in AD

60
Q

Issuing Templates

A

Issuing CA, Certificate Templates

rc Cert Templates, new, cert template to issue

Select cert template(s)

61
Q

Config Enrollment in GP

A

Must be assigned to all members of the domain

Computer Config or User Config \Policies\Windows Settings\Security Settings\Public Key Policies

dc Cert Services Client - Auto Enrollment

Enable

Renew expired, update pending, and remove revoked certs

Update Certs that use Cert Templates - if already issued certs manually

On User Config - can enable Expiration Notification

62
Q

Set Default Action for Issuing CA

A

rc Issuing CA server name, Properties

Policy Module Tab, Properties

Set to Pending, Admin must issue
or
Follow Cert Setting, otherwise Automatic

63
Q

Config of Online Responder

A

Config and Install OCSP Response Signing Cert

Config AIA extension support

Assign template to a CA

Enroll system to obtain cert

64
Q

OR Array

A

Two or more CAs acting as ORs

65
Q

Config OCSP Response Signing Cert

A

Duplicate cert and name

Publish in AD

Security Tab - Add CA server that hosts OR and give enroll and autoenroll permissions

66
Q

Config AIA Extension

A

rc Issuing CA, Properties, Extensions Tab

Extension drop down list - AIA

Specify locations to obtain revocation data

Include AIA Extension of Issued Cert
Include OCSP Extension

Cert Templates, new, cert templates to issue

Select OCSP Response Signing template to enable

67
Q

Verify OCSP cert assign to server

A 
Create MMC
Certs snap in
Computer Account
Local Computer
Save

Expand Cert\Personal, Certs, rc, request new cert

AD Enrollment Policy

Select new OCSP cert and click enroll

rc new cert, all task, Manage Private Key, Security Tab

Local server name in location, add Network Service, give full control permission

68
Q

Adding Revocation Config for OR

A

Online Responder, Revocation Config, rc, add

Assign a valid name - each revocation config tied to particular CA so use CA name in it

Select location - AD, local cert store or a file

Located Root CA in AD

Select signing method - auto, manually or CA cert uses cert from CA

Provider, Add under Base CRLs and Delta CRLs: http:\localhost\ca.crl

Repeat for each CA that is an OR

69
Q

AD CS & AD DS

A

Relies on LDAP to get infor from directory store

70
Q

AD CS & RSAT

A

To get MMC snap in to manage certs on Win 7 workstation select AD CS tools in RSAT tools

71
Q

Cross-Certification

A

Created to establish relationships between original cert and renewed root

72
Q

Exit Module

A

publish or send email notification

73
Q

Enterprise PKI
or
PKIView - command line

A

View status of deployment, entire PKI hierarcy and drill down into individual CAs to identify issues with config or operations

Can link to CAs quickly, rc CA, Manage CA

Access to Manage Templates

Access to Certs Container in AD DS

Icons show green (healthy), yellow (minor issues) and red (critical issues)

74
Q

Backing Up CAs

A

Cert Authority Backup Wizard

Select Items:
Private Key and CA Cert
Cert db and cert db log (full or incremental)

Identify backup location

Assign strong password

can also use certutil on the command line

75
Q

Restoring CAs

A

Cert Authority Restore Wizard

Stop CA service

Select items to restore:
Private Key and CA Cert
Cert db and db logs

Enter location of backup files

Provide password

Restart AD CS service

76
Q

Web Based Download Locations for CRL Distribution

A

CDP and AIA http locations

Must be created manually in IIS

Secondary locations needed for mobile or external users outside network, URLs specified must be available externallly

AD DS integrated deployment does not need web based secondary locations, directory service responsible for AIA and CRL distribution

77
Q

Web Support for CRLs

A

Points to CertEnroll vd under default website as CDP, not created by default, must create in IIS

78
Q

AD CS Servers Name and Role

A

After AD CS installed cannot change name or domain status (cannot be demoted from or promoted to DC)

79
Q

EFS

A

Encryption of NT File System, allows offline folders to maintain encryption sert on the server

80
Q

BitLocker

A

Vista or Win 7 - allows for entire hard drive, aside from some boot files, to be encrypted

81
Q

Base CRL and Delta CRL Overlap

A

The amount of time at the end of a published CRLs lifetime that a client can use to obtain a new CRL before the old CRL is considered unusable

The default value is 10% of the CRLs lifetime

82
Q

CRLs Lifetime

A

Revoked Certificates

CRL Publishing Parameters tab

Base default - 1 week

Delta default - 1 day

83
Q

Enterprise PKI - rc

A

Manage Templates
Manage AD Containers
Options - can set Cert, CRL and Delta CRL status to expiring

84
Q

Publish CRL Manually

A

rc Revoked Certificates

85
Q

4 Ways To Enroll For Certs

A

MMC Based Enrollment
Auto Enrollment
Web Based Enrollment
Manual Enrollment

86
Q

Cert Web Enrollment Services

Cert Web Enrollment Policy

A

Cert web enroll service enables users to obtain the cert web enroll policies which policies enable cert enroll when the client computer is not a member of or not currently connected to the domain

Also enables cross forest based cert enroll for Win 7 or 2008 r2 clients

87
Q

Cert Web Enroll & GP

A

Computer / User Config

Policies\windows settings\security policy\public key policies\certificate services client - certificate enrollment policy

88
Q

CA Web Enrollment

A

Provides a set of web pages that interact with a CA

Can be installed on a server that is not a CA to keep web traffic away from the CA

Install configs the computer as a enrollment registration authority

The CA used is called the TargetCA

If the CA Web Enrollment is installed on a computer that is not the Target CA, the computer account where it is installed must be trusted for delegation in order to present the client identity to the CA

70-640 exam (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions