This best practice for nesting groups is known as

• IGDLA

• IDGLA

• IGLAD

• IAGDL

__________________enable administrators con figure users, service accounts and computers within the same security scope to apply the same authentication policy

• Authentication policy container

• Authentication policy silo

• Authentication policy scope

• Authentication access control policy

Which of the following statements are true regarding smart cards? (choose 3)

• Smart cards provide an option for multifactor authentication

• Smart cards cannot be used for interactive sign in

• Smart cards contain a certificate and private key that can only be accessed by using a PIN

• Smart cards provide enhanced security beyond a password

• Smart cards can only be used for digital signature and encryption

TRUE OR FALSE?

An account lockout threshold setting ensures that users are allowed only that many invalid sign-inattempts

• True

• False

You are the AD CS administrator for A. Datum. You want to enable your AD DS users to perform digital signature and encryption using certificates from your internal PKI. Which of the following steps are required?

• Enable a key recovery agent

• Enable a data recovery agent

• Publish the User certificate template and configure the desired groups of users for auto-enrollment

• Enable EFS on AD DS domain computers by using Group Policy

• Upgrade all AD DS domain computers to Windows Server 2016 or Windows 10

TRUE OR FALSE

Managed service accounts provide managed password changes that do not require administrator intervention

• True

• False

Which of the following are true statements regarding the use of certificates in a business environment? (Choose 3 )

• Certificates can be used to encrypt HTTP traffic between a web server and browser

• Certificates can be used to digitally sign documents

• Digitally signed documents are invalidated if the contents are modified

• To send encrypted e-mail to an external recipient who is not part of your internal PKI, you must use an encryption certificate issued by a public CA

• Files encrypted using Encrypting File System (EFS) can only be read by the individual who first encrypted the file

TRUE OR FALSE

Both User account names and passwords are case sensitive

• True

• False

Which of the following actions must you take to configure key archival on an AD CS CA? (Choose 4)

• Configure the KRA certificate template

• Enroll a designated user for a KRA certificate

• Publish the KRA public key by using Group Policy

• Configure a recovery agent on the CA

• Configure desired certificate templates for key archival

When deploying AD FS SSO, where do you need deploy the application Proxy Server?

• Internal network

• External network

• Perimeter network

• Anywhere