MOC 20-742 - Part 2

Which of the following statements are true regarding smart cards? (choose 3)

• Smart cards provide an option for multifactor authentication

• Smart cards cannot be used for interactive sign in

• Smart cards contain a certificate and private key that can only be accessed by using a PIN

• Smart cards provide enhanced security beyond a password

• Smart cards can only be used for digital signature and encryption

TRUE OR FALSE?

An account lockout threshold setting ensures that users are allowed only that many invalid sign-inattempts

• True

• False

You are the AD CS administrator for A. Datum. You want to enable your AD DS users to perform digital signature and encryption using certificates from your internal PKI. Which of the following steps are required?

• Enable a key recovery agent

• Enable a data recovery agent

• Publish the User certificate template and configure the desired groups of users for auto-enrollment

• Enable EFS on AD DS domain computers by using Group Policy

• Upgrade all AD DS domain computers to Windows Server 2016 or Windows 10

TRUE OR FALSE

Managed service accounts provide managed password changes that do not require administrator intervention

• True

• False

Which of the following are true statements regarding the use of certificates in a business environment? (Choose 3 )

• Certificates can be used to encrypt HTTP traffic between a web server and browser

• Certificates can be used to digitally sign documents

• Digitally signed documents are invalidated if the contents are modified

• To send encrypted e-mail to an external recipient who is not part of your internal PKI, you must use an encryption certificate issued by a public CA

• Files encrypted using Encrypting File System (EFS) can only be read by the individual who first encrypted the file

TRUE OR FALSE

Both User account names and passwords are case sensitive

• True

• False

Which of the following actions must you take to configure key archival on an AD CS CA? (Choose 4)

• Configure the KRA certificate template

• Enroll a designated user for a KRA certificate

• Publish the KRA public key by using Group Policy

• Configure a recovery agent on the CA

• Configure desired certificate templates for key archival

What Windows command can you use to force the immediate refresh of all GPOs on a client computer?

• Gpupdate /*

• Gpupdate /force

• Refresh /GPO

• GPO /now

What are the two main purposes of OUs? (choose 2)

• to provide a framework for delegations of administration

• to provide a place to store files

• to provide a structure to enable the targeted GPO deployment

• to provide a structure to enable PowerShell commands

What type of Active Directory accounts should we restrict password changes on?

• Managed Service accounts

• User accounts

• Computer accounts

• Bank accounts