wayground logo

Free Printable Worksheets

Font size

S
M
L
XL
Worksheets

Quiz 8,9,10 COOS295

Total questions: 110

Worksheet time: 55mins

Name
Class
Date
1.

Which AD CS role service provides a web-based interface for requesting and renewing certificates, commonly used for devices that are not domain-joined?

a)

Certification Authority

b)

Certification Authority Web Enrollment

c)

Online Responder

d)

Network Device Enrollment Service

2.

What is the primary purpose of the Certification Authority (CA) role in AD CS?

a)

To provide a web-based interface for certificate requests

b)

To issue certificates to users and computers

c)

To support network devices using SCEP

d)

To query information required to obtain a certificate

3.

Which of the following can increase the security of a CA by generating key pairs and securing the private key, preventing unauthorized certificate issuance?

a)

Trusted Platform Module (TPM)

b)

Hardware Security Module (HSM)

c)

Online Responder

d)

Certificate Enrollment Policy Web Service

4.

In the context of AD CS, what is a major risk associated with using a single CA?

a)

The CA becoming compromised and compromising the entire CA infrastructure

b)

Difficulty in certificate enrollment for non-domain devices

c)

Inability to support TPM key attestation

d)

Lack of certificate autoenrollment functionality

5.

Which of the following is an advantage of deploying an offline root CA?

a)

Easier to issue certificates to domain-joined devices

b)

Increased security by preventing network-based attacks

c)

Automatic publishing of the root CA's certificate in AD DS

d)

Simplified management of subordinate CAs

6.

Which role service in AD CS supports network devices that use SCEP?

a)

Certificate Enrollment Web Service

b)

Certification Authority Web Enrollment

c)

Network Device Enrollment Service

d)

Certificate Enrollment Policy Web Service

7.

What is the minimum key length recommended for a CA's public and private keys to ensure a higher level of security?

a)

1,024 bits

b)

2,048 bits

c)

3,072 bits

d)

4,096 bits

8.

Which tool is the primary graphical interface for managing Windows-based CAs?

a)

Certutil.exe

b)

Windows PowerShell

c)

Certification Authority console

d)

Group Policy Management Console

9.

What task can certutil.exe perform that the Certification Authority console cannot?

a)

Renew a CA certificate

b)

Publish CRL or certificate to AD DS

c)

Configure CA security

d)

Back up or restore a CA

10.

What Group Policy feature allows user certificates to move with users as they sign in to multiple computers?

a)

Certificate distribution

b)

Certificate path validation

c)

Credential roaming

d)

Autoenrollment

11.

Which role is responsible for managing certificates but cannot manage the CA itself?

a)

CA administrator

b)

Certificate manager

c)

Backup operator

d)

Auditor

12.

What default permission is assigned to the 'Authenticated Users' group on a CA?

a)

Read

b)

Request Certificates

c)

Issue and Manage Certificates

d)

Manage CA

13.

What is the primary function of the policy module on a CA?

a)

  • Publish certificates to a file or send SMTP notifications

b)

  • Perform actions after a certificate is issued

c)

  • Determine how a certificate request is processed

d)

  • Configure AIA and CDP locations

14.

What is the default action of the Windows default exit module on a CA?

a)

Publish certificates to a file

b)

Perform no actions

c)

Send SMTP notifications

d)

Integrate into a workflow-approval process

15.

Which protocol is recommended for AIA and CDP locations to ensure accessibility by domain-joined clients?

a)

FTP

b)

LDAP

c)

HTTP

d)

FILE

16.

What must you configure to enable SMTP notifications using the Windows default exit module?

a)

CDP locations

b)

SMTP server name

c)

Certificate template permissions

d)

AIA protocol

17.

What is the primary purpose of configuring AIA locations in certificates?

a)

To hold certificate requests for approval

b)

To identify where the CA certificate can be found

c)

To automatically provide certificates for users and computers

d)

To send email notifications upon certificate issuance

18.

What action is necessary when configuring AIA and CDP locations for an offline root CA?

a)

Use LDAP to publish certificates

b)

Manually copy files to the web server specified by the HTTP URL

c)

Automatically update CRLs

d)

Configure exit modules to send email notifications

19.

Which tool can be used to review the overall health of your PKI and read PKI information from AD DS?

a)

Certification Authority console

b)

Certutil.exe

c)

  • pkiview

d)

Windows PowerShell

20.

What is a limitation of the Certification Authority console?

a)

It can't review issued certificates

b)

It can't verify that the AD CS service is running

c)

It can only be used by Enterprise Admins

d)

It doesn't provide error notifications

21.

If a certificate includes www.adatum.com but you access a website at https://adatum.com, what issue might you encounter?

a)

Expired certificate

b)

Certificate trust error

c)

Revoked certificate

d)

Untrusted root CA

22.

When adding the Certificates snap-in to the Microsoft Management Console (MMC), what are you prompted to review?

a)

Only personal certificates

b)

Certificates for the local user, computer, or service

c)

Only certificates issued by the CA

d)

Only expired certificates

23.

What cmdlet can NOT be used in Windows PowerShell to test certificate validity?

a)

Certutil -store

b)

Certutil -verify

c)

Get-Certificate

d)

Test-Certificate

24.

What is required to install an enterprise CA?

a)

Membership in the local Administrators group

b)

Membership in the Backup Operators group

c)

Membership in Domain Admins or Enterprise Admins

d)

Membership in the Auditors group

25.

Why is it crucial to monitor the expiration dates for CA certificates?

a)

To update the OS regularly

b)

A CA cannot issue certificates beyond the expiration date of its own certificate

c)

To ensure compliance with corporate policies

d)

  • To renew certificates every month

26.

What should you do if a root CA certificate is close to expiration and subordinate CAs have a five-year certificate lifetime?

a)

Renew the subordinate CA certificates first

b)

Renew the root CA certificate at or just before five years of validity remain

c)

Distribute new trusted root certificates immediately

d)

Wait until the root CA certificate expires

27.

What is the first step required when renewing a subordinate CA certificate with an offline root CA?

a)

Restarting the subordinate CA service immediately

b)

Stopping the Active Directory Certificate Services service on the subordinate CA

c)

Generating new keys automatically

d)

Installing a new CA role on the offline root CA

28.

What must be done to move a root CA to another computer while ensuring existing certificates remain trusted?

a)

Rename the source CA immediately

b)

Follow the correct process to keep the CA identity intact

c)

Upgrade the OS on the source CA first

d)

Use new file paths for the certificate database and log on the target CA

29.

Why must the target CA have the same computer name as the source CA when moving a root CA?

a)

To simplify the OS upgrade

b)

To ensure continuity and trust in the CA identity

c)

To comply with naming conventions

d)

To avoid configuration errors

30.

What is NOT a reason to implement an offline root CA?

a)

Enhanced security for the PKI

b)

The network speeds are faster

c)

The root CA is less likely to be compromised

d)

It’s easier to recover from a compromised subordinate CA

31.

Why is it important configure AIA and CDP locations correctly?

a)

  • If clients can’t use the AIA and CDP locations specified, they might not trust the certificate

b)

  • To reduce the size of the CRL

c)

  • To speed up the certificate issuance process

d)

  • To make certificate templates more accessible

32.

How long should an offline root CA certificate be valid for?

a)

The same duration as subordinate CA certificates

b)

For one year only

c)

For the lifetime of the certificate database

d)

Longer than the lifetime of subordinate CA certificates

33.

What uniquely identifies both users and computers in a certificate?

a)

SAN

b)

FQDN

c)

UPN

d)

IP address

34.

Which certificate key is known only to the certificate owner?

a)

Public key

b)

Session key

c)

Private key

d)

Symmetric key

35.

What does a CA use to verify the requester's identity in environments using AD DS?

a)

Firewall rules

b)

AD DS authentication

c)

Network policies

d)

User profiles

36.

Where are certificate templates stored in AD DS?

a)

User partition

b)

Domain partition

c)

Configuration partition

d)

Schema partition

37.

Which schema version does NOT support the certificate Autoenroll permission?

a)

Schema version 1

b)

Schema version 2

c)

Schema version 3

d)

Schema version 4

38.

What is the recommended renewal period for a certificate relative to its validity period?

a)

10 percent

b)

15 percent

c)

20 percent

d)

25 percent

39.

How does a certificate template’s major version number increment?

a)

When you choose the Reenroll All Certificate Holders option

b)

When a new template is created

c)

When the template is deleted

d)

When the template permissions are changed

40.

What role service can be used to submit a certificate request and download the response via a web interface?

a)

IIS Manager

b)

Exchange Admin Console

c)

CA Web Enrollment

d)

Group Policy Management Console

41.

Which command can be used to generate a certificate request file?

a)

netsh.exe

b)

certreq.exe

c)

ipconfig.exe

d)

ping.exe

42.

Where can you review the tasks that trigger autoenrollment on clients?

a)

Event Viewer

b)

Task Scheduler

c)

Performance Monitor

d)

Disk Management

43.

Who can request certificates on behalf of other users or devices?

a)

System Administrator

b)

Enrollment Agent

c)

Security Manager

d)

Network Administrator

44.

What additional permission is required, along with Read and Enroll, for a user or computer to obtain a certificate via autoenrollment?

a)

Autoenroll

b)

Write

c)

Full Control

d)

Execute

45.

What is the purpose of revoking a certificate?

a)

To renew it

b)

To extend its expiration date

c)

To invalidate it before its expiration

d)

To encrypt it

46.

What is the consequence if a CA certificate is revoked?

a)

Only the CA certificate is affected

b)

The CA continues to issue new certificates

c)

All certificates issued by that CA are no longer trusted

d)

The CA becomes read-only

47.

What is a more efficient alternative to CRLs for checking certificate status?

a)

OCSP

b)

HTTP

c)

HTTPS

d)

SMTP

48.

Where should a Key Recovery Agent (KRA) certificate and its private key be stored?

a)

In the user's Documents folder

b)

On a public file share

c)

In a secure location with limited access

d)

On the CA server

49.

What is the primary use of a certificate's private key in the context of key archival and recovery?

a)

To sign emails

b)

To authenticate users

c)

To establish VPN connections

d)

To decrypt data

50.

What protocol is commonly used to encrypt network communication between a server and a client?

a)

SSL

b)

FTP

c)

HTTP

d)

TLS

51.

Which property must be included in a TLS certificate for it to be trusted by a web browser?

a)

CN

b)

OU

c)

SAN

d)

C

52.

What should you do to ensure your certificate is automatically trusted by external clients?

a)

Create a self-signed certificate

b)

Purchase a certificate from a public CA

c)

Use a private CA

d)

Only use HTTP

53.

What type of certificate is used to verify the authenticity of programs and scripts?

a)

Client certificate

b)

Code-signing certificate

c)

Server certificate

d)

S/MIME certificate

54.

What protocol is commonly used to send encrypted and digitally signed emails?

a)

POP3

b)

IMAP

c)

SMTP

d)

S/MIME

55.

What does a BitLocker recovery key decrypt?

a)

The symmetrical key

b)

The public key

c)

The private key

d)

The hash value

56.

What does a mobile device management solution typically issue to devices as part of initial registration?

a)

A password

b)

A digital signature

c)

A certificate

d)

  • A recovery key

57.

Which feature in Windows allows users to authenticate using biometrics such as face recognition or a fingerprint?

a)

Credential Manager

b)

Windows Hello for Business

c)

BitLocker

d)

EFS

58.

Which permissions do you need to assign on a certificate template to support autoenrollment?

a)

Read

b)

Enroll

c)

Autoenroll

d)

Execute

59.

When you implement TLS, where do you need to install the certificate

a)

On the server

b)

On the client

c)

On the router

d)

On the firewall

60.

How do you set the schema version for a certificate template?

a)

It is automatically configured based on the compatibility settings you select

b)

It is created manually through the certification console and based on the operating system version

c)

Schema versions are not required for certificate templates

d)

The schema version must set the same as defined in the network policy settings on the local firewall

61.

What encryption method does S/MIME use for the message content?

a)

Asymmetric encryption

b)

Symmetrical encryption

c)

Digital signature

d)

Hashing

62.

What is the primary purpose of establishing federated trust between partner organizations using AD FS?

a)
Resource access
b)

Data encryption

c)

  • Load balancing

d)

Data backup

63.

Which protocol is used for communication in federated trust relationships established by AD FS?

a)

FTP

b)

Telnet

c)

HTTPS

d)

SSH

64.

What type of claims can AD FS use for claims-based authentication?

a)

SSL claims

b)

DNS claims

c)

IP claims

d)

Identity claims

65.

Which of the following is NOT a type of claim used by AD FS?

a)

Identity claims

b)

Group claims

c)

Custom claims

d)

Role claims

66.

What is the difference between federated trust and AD DS domain trust?

a)

Federated trust uses direct communication between domain controllers

b)

AD DS domain trust uses HTTPS for communication

c)

Federated trust requires opening multiple ports besides port 443

d)

Federated trust does not require direct communication between domain controllers

67.

Which of the following is NOT a feature of AD FS in Windows Server?

a)

Web SSO

b)

Web-services interoperability

c)

Built-in email client

d)

Enhanced security

68.

In the context of AD FS, what does WAP stand for?

a)

Web Application Proxy

b)

Windows Application Proxy

c)

  • Web Access Protocol

d)

  • Wide Area Protocol

69.

What improvements were introduced in AD FS for Windows Server 2019 and 2022?

a)

Protected logins

b)

Security improvements

c)

New Authentication/Policy capabilities

d)

Sign-in SSO improvements

e)

Integrated firewall solutions

70.

How does AD FS handle authentication requests in a business-to-business federation?

a)

By directly connecting domain controllers of different organizations

b)

By using VPN connections between organizations

c)

By issuing group policies across organizations

d)

By establishing a federation trust and exchanging claims

71.

Which feature of AD FS enables interoperability with non-Microsoft environments?

a)

Passive client support

b)

WS-Federation

c)

Extensible architecture

d)

Enhanced security

72.

What is the primary function of a Federation server in an AD FS deployment?

a)

To act as a backup server for AD DS

b)

To manage and validate DNS requests

c)

To issue, manage, and validate identity claims

d)

To store user attributes

73.

Where is the Web Application Proxy (WAP) typically deployed in an AD FS environment?

a)

Inside the internal network

b)

In a perimeter network

c)

As part of the domain controller

d)

On the same server as the Federation server

74.

What functionality do Claims rules provide in AD FS?

a)

They act as a firewall

b)

They manage network connectivity

c)

They determine how federation servers process claims

d)

They store user passwords

75.

What is included in a Relying party trust?

a)

DNS configuration data

b)

Network firewall rules

c)

Names, groups and rules

d)

User authentication logs

76.

Which of the following is a critical requirement for an AD FS deployment?

a)

Network connectivity

b)

Deployment of an additional DNS server

c)

Use of third-party firewalls

d)

Installation of a secondary AD DS domain

77.

Why is DNS critical in an AD FS deployment?

a)

It manages certificates

b)

It helps clients locate applications and federation services

c)

It stores user credentials

d)

It issues claims

78.

What is the primary purpose of a service communication certificate in an AD FS deployment?

a)

To store user passwords

b)

To manage DNS records

c)

To establish an SSL connection for AD FS service communication

d)

To configure endpoint settings

79.

What happens if a token-signing certificate is not changed after the initial AD FS server configuration?

a)

In most cases, it does not need to be changed

b)

The server will fail to authenticate users

c)

The certificate will automatically renew

d)

The server will lose its ability to communicate with clients

80.

What type of certificate does AD FS use to encrypt user tokens?

a)

Service communication certificate

b)

Token-signing certificate

c)

Token-decrypting certificate

d)

Claims provider certificate

81.

What is the primary benefit of deploying a federation server farm in an AD FS environment?

a)

Reducing server costs

b)

Enhancing data encryption

c)

Simplifying DNS configuration

d)

Establishing load balancing and high availability

82.

Which deployment method is recommended for ensuring high availability for AD FS proxy components in the perimeter network?

a)

Installing additional domain controllers

b)

Using Network Load Balancing (NLB)

c)

Deploying additional DNS servers

d)

Configuring multiple service communication certificates

83.

What is a critical requirement for achieving high availability of the AD FS configuration database when using Microsoft SQL Server?

a)

Using Windows Internal Database (WID)

b)

Deploying additional AD FS servers

c)

Configuring multiple DNS servers

d)

Implementing failover clustering for the SQL database

84.

What information does the AD FS Capacity Planning spreadsheet return based on expected usage data?

a)

Required SSL certificate configurations

b)

Recommended optimal number of federation servers

c)

DNS settings for external access

d)

Encryption keys for token-signing

85.

What is one of the key advantages of deploying AD FS in Azure?

a)

Increased local network traffic

b)

Reduced security measures

c)

Cross-geo redundancy

d)

Simplified token signing

86.

An AD FS claim is:

a)

A statement about a user that is used for authentication and authorization.

b)

A type of firewall setting in Windows Server.

c)

A method for encrypting network traffic.

d)

A protocol for file sharing in Active Directory.

87.

What uniquely identifies each AD FS claim type?

a)

User ID

b)

Claim Value

c)

Security Token

d)

Uniform Resource Identifier (URI)

88.

How can AD FS populate claim values?

a)

Retrieve from an attribute store.

b)

Store values in a JSON file.

c)

Use an encrypted token.

d)

Configure static values manually.

89.

Which type of claim rule defines the relationship between an AD FS server and a claims provider?

a)

Issuance transform rules

b)

Claim rules for a claims provider trust

c)

Delegation authorization rules

d)

Issuance authorization rules

90.

What tool can be used to configure settings for a relying party trust?

a)

AD FS Management Console

b)

Group Policy Editor

c)

Claims Transformation Tool

d)

Add Relying Party Trust Wizard

91.

What must be prepared before starting the AD FS service configuration?

a)

Database

b)

Service account

c)

Certificate

d)

DNS configuration

92.

What is recommended to be used as the service account for AD FS?

a)

Local user account

b)

Domain admin account

c)

  • Group-managed service accounts

d)

  • Guest account

93.

What type of DNS record should be created for a federation server farm?

a)

CNAME record

b)

MX record

c)

A record

d)

TXT record

94.

What cmdlet is used to deploy the first federation server in an AD FS farm using PowerShell?

a)

Add-AdfsServer

b)

Install-AdfsFarm

c)

Add-AdfsFarmNode

d)

Start-AdfsConfiguration

95.

What is an account partner in a business-to-business AD FS scenario?

a)

An organization where user accounts are stored and authenticated

b)

An organization that provides web hosting services

c)

An organization that manages DNS records

d)

An organization that issues SSL certificates

96.

What is the resource partner in a business-to-business AD FS scenario responsible for?

a)

Issuing claims

b)

Processing security tokens and consuming claims

c)

Managing user accounts

d)

Configuring network printers

97.

What can be used to create more complex claim rules in AD FS if templates are not sufficient?

a)

AD FS Management Console

b)

AD FS claim rules language

c)

Group Policy Editor

d)

Event Viewer

98.

How can the home realm discovery process be initiated without prompting the user?

a)

By using a third-party authentication service

b)

By modifying the link for the web application to pass the "whr" parameter

c)

Through manual user selection

d)

Via hardware-based authentication

99.

Which tool can be used to review certificate expiration dates for AD FS services?

a)

Exchange Management Shell

b)

AD DS Console

c)

AD FS Management console

d)

Group Policy Management Console

100.

How can the home realm discovery process be initiated without prompting the user?

a)

  • By using a third-party authentication service

b)

  • By modifying the link for the web application to pass the "whr" parameter

c)

  • Through manual user selection

d)

  • Via hardware-based authentication

101.

Which tool can be used to review certificate expiration dates for AD FS services?

a)

  • Exchange Management Shell

b)

  • Group Policy Management Console

c)

  • AD FS Management console

d)

  • AD DS Console

102.

How frequently are new token-signing certificates generated through automatic certificate rollover in AD FS?

a)

  • Every quarter

b)

  • Every year

c)

  • Every two years

d)

  • Every six months

103.

What PowerShell command is used on a secondary federation server to change its role to primary?

a)

  • Add-AdfsSyncProperties -Role PrimaryServer

b)

  • Update-AdfsServer -Role Primary

c)

  • Set-AdfsSyncProperties -Role PrimaryComputer

d)

  • Change-AdfsServerRole -Primary

104.

Which of the following is a prerequisite for deploying Web Application Proxy?

a)

  • A perimeter network

b)

  • A properly configured firewall

c)

  • An AD FS deployment

d)

  • A VPN client configured

105.

What key benefit does AD FS preauthentication provide over pass-through preauthentication?

a)

  • Enables SSO functionality

b)

  • Lowers latency

c)

  • Reduces the need for DNS configuration

d)

  • Allows access without any credentials

106.

What feature of Azure AD Application Proxy allows organizations to control user sign-ins based on conditions like user location and device type?

a)

  • Centralized security management

b)

  • Conditional Access App Control functionality

c)

  • Single Sign-On (SSO)

d)

  • Manual firewall configurations

107.

True or False: A federated trust is the same as a forest trust that organizations can configure between AD DS forests.


a)

  • True

b)

False

108.

True or False: In Windows Server, the federation server proxy functionality is part of the Web Application Proxy role.


a)

True

b)

False

109.

Which of the following statements about configuring the Web Application Proxy is true? (Choose all that apply.)


a)

  • To install the Web Application Proxy, you first must implement AD FS in your organization.

b)

  • To install the Web Application Proxy, you don’t have to implement AD FS in your organization.

c)

  • You must configure an external and internal server URL for each application you publish.

d)

  • When you define the external URL, you must also select a certificate that contains the hostname

110.

Which step occurs first when a user tries to access Microsoft 365 services via AD FS?*

a)

  • The user is prompted for credentials by AD FS

b)

  • The user sends an HTTPS request to the Microsoft 365 web service

c)

  • The user is redirected to the on-premises federation server

d)

  • The Microsoft online services federation server creates a new token

Similar Resources on Wayground

Repaso Premaraton

110 questions

Repaso Premaraton

quiz

Worksheet

•

University

REVISÂO DE PROJETOS DE JOGOS

109 questions

REVISÂO DE PROJETOS DE JOGOS

quiz

Worksheet

•

University

Java Final exam (comprog2)

114 questions

Java Final exam (comprog2)

quiz

Worksheet

•

University

deep learning

106 questions

deep learning

quiz

Worksheet

•

University

ict 2

112 questions

ict 2

quiz

Worksheet

•

University

BA Comp1 Prefinal Examination Reviewer

110 questions

BA Comp1 Prefinal Examination Reviewer

quiz

Worksheet

•

University

COMPTIA ITF+ Practice Quiz - Domain 1

109 questions

COMPTIA ITF+ Practice Quiz - Domain 1

quiz

Worksheet

•

University

Lập trình hướng đối tượng

105 questions

Lập trình hướng đối tượng

quiz

Worksheet

•

University