Your company has an Active Directory domain.
You install an Enterprise Root certification authority （CA） on a member server named Server1. You need to ensure that only the Security Manager is authorized to revoke certificates that are supplied by Server1.
What should you do（）
A.Remove the Request Certificates permission from the Domain Users group.
B.Remove the Request Certificates permission from the Authenticated Users group.
C.Assign the Allow - Manage CA permission to only the Security Manager user account.
D.Assign the Allow - Issue and Manage Certificates permission to only the Security Manager user account.
您可能感兴趣的试卷
你可能感兴趣的试题
Your company has a server that runs Windows Server 2008 R2. Active Directory Certificate Services （AD CS） is configured as a standalone Certification Authority （CA） on the server. You need to audit changes to the CA configuration settings and the CA security settings.
Which two tasks should you perform（）
A.Configure auditing in the Certification Authority snap-in.
B.Enable auditing of successful and failed attempts to change permissions on files in the %SYSTEM32%\CertSrv dire
C.Enable auditing of successful and failed attempts to write to files in the %SYSTEM32%\CertLog directory.
D.Enable the Audit object access setting in the Local Security Policy for the Active Directory Certificate Services
You have a Windows Server 2008 R2 Enterprise Root CA . Security policy prevents port 443 and port 80 from being opened on domain controllers and on the issuing CA .
You need to allow users to request certificates from a Web interface. You install the Active Directory Certificate Services （AD CS） server role.
What should you do next（）
A.Configure the Online Responder Role Service on a member server.
B.Configure the Online Responder Role Service on a domain controller.
C.Configure the Certificate Enrollment Web Service role service on a member server.
D.Configure the Certificate Enrollment Web Service role service on a domain controller.
You have a Windows Server 2008 R2 that has the Active Directory Certificate Services server role installed.
You need to minimize the amount of time it takes for client computers to download a certificate revocation list （CRL）.
What should you do（）
A.Install and configure an Online Responder.
B.Install and configure an additional domain controller.
C.Import the Root CA certificate into the Trusted Root Certification Authorities store on all client workstations.
D.Import the Issuing CA certificate into the Trusted Root Certification Authorities store on all client workstations.
Your company has an Active Directory forest. You plan to install an Enterprise certification authority （CA） on a dedicated stand-alone server.
When you attempt to add the Active Directory Certificate Services （AD CS） server role， you find that the Enterprise CA option is not available.
You need to install the AD CS server role as an Enterprise CA.
What should you do first（）
A.Add the DNS Server server role.
B.Join the server to the domain.
C.Add the Web Server （IIS） server role and the AD CS server role.
D.Add the Active Directory Lightweight Directory Services （AD LDS） server role.
You have an Active Directory domain that runs Windows Server 2008 R2. You need to implement a certification authority （CA） server that meets the following requirements：
- Allows the certification authority to automatically issue certificates - Integrates with Active Directory Domain Services
What should you do（）
A.Install and configure the Active Directory Certificate Services server role as a Standalone Root CA .
B.Install and configure the Active Directory Certificate Services server role as an Enterprise Root CA .
C.Purchase a certificate from a third-party certification authority. Install and configure the Active Directory Certificate S
D.Purchase a certificate from a third-party certification authority. Import the certificate into the computer store of the sc
Your network consists of a single Active Directory domain. All domain controllers run Windows Server 2008 R2.
You need to capture all replication errors from all domain controllers to a central location.
What should you do（）
A.Configure event log subscriptions.
B.Start the System Performance data collector set.
C.Start the Active Directory Diagnostics data collector set.
D.Install Network Monitor and create a new capture.
Your network consists of a single Active Directory domain.？ All domain controllers run Windows Server 2008 R2.
You need to identify the Lightweight Directory Access Protocol （LDAP） clients that are using the largest amount of available CPU resources on a domain controller.
What should you do（）
A.Review performance data in Resource Monitor.
B.Review the Hardware Events log in the Event Viewer.
C.Run the LAN Diagnostics Data Collector Set. Review the LAN Diagnostics report.
D.Run the Active Directory Diagnostics Data Collector Set. Review the Active Directory Diagnostics report
You need to validate whether Active Directory successfully replicated between two domain controllers.
What should you do（）
A.Run the DSget command.
B.Run the Dsquery command.
C.Run the RepAdmin command.
D.Run the Windows System Resource Manager.
You create 200 new user accounts. The users are located in six different sites. New users report that they receive the following error message when they try to log on： "The username or password is incorrect."
You confirm that the user accounts exist and are enabled. You also confirm that the user name and password information supplied are correct.
You need to identify the cause of the failure. You also need to ensure that the new users are able to log on.
Which utility should you run（）
A.Rsdiag
B.Rstools
C.Repadmin
D.Active Directory Domains and Trusts
You need to identify all failed logon attempts on the domain controllers.
What should you do（）
A.Run Event Viewer.
B.View the Netlogon.log file.
C.Run the Security Configuration Wizard.
D.View the Security tab on the domain controller computer object.
最新试题
Your network contains two Active Directory forests named contoso.com and nwtraders.com. A two-way forest trust exists between contoso.com and nwtraders.com. The forest trust is configured to use selective authentication. Contoso.com contains a server named Server1. Server1 contains a shared folder named Marketing. Nwtraders.com contains a global group named G_Marketing. The Change share permission and the Modify NTFS permissions for the Marketing folder are assignes to the G_Marketing group. Members of G_Marketing report that they cannot accesss the Marketing folder. You need to ensure that the G_Marketing members can accesss the folder from the network. What should you do（）
You have an enterprise subordinate certification authority （CA）. The CA is configured to use a hardware security module. You need to back up Active Directory Certificate Services on the CA. Which command should you run（）
Your network contains an Active Directory forest. The forest contains two domain controllers. The domain controllers are configured as shown in the following table. All client computers run Windows 7. You need to ensure that all client computers in the domain keep the same time as an external time server. What should you do（）
You create a new Active Directory domain. The functional level of the domain is Windows Server 2008 R2. The domain contains five domain controllers. You need to monitor the replication of the group policy template files. Which tool should you use（）
You have an enterprise subordinate certification authority （CA）. You have a group named Group1. You need to allow members of Group1 to publish new certificate revocation lists. Members of Group1 must not be allowed to revoke certificates. What should you do（）
You have an enterprise subordinate certification authority （CA） configured for key archival. Three key recovery agent certificates are issued. The CA is configured to use two recovery agents. You need to ensure that all of the recovery agent certificates can be used to recover all new private keys. What should you do（）
You remotely monitor several domain controllers. You run winrm.exe quickconfig on each domain controller. You need to create a WMI script query to retrieve information from the bios of each domain controller. Which format should you use to write the query（）
Your network contains an Active Directory domain named contoso.com. The domain contains five domain controllers.You add a logoff script to an existing Group Policy object （GPO）. You need to verify that each domain controller successfully replicates the updated group policy. Which two objects should you verify on each domain controller（）
You have a domain controller named Server1 that runs Windows Server 2008 R2. You need to determine the size of the Active Directory database on Server1. What should you do（）
Your company has four offices. The network contains a single Active Directory domain. Each office has domain controller. Each office has an organitational unit （OU） that contains the user accounts for the users in that office. In each office， support technicians perform basic troubleshooting for the users in their respective office. You need to ensure that the support technicians can reset the password for the user accounts in their respective office only. The solution must prevent the thechnicians from creating user accounts. What shoul you do（）