Module Assessment

1.

A workgroup Windows server on the internet needs initial certificate enrollment and unattended renewal while its private key remains in a trusted platform module. Which approach should an administrator use?

Use native certificate policy and enrollment web services over HTTPS with controlled bootstrap, then use certificate-based renewal.

Publish the certification authority remote procedure call endpoint directly to the internet.

Use certification authority web enrollment as an unattended renewal service.

2.

A remote client retrieves certificate enrollment policy successfully, but request submission fails. What has already been proven?

The certificate request was accepted and issued by the certification authority.

Policy discovery and template visibility have been proven, but enrollment service authentication, transport, delegation, certification authority access, and disposition still require testing.

The client can communicate directly with the certification authority over remote procedure call.

3.

A network device registration service uses one broad general-purpose template and exposes its administrative challenge endpoint to the internet. Which change is most important?

Grant the service account enrollment permission on every published template.

Replace one-time challenges with a reusable shared challenge.

Use narrow templates with required usages, restrict subject data, protect service credentials, and limit the challenge endpoint to authorized management systems.

4.

certreq.exe returns a request identifier and a pending disposition. Why does immediately accepting issued.cer fail?

No issued certificate exists yet; an authorized approval must occur before retrieving the same request from the same certification authority.

The request must be recreated with an exportable private key.

The certificate must be accepted on the certification authority first.

5.

Autoenrollment reports no eligible templates, but a certification authority administrator can enroll manually. What is the most likely testing problem?

The certification authority must always be restarted after publishing a template.

The test used an administrator identity instead of the target user or computer identity.

Autoenrollment can process only certificates that use exportable private keys.

6.

A renewed certificate has a different thumbprint from its predecessor. What does this result prove?

It proves that the private key was rotated.

It proves that the relying service is using the new certificate.

It proves only that the certificate is different; compare provider, key container, or public-key material to determine whether the key changed.

7.

A team proposes certification authority web enrollment because it accepts certificate signing requests over HTTPS. Why is this approach insufficient for automated remote enrollment?

Request transport alone doesn't provide native policy discovery, automated provisioning, provider orchestration, renewal lifecycle, endpoint failover, or enrollment service delegation behavior.

Web enrollment can issue only certificates that contain no subject alternative names.

Web enrollment requires the private key to be generated on the certification authority.

Feedback