70-299 Implementing and Administering Security in a Microsoft Windows Server 2003 Network Training Boot Camp

Demo Question 8.

You are a security administrator for EliteCertify.com. The network consists of a single Active Directory domain named EliteCertify.com. All servers run Windows Server 2003. All client computers run Windows XP Professional. EliteCertify.com hosts an extranet Web site that allows employees from a partner company to access confidential information over the Internet. You want to require the partner company employees to use certificate-based authentication to access the extranet Web site. You have a public key infrastructure (PKI), which consists of a stand-alone root certification authority (C

A. and an enterprise subordinate C The partner company does not have a PKI. You decide to issue certificates from your CA hierarchy to the partner company employees. The partner company certificates will require a different certificate policy than the policy currently used for issuing certificates to internal employees. Certificate revocation checking will be used during certificate-based authentication. You need to implement the necessary PKI changes to comply with these requirements. You want to achieve this goal by using the minimum amount of administrative effort. Which three actions should you perform? (Each correct answer presents part of the solution. Choose THREE. ) Use a new subordinate CA in your CA hierarchy to issue certificates to partner company employees and to the extranet Web server.
B. Use the eixisting subordinate CA in your CA hierarchy to issue certificates to partner company employees and to the extranet Web server.
C. Add the certificate of the root CA to the Trusted Root Certification Authorities store on the partner company's computers.
D. Add the certificate of the subordinate CA to the Trusted Root Certification Authorities store on the partner company's computers.
E. Create new HTTP Authority Information Access (AI paths and certificate revocation list (CRL) distribution points that specify locations on the extranet Web site.
F. Create new LDAP Authority Information Access (AI paths and certificate revocation list (CRL) distribution points that specify locations on the extranet Web site.


Display Answer

Answer: A, C, E

Explanation: