70-648 · Question #55
Your network contains a single Active Directory domain. The domain contains an enterprise certification authority (CA). You need to ensure that the encryption keys for e-mail certificates can be…
The correct answer is C. Issue the key recovery agent certificate template. certutil.exe recoverkeyrecovers archived keys, but the e-mail certificate template does not have key archival by default. So we need to create a recovery agent. However, this cannot be done until we issue the recovery agent template. The AIA extension specifies where to find…
Question
Your network contains a single Active Directory domain. The domain contains an enterprise certification authority (CA). You need to ensure that the encryption keys for e-mail certificates can be recovered from the CA database. You modify the e-mail certificate template to support key archival. What should you do next? Microsoft 70-648 Exam
Options
- ARun certreq.exe -policy
- BRun certutil.exe -recoverkey
- CIssue the key recovery agent certificate template
- DModify the location of the Authority Information Access (AIA) distribution point
How the community answered
(50 responses)- A6% (3)
- B8% (4)
- C72% (36)
- D14% (7)
Explanation
certutil.exe recoverkeyrecovers archived keys, but the e-mail certificate template does not have key archival by default. So we need to create a recovery agent. However, this cannot be done until we issue the recovery agent template. The AIA extension specifies where to find up-to-date certificates for the CA. certreq.exe -policyThis command sets the policy for a request(...)If you type the certreq - policywithout any additional parameter it will open a dialog window so you can select the
Topics
Community Discussion
No community discussion yet for this question.