You have an Exchange 2010 organization. Your company's security policy states that all connections to Outlook Web App (OWA) must use smart card authentication. You need to recommend a solution to…

The correct answer is A. Require certificate-based authentication for all Internet-facing Client Access servers. D. Deploy a server that runs Microsoft Internet Security and Acceleration (ISA) Server and. We need to enable certificate-based authentication in IIS for the server itself. The first step it to open IIS, then navigate to the server node. Select Authentication under the IIS heading, then after selecting Active Directory Client Certificate Authentication, choose Enable…

Designing Client Access Servers

Question

You have an Exchange 2010 organization. Your company's security policy states that all connections to Outlook Web App (OWA) must use smart card authentication. You need to recommend a solution to meet the security policy requirements. Which two possible ways to achieve this goal should you recommend? (Each correct answer presents a complete solution. Choose two.)

Exhibit

Options

ARequire certificate-based authentication for all Internet-facing Client Access servers.
BRequire Windows Integrated Authentication for all Internet-facing Client Access servers.
CDeploy an Edge Transport server and then disable Windows Integrated Authentication.
DDeploy a server that runs Microsoft Internet Security and Acceleration (ISA) Server and

How the community answered

(35 responses)

A
74% (26)
B
17% (6)
C
9% (3)

Explanation

We need to enable certificate-based authentication in IIS for the server itself. The first step it to open IIS, then navigate to the server node. Select Authentication under the IIS heading, then after selecting Active Directory Client Certificate Authentication, choose Enable: The second step is to enable certificate-based authenticate for the website. C:\WINDOWS\SYSTEM32\INETSRV\APPCMD.EXE set config "Default Web Site"- webServer/security/authentication/clientCertificateMappingAuthentication /enabled:"True" /commit: apphost Third, from EMC select the Client certificate authentication options; ISA Server 2006 introduces support for Kerberos constrained delegation to enable published Web servers to authenticate users by Kerberos after their identity has been verified by ISA Server using a non-Kerberos authentication method. When used in this way, Kerberos constrained delegation eliminates the need for requiring users to provide credentials twice. For example, because it is unrealistic to perform Kerberos authentication over the Internet, SSL certificates might be used for authenticating users at the ISA Server computer. After ISA Server verifies the user's identity, ISA Server cannot pass the SSL client certificate provided by the user to a published server, but it can impersonate the user and obtain a Kerberos service ticket for authenticating the user (client) to a published Web server.

Topics

#smart card authentication#certificate-based authentication#OWA#ISA Server

Community Discussion

No community discussion yet for this question.

Full 70-663 Practice