You are tasked to enforce certificate based authentication onto all the domain-joined Windows machines within your organization. Based on the inventory record, there are 1000 Windows machines, which i

Question

Options

• ASet an expiration date defining when the code should expire.
• BSpecify the maximum number of devices that can be enrolled.
• CDefine the enrollment code to only the specific office/VPN IP network segment.
• DDefine that only Linux machines may be enrolled.

• A
  77% (20)
• B
  12% (3)
• C
  4% (1)
• D
  8% (2)

Explanation

Setting an expiration date on the enrollment code directly limits the attack window - once the deadline passes, the code becomes invalid, preventing unauthorized or belated use even if the code is leaked or intercepted. This is the core security control for the enrollment code itself, making it time-bound and reducing the risk of misuse throughout the rollout.

Why the distractors are wrong:

• B (max device count) controls quantity, not authorization - a bad actor could still enroll 850 unauthorized machines before the limit is hit.
• C (IP network restriction) sounds appealing but merely mirrors a constraint already stated in the scenario (enrollment is already scoped to office/VPN); it doesn't verify the identity of individual endpoints and any machine on that network segment could still register.
• D (Linux only) is the opposite of the goal - the task involves Windows machines exclusively.

Memory tip: Think of the enrollment code like a coupon - the most important security property is an expiration date, not where it's redeemed. Time-bounding a credential limits blast radius if it's ever compromised, which is why expiry is the foundational control.

No community discussion yet for this question.