GSLC · Question #236
Mark works as a Network Administrator for NetTech Inc. The company has a Windows 2003 Active Directory domain-based network. The domain consists of four domain controllers, six Windows 2003 member…
The correct answer is C. Configure key archival on certificate authority (CA). Configuring key archival on the CA allows private keys to be backed up and recovered when user profiles are lost, restoring access to EFS-encrypted files. No other option addresses the root cause of lost private keys.
Question
Mark works as a Network Administrator for NetTech Inc. The company has a Windows 2003 Active Directory domain-based network. The domain consists of four domain controllers, six Windows 2003 member servers, and 500 Windows XP Professional client computers. The PKI infrastructure is already configured on the network. The current configuration of the network allows only managers to use EFS on local computers. Sometimes Mark faces problems when managers lose their private keys due to the user profile becoming corrupt or being lost. Due to this, the files that were persistently encrypted by using the corresponding public key are inaccessible. He wants to restore access to the encrypted files as quickly as possible. What will he do to accomplish the task?
Options
- AAsk the managers to log on to the network with a new user account.
- BRename all the encrypted files and ask the managers to open the files.
- CConfigure key archival on certificate authority (CA).
- DAsk the managers to use the Distributed file system (Dfs) to encrypt important files.
How the community answered
(26 responses)- A4% (1)
- B4% (1)
- C81% (21)
- D12% (3)
Why each option
Configuring key archival on the CA allows private keys to be backed up and recovered when user profiles are lost, restoring access to EFS-encrypted files. No other option addresses the root cause of lost private keys.
Creating a new user account generates a new key pair that cannot decrypt files encrypted with the original user's public key, leaving the files permanently inaccessible.
Renaming encrypted files does not affect the EFS encryption metadata or the key required for decryption; the files remain inaccessible regardless of their name.
Key archival is a Windows CA feature that stores a copy of a user's private key on the CA at certificate enrollment time. When a manager loses their private key due to profile corruption, an administrator can retrieve and restore the archived key, allowing decryption of files that were encrypted using the corresponding EFS certificate - without needing the original user profile.
The Distributed File System (DFS) provides a unified namespace for shared folders but has no capability to recover EFS private keys or decrypt files.
Concept tested: EFS private key recovery using CA key archival
Source: https://learn.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/configure-the-cdp-and-aia-extensions-on-ca1
Topics
Community Discussion
No community discussion yet for this question.