Lesson 10: Maintaining Network Health
Multiple Choice
1.In a PKI, each user/computer possesses a piece of information that is known only to the individual user or computer that is called a ______.
a) public key
b) private packet
c) private key
d) shared secret key
2. Which digital document contains identifying information about a particular user, computer, service, and so on?
a) digital signature
b) digital certificate
c) certificate revocation list
d) smart card
3. Which of the following provides a detailed explanation of how a particular Certification Authority manages certificates and keys?
a) smartcard
b) certificatetemplate
c) Certificate Revocation List
d) Certificate Practice Statement
4. Which service responds to requests from clients concerning the revocation status of a particular certificate, sending back a digitally signed response indicating the certificate’s current status?
a) Web enrollment
b) Network Device Enrollment Service
c) Online Responder
d) Simple Certificate Enrollment Protocol
5. Which CA integrates with an Active Directory domain and can use certificate templates to allow autoenrollment of digital certificates, as well as store the certificates themselves within the Active Directory database?
a) standalone
b) enterprise
c) subordinate
d) none of the above
6. Certificate templates can be used to automate the deployment of PKI certificates by controlling the ______.
a) security settings associated with each template
b) user settings associated with each template
c) configuration settings associated with each template
d) networking settings associated with each template
7. Which security role is tasked with issuing and managing certificates, including approving certificate enrollment and revocation requests?
a) CA Administrator
b) Certificate Manager
c) Backup Operator
d) Auditor
8. Which of the following is not a privilege granted to certificate managers?
a) modify Certificate Revocation List (CRL) publication schedules
b)recover archived keys
c) issue, approve, deny, revoke, reactivate, and renew certificates
d) read records and configuration information in the CA database
9. To indicate the health status of a particular SHA, each SHA creates what kind of statement that it transmits to the NAP Agent?
a) System Health Agent
b) Statement of Health
c) Statewide Statement of Health
d) System Statement of Health
10. Who maintains information about the health of the NAP client computer and transmits information between the NAP Enforcement Clients and the System Health Agents?
a) Health Registration Authority
b) System Health Agent
c) NAP Agent
d) System Health Validator
11. A server that operates the NAP Enforcement Server components is referred to as a NAP______.
a) Agent
b) enforcement point
c) enforcement server
d) none of the above
12. Depending on the enforcement method in use, a NAP enforcement point can take a number of different forms, such as what?
a) 802.1X-capable Wireless Access Point for 802.1X enforcement
b) Health Registration Authority (HRA) that can obtain health certificates from client computers when the IPSec enforcement method is used
c) Windows Server 2008 DHCP server for the DHCP enforcement method
d) All of the above
13.To distribute the load of issuing certificates in a geographically dispersed location, an organization can have one or more ______CAs.
a) intermediate
b) subordinate
c)standalone
d) enterprise
14. Which enforcement method allows authorized remote users to connect to resources on an internal corporate or private network from any Internet-connected device?
a) Internet Protocol Security (IPSec) enforcement
b) VPN enforcement
c) 802.1X enforcement
d) Terminal Services Gateway (TS Gateway) enforcement
15. The IPSec NAP enforcement method relies on which type of PKI certificate to perform its enforcements?
a) IPSec certificate
b) NAP certificate
c) health certificate
d) recovery certificate
16. The NPS service combines each Statement of Health Response into what?
a) System Statement of Health Response
b) System Statement of Health Requirement
c) Statement of Health Requirement
d) System Statement of Health Policy
17. Whatis an optional component that can be deployed to allow non-compliant client computers to achieve network compliance and gain network access?
a) enforcement server
b) health policy server
c) health requirement server
d) remediation server
18. Which feature enables users to request their own PKI certificates, typically through a Web browser?
a) self-enrollment
b) recoveryagents
c) autoenrollment
d) Web enrollment
19. What feature allows users or computers to manually request a certificate based a template?
a) Enroll ACL
b) Write ACL
c) Read ACL
d) Autoenroll ACL
20. Which element of Active Directory Certificate Services utilizes the Online Certificate Status Protocol to act in response to client requests?
a) NDES
b) subordinate CA
c) Certificate Revocation List
d) Online Responder
.
True/False
21.DHCP is the only NAP enforcement method that can be deployed in a non-Active Directory environment.
22. If a client cannot provide the necessary health certificate, they will still be able to participate in IPSec-secured traffic.
23. Windows Server 2008, Windows Vista, and Windows XP with Service Pack 3 all have a built-in NAP client, and third-party vendors can use the NAP API to write additional clients for additional operating systems, such as Macintosh and Linux computers.
24. DHCP enforcement is the least secure enforcement method because a user can simply configure their computer with a static IP configuration to bypass any DHCP enforcement method that is in place.
25. Depending on the configuration item that is being monitored for compliance, autoremediation may not be possible.
Fill-in-the-Blank
26. Group Policy can be used to establish ______settings for an Active Directory domain.
27. ______is an extremely flexible command-line utility for administering Active Directory Certificate Services.
28. NAP can perform ______if it detects that the client is out of compliance.
29. The top-level CA in any PKI hierarchy is the ______CA.
30. A(n)______CA integrates with an Active Directory domain, and it can use certificate templates to allow autoenrollment of digital certificates, as well as store the certificates themselves within the Active Directory database.
31. Simple Certificate Enrollment ______allows network devices to enroll for PKI certificates.
32. The ______service combines each Statement of Health Response into a System Statement of Health Response (SSOHR).
33. Windows Server 2008, Windows Vista, and Windows XP with Service Pack 3 all have a built-in NAP client, and third-party vendors can use the NAP ______to write additional clients for additional operating systems, such as Macintosh and Linux computers.
34. Enforcement ______receive information from the Enforcement Clients on each client, which is then consumed by other components of the NAP server-side architecture.
35. To deploy the DHCP enforcement mechanism within Network Access Protection, you must first deploy a(n)______server running Windows Server 2008.
Short Answer
36. The new Active Directory Certificate Services (AD CS) role in Windows Server 2008 is a component within Microsoft’s larger what?
37. PKI consists of a number of elements that allow two parties to communicate securely without any previous communication through the use of a mathematical algorithm called what?
38. Users can use a smart card to authenticate to an Active Directory domain, access a Website, or authenticate to other secured resources through the use of what type of physical device that attaches to a workstation?
39. What is the network protocol that allows network devices to enroll for PKI certificates?
40. Certification Authority Web Enrollment allows users to manually request certificates using a Web interface, which is located where by default on a CA that is running the Certification Authority Web Enrollment role service?
41. An escrow copy of a private key can be restored by one or more of what item?
42. What solution controls access to corporate network resources based on the identity of the computer attempting to connect to the resource, as well as the connecting computer’s compliance with corporate policies and standards like patching levels and Windows Firewall configurations?
43. What is the name of the specially configured PKI certificates used by the Internet Protocol Security (IPSec) enforcement method that are issued to clients that meet defined compliance standards?