Exam 70-744 topic 1 question 70 discussion

Actual exam question from Microsoft's 70-744

Question #: 70
Topic #: 1

Your network contains an Active Directory domain named contoso.com. The domain contains a certification authority (CA).
You need to implement code integrity policies and sign them by using certificates issued by the CA.
You plan to use the same certificate to sign policies on multiple computers.
You duplicate the Code Signing certificate template and name the new template CodeIntegrity.
How should you configure the CodeIntegrity template?

A. Enable the Allow private key to be exported setting and modify the Key Usage extension.
B. Disable the Allow private key to be exported setting and modify the Application Policies extension.
C. Disable the Allow private key to be exported setting and disable the Basic Constraints extension.
D. Enable the Allow private key to be exported setting and enable the Basic Constraints extension

Show Suggested Answer

Suggested Answer: D 🗳️
References:
https://blogs.technet.microsoft.com/ukplatforms/2017/05/04/create-code-integrity-signing-certificate/

by Kamikazekiller at Aug. 9, 2020, 2:54 p.m.

Comments

Submit Cancel

Kamikazekiller

Highly Voted 4 years, 9 months ago

Correct

upvoted 5 times

...

Timock

Most Recent 4 years, 3 months ago

The basic constraint is an X.509 certificate v3 extension. This extension describes whether the certificate is a CA certificate or an end entity certificate. In the certificate shown above, basic constraints extension is selected and the Subject Type = CA means it is CA certificate. In this case not the end entity which is also an option but CA. Answer: D

upvoted 1 times

...

SamsOtro

4 years, 5 months ago

Correct answer is: D. Enable the Allow private key to be exported setting and enable the Basic Constraints extension

upvoted 3 times

...

KidCastaldo

4 years, 6 months ago

Given reference seems to support D.