Exam 70-417 topic 1 question 636 discussion

HOTSPOT -
Your network contains one Active Directory domain. The domain contains an enterprise certification authority (CA). You need to ensure that members of a group named Group1 can issue certificates for the User certificate template only.
Which two tabs should you use to perform the configuration? To answer, select the appropriate tabs in the answer area.
Hot Area:

Suggested Answer:
To configure certificate manager restrictions for a CA
1. Open the Certification Authority snap-in, and right-click the name of the CA.
2. Click Properties, and then click the Security tab.
3. Verify that the user or group that you have selected has Issue and Manage Certificates permission. If they do not yet have this permission, select the Allow check box, and then click Apply.
4. Click the Certificate Managers tab.
5. Click Restrict certificate managers, and verify that the name of the group or user is displayed.
6. Under Certificate Templates, click Add, select the template for the certificates that you want this user or group to manage, and then click OK. Repeat this step until you have selected all certificate templates that you want to allow this certificate manager to manage.
7. Under Permissions, click Add, type the name of the client for whom you want the certificate manager to manage the defined certificate types, and then click
OK.
8. If you want to block the certificate manager from managing certificates for a specific user, computer, or group, under Permissions, select this user, computer, or group, and clickDeny.
9. When you are finished configuring certificate manager restrictions, click OK or Apply.
References: https://technet.microsoft.com/en-us/library/cc753372.aspx