Exam 70-742 topic 1 question 220 discussion

Actual exam question from Microsoft's 70-742

Question #: 220
Topic #: 1

You network contains an Active Directory domain named contoso.com. The domain contains an enterprise certification authority (CA) named CA1.
You have a test environment that is isolated physically from the corporate network and the Internet.
You deploy a web server to the test environment. On CA1, you duplicate the Web Server template, and you name the template Web_Cert_Test.
For the web server, you need to request a certificate that does not contain the revocation information of CA1.
What should you do first?

A. From the properties of CA1, allow certificates to be published to the file system.
B. From the properties of CA1, select Restrict enrollment agents, and then add Web_Cert_Test to the restricted enrollment agent.
C. From the properties of Web_Cert_Test, assign the Enroll permission to the guest account.
D. From the properties of Web_Cert_Test, set the Compatibility setting of CA1 to Windows Server 2016.

Show Suggested Answer

Suggested Answer: D 🗳️
The option ג€Do not include revocation information in issued certificates checkboxג€ is only available with the compatibility mode set to Windows Server 2008 R2 or later.
References:
http://techgenix.com/certificate-revocation-checking-test-labs/

by renatovieira at Sept. 17, 2019, 6:08 p.m.

Comments

Submit Cancel

TMW

Highly Voted 5 years, 8 months ago

This appears to be correct. In my home lab, the option "Do not include revocation information in issued certificates" is grayed out. The compatibility settings are set to 2003 by default. After changing this to 2016, the option is available. The takeaway from this question, is that the default setting for this is 2003, and not available unless we configure the compatibility settings to 2016. I think renatovieira is spot on.

upvoted 8 times

...

renatovieira

Highly Voted 5 years, 8 months ago

In the Properties dialog box of the certificate template, click on the Server tab. On the Server tab you’ll see an option for Do not include revocation information in issued certificates (Applicable only for Windows Server 2008 R2 and above). When you select this option, certificates issued using this template will not include certificate revocation information and certificate revocation checks against these certificates will not fail.

upvoted 7 times

...