Exam MD-101 topic 3 question 36 discussion

Actual exam question from Microsoft's MD-101

Question #: 36
Topic #: 3

You have 500 computers that run Windows 10. The computers are joined to Microsoft Azure Active Directory (Azure AD) and enrolled in Microsoft Intune.
You plan to distribute certificates to the computers by using Simple Certificate Enrollment Protocol (SCEP).
You have the servers shown in the following table.

NDES issues certificates from the subordinate CA.
You are configuring a device profile as shown in the exhibit. (Click the Exhibit tab.)

On which server is the required root certificate located?

A. Server1
B. Server2
C. Server3
D. Server4

Show Suggested Answer

Suggested Answer: C 🗳️

by MR_Eliot at May 1, 2022, 4 p.m.

Comments

Submit Cancel

RodrigoT

Highly Voted 2 years, 12 months ago

Selected Answer: C

The CA is Server3. Check NDES functions: 1-Generates and provides one-time enrollment passwords to administrators 2-Submits enrollment requests to the CA (in this case Server3) 3-Retrieves enrolled certificates from the CA and forwards them to the network device Source: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831498(v=ws.11)

upvoted 8 times

...

Amir1909

Most Recent 1 year, 3 months ago

Correct

upvoted 1 times

...

Horhe

2 years, 6 months ago

Selected Answer: C

Rodrigo T explains it well... https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831498(v=ws.11)

upvoted 2 times

...

MR_Eliot

3 years ago

Selected Answer: D

NDES server role – To support using the Certificate Connector for Microsoft Intune with SCEP, you must configure the Windows Server that will host the certificate connector with the Network Device Enrollment Service (NDES) server role. The connector supports installation on Windows Server 2012 R2 or later. In a later section of this article, we guide you through installing NDES. The server that hosts NDES and the connector must be domain-joined and in the same forest as your Enterprise CA. Do not use NDES that's installed on the server that hosts the Enterprise CA. This configuration represents a security risk when the CA services internet requests, and installation of the connector isn't supported on the same server as your issuing Certification Authority (CA). https://docs.microsoft.com/en-us/mem/intune/protect/certificates-scep-configure