You support Windows 8.1 desktop computers and tablets that are members of an Active Directory domain. The domain includes Active Directory Certificate Services. All users use virtual smart cards to log on to their computers.
A domain user wants to log on to both his desktop computer and his tablet computer by using the same domain user account. You need to configure the desktop and tablet computers to support two-factor authentication for the same domain user account. What should you do?
A. Enroll the user for two separate certificates based on the Smartcard Logon template. Install one certificate in a virtual smart card on each of the user’s computers.
B. Export the private key from the desktop computer. Import the private key to the tablet.
C. After the user has logged on to one computer, disable the Trusted Platform Module (TPM) on the second computer. Run the tpmvscmgr.exe utility on each of the computers.
D. Issue a temporary physical smart card. Use this smart card for an initial logon on each computer, then disconnect the tablet from the office network and destroy the temporary smart card.
Correct Answer: D
Explanation/Reference:
Using one-time password for enrollment
One option to ensure that users are strongly authenticated before virtual smart card certificates are issued is to send a user a one-time password through SMS, email, or phone. The user then types the one-time password during the certificate enrollment from an application or a script on a desktop that invokes built-in command-line tools.
Note:
* Virtual smart card technology from Microsoft offers comparable security benefits to physical smart cards by using two-factor authentication. Virtual smart cards emulate the functionality of physical smart cards, but they use the Trusted Platform Module (TPM) chip that is available on computers in many organizations, rather than requiring the use of a separate physical smart card and reader. Virtual smart cards are created in the TPM, where the keys that are used for authentication are stored in cryptographically secured hardware.
* Because all private information on the virtual smart card is encrypted by using the TPM on the host computer, it cannot be used on a different computer with a different TPM. There is no method to export the user’s virtual smart card for use on other computers, which adds to the security of virtual smart cards. If a user requires access to network resources on multiple computers, multiple virtual smart cards can be issued for that user.
* Multi-factor authentication, or two-factor authentication, is the term used to define the authentication mechanism that involves two (or more) factors. A "factor" is something you can prove: something you know (for instance, the username and password), something you possess (for instance, a token, a TPM-enabled device, a certificate, or a phone), or something that confirms your physical identity (for instance, a positive iris scan or a specific thumbprint).
Incorrect:
Not B: This would only b
Reference: Deploy Virtual Smart Cards
