Your network contains an Active Directory domain named contoso.com. Contoso.com contains a server named Server2.
You open the System properties on Server2 as shown in the exhibit:
When you attempt to configure Server2 as an enterprise subordinate certification authority (CA), you discover that the enterprise subordinate CA option is unavailable.
You need to configure Server2 as an enterprise subordinate CA.
What should you do first?
A. Upgrade Server2 to Windows Server 2008 R2 Enterprise.
B. Log in as an administrator and run Server Manager.
C. Import the root CA certificate.
D. Join Server2 to the domain.
Correct Answer: D
Explanation/Reference:
In doubt about this one, whether to go for A ("Upgrade Server2 to Windows Server 2008 R2 Enterprise"), or D ("Join Server2 to the domain"). Left it at D ("Join Server2 to the domain"), because that’s undoubtedly a necessary step we have to take here.
See below for my (messy) thoughts.
Reference:
http://social.technet.microsoft.com/Forums/nl-BE/winserversecurity/thread/1a1172c6-abdb-4c5a-8a7c-ea254de5dada
[Someone asked this question to Brian Komar:]
<begin quote>
buffaloyoung
Okay, so on this same note, I’m looking at a practice test type question for the 70-640 exam that shows the server runnning Windows Server 2008 R2 standard, and mentions that when you set up the Enterprise Sub Certificate Authority, the Enterprise Sub CA option is not available. The mulitple choice solutions are:
a. upgrade to enterprise;
b. run server manager as an admin;
c. import the root CA;
d. Join the server to the domain.
I had thought it was "A" because of the enterprise 2008 issue, but if this is changed in standard R2 … looking at the fact that the info shows the Workgroup to be "WORKGROUP," I am inclined to answer D. Is this right? Or should it still be A?
Brian:
This forum is for helping people with real world PKI and security issues. It is not a study board <G>
That being said, D would be my answer. Based on some of the other things I have heard about the exam, that may not be the answer they are looking for 😉
Brian
<end quote>
"that may not be the answer they are looking for", what does Brian mean by that? Was he deliberately trying to confuse buffaloyoung, or was he hinting at Microsoft advising to use Windows Server 2008 R2 Standard for root CA only? I’m talking about this, from the 70-640 Training Kit errata page:
Page 781, 1st paragraph
<begin quote>
The book states: Enterprise CAs can run only on Windows Server 2008 R2 Enterprise edition or Windows Server 2008 R2 Datacenter edition. This is not correct. You can use Windows 2008 R2 Standard edition, but you will not have access to all features.
Note from the Author or Editor:
Yes indeed, you can use the Standard Edition to run an Enterprise CA with limited functionality. Our recommendation would be to use this as a root CA only.
<end quote>
If that would be the case, then an upgrade to Windows Server 2008 R2 Enterprise might be what Microsoft wants to hear from us, being answer A. Since the question is about an enterprise subordinate CA.
