Your network contains an Active Directory domain. The domain contains two domain controllers  named DC1 and DC2.    
DC1 hosts a standard primary DNS zone for the domain. Dynamic updates are enabled on the  zone. DC2 hosts a standard secondary DNS zone for the domain.    
You need to configure DNS to allow only secure dynamic updates.    
What should you do first（）

多项选择题You have two servers named Server1 and Server2. Both servers run Windows Server 2008 R2.  Server1 is configured as an Enterprise Root certification authority （CA）. You install the Online  Responder role service on Server2.     You need to configure Server2 to issue certificate revocation lists （CRLs） for the enterprise root  CA.     Which two tasks should you perform（）

A.Import the enterprise root CA certificate.
B.Import the OCSP Response Signing certificate.
C.Add the Server1 computer account to the CertPublishers group.
D.Set the Startup Type of the Certificate Propagation service to Automatic.

单项选择题Your company has an Active Directory domain. You have a two-tier PKI infrastructure that  contains an offline root CA and an online issuing CA. The Enterprise certification authority is  running Windows Server 2008 R2.   You need to ensure users are able to enroll new certificates.     What should you do（）

A.Renew the Certificate Revocation List （CRL） on the root CA . Copy the CRL to the CertEnroll folder on the issuing C
B.Renew the Certificate Revocation List （CRL） on the issuing CA . Copy the CRL to the SystemCertificates folder in th
C.Import the root CA certificate into the Trusted Root Certification Authorities store on all client workstations.
D.Import the issuing CA certificate into the Intermediate Certification Authorities store on all client workstations.

单项选择题Your company has an Active Directory domain. All servers run Windows Server 2008 R2.     Your company uses an Enterprise Root certificate authority （CA）. You need to ensure that  revoked certificate information is highly available.   What should you do（）

A.Implement an Online Certificate Status Protocol （OCSP） responder by using Network Load Balancing.
B.Implement an Online Certificate Status Protocol （OCSP） responder by using an Internet Security and Acceleration S
C.Publish the trusted certificate authorities list to the domain by using a Group Policy Object （GPO）.
D.Create a new Group Policy Object （GPO） that allows users to trust peer certificates. Link the GPO to the domain.

单项选择题YournetworkconsistsofasingleActiveDirectorydomain.ThefunctionalleveloftheforestisWindowsServer2008R2. Youneedtocreatemultiplepasswordpoliciesforusersinyourdomain. Whatshouldyoudo（）

A.From the Active Directory Schema snap-in， create multiple class schema objects.
B.From the ADSI Edit snap-in， create multiple Password Setting objects.
C.From the Security Configuration Wizard， create multiple security policies.
D.From the Group Policy Management snap-in， create multiple Group Policy objects.

多项选择题Your company has an Active Directory domain. You plan to install the Active Directory Certificate Services （AD CS） server role on a member  server that runs Windows Server 2008 R2.     You need to ensure that members of the Account Operators group are able to issue smartcard  credentials. They should not be able to revoke certificates.     Which three actions should you perform（）

A.Install the AD CS server role and configure it as an Enterprise Root CA .
B.Install the AD CS server role and configure it as a Standalone CA .
C.Restrict enrollment agents for the Smartcard logon certificate to the Account Operator group.
D.Restrict certificate managers for the Smartcard logon certificate to the Account Operator group.
E.Create a Smartcard logon certificate.
F.Create an Enrollment Agent certificate.