Apply Your Knowledge

Exercises

8.1 Creating an Enterprise Root CA

In this exercise, you create an Enterprise Root CA for your network. You need to have a Windows Server 2003 computer that is part of an Active Directory network. If you want to use the Web Enrollment pages, you need to install IIS before installing this CA.

Estimated time: 20 minutes

Log in to a Windows Server 2003 that is a member of the Active Directory domain with administrative permissions.
Select Start, Settings, Control Panel, Add or Remove Programs to open the Add or Remove Programs dialog box.
Click the Add/Remove Windows Components button located on the left side of the Add or Remove Programs dialog box to open the Windows Components Wizard.
Select the Certificate Services option.
A warning dialog informs you that you cannot rename the server after installing Certificate Services on it.
Click Next on the Windows Components Wizard dialog box to commence the installation process.
On the CA Type dialog box, select the type of CA you are installing. For this example, select Enterprise root CA. If you want to customize the key pair settings, you can do so by selecting the Use Custom Settings to Generate the Key Pair and CA certificate option.
If you selected to customize your key settings, the Public and Private Key Pair dialog box appears next. You have the opportunity to customize the installation by selecting the CSP and the Key Length. You also can use and import an existing certificate and key.
On the CA Identifying Information dialog box, enter the common name of the CA. This name should be descriptive but should not contain any special characters . You also need to configure the Validity period; the default value is five years .
On the Certificate Database Settings dialog box, enter the database and log locations or simply use the default selectionsusually the best option in most cases.
If IIS is running on the server, you are prompted to acknowledge that it will be stopped to perform the configuration of the CA. If IIS is not installed, you are prompted to install it before Web Enrollment can be used.
Click Finish to close the Windows Component Wizard. The CA is now ready and available for immediate use.

8.2 Configuring CRL Publication Properties

In this exercise, you configure the CRL publication properties of your CA. To complete this exercise, you should first complete Exercise 8.1.

Estimated time: 15 minutes

Select Start, Programs, Administrative Tools, Certification Authority to open your Certification Authority management console.
Locate the CA of concern in the CA management console and expand its nodes.
Right-click the Revoked Certificates node and select Properties from the context menu.
The Revoked Certificates Properties dialog box opens. Configure the CRL publication interval as well as the Delta CRL publication interval, or disable the use of Delta CRLs completely.
View those CRLs that have been published by switching to the View CRLs tab.
To change the CRL publication location, right-click the CA name and select Properties from the context menu.
When the CA Properties dialog box opens, switch to the Extensions tab. You can publish to Active Directory, a file system location, and an FTP or HTTP location.
To manually publish the CRL, right-click again on the Revoked Certificates folder and select All Tasks, Publish. You are asked what type of CRL you want to publish.

8.3 Requesting a Certificate with the Certificate Request Wizard

In this exercise, you request a new digital certificate from your CA using the Certificate Request Wizard. You need to complete Exercise 8.1 before attempting this exercise.

Estimated time: 10 minutes

Open the Certificates console by adding it as a snap-in to a custom MMC console or by entering certmgr.msc at the command prompt.
Right-click the Personal node and select All Tasks, Request New Certificate to start the Certificate Request Wizard.
Click Next to dismiss the opening page of the Certificate Request Wizard.
On the Certificate Types dialog box, select the type of certificate being requested . You also can configure advanced options, including the CSP to be used, by selecting the Advanced check box.
On the Certificate Friendly Name and Description dialog box, enter a friendly name and description for your certificate to identify more easily in the future.
Click Finish on the Completing the Certificate Request Wizard dialog box to complete the process.

8.4 Requesting a Certificate via the Web Enrollment Pages

In this exercise, you request a new digital certificate using the Web Enrollment pages. To complete this exercise, you must first complete Exercise 8.1 and install IIS on your CA.

Estimated time: 10 minutes

Open a new Internet Explorer window and enter http:// CAname /certsrv in the address bar, where CAname represents the name or IP address of your CA.
Click the Request a Certificate link to request a new certificate.
To request a basic user certificate, click the User Certificate link. If you want to request any other type of certificate, click the Advanced Certificate Request link.
On the Advanced Certificate Request page, click the Create and Submit a Request to This CA link to continue.
On the Advanced Certificate Request page, select the type of certificate being requested as well as configure its properties as you require. After you have configured your certificate request as desired, click the Submit button located at the bottom of the page.
As part of the enhanced security of Windows Server 2003 (and Windows XP), a warning dialog indicates that a Web page is requesting a certificate on your behalf .
If the request was successfully approved, you are presented with the Certificate Issued page. Click Install This Certificate to install your new certificate.
Again, Windows alerts you to the fact that the Web page is attempting to perform some action related to a digital certificate.

Review Questions

1:	What is a certificate?
2:	Why would an organization have a Standalone CA?
3:	Why would a CA need to renew its certificate?
4:	You are the network administrator of a large campuswide community college network. Your network is composed of computers running every version of Windows from Windows 95 to Windows Server 2003. Is SUS a good solution for your network, to ensure that all computers are up to date with the latest security patches?
5:	You have configured SUS for your network, but now several client computers are not getting updates. You determine that these computers are running a Japanese localized version of Windows XP Professional. What should you do to allow the client computers to get updates from your SUS server?
6:	Your CIO has instructed you to implement an SUS solution for your corporate network. He is concerned , however, about making unsecured connections to the SUS server. What can be done to provide connection security?

Exam Questions

1:	Christopher is the network administrator for the Heron Woods Resort Cottages company. Heron Woods rents vacation cottages at several locations along the Eastern Shore of Virginia and Maryland. Christopher needs to implement a solution that will keep the Windows Server 2003 and Windows XP Professional computers at all his locations up to date with the latest security updates, while at the same time installing only those updates that he has specifically approved. Heron Woods has a main office in Chincoteague, Virginia, connected to the Internet by a fractional T-1 line. All other locations are considered remote locations and have a dedicated ISDN link connecting them to the main office. What solution can Christopher implement that will allow him to meet his goals of providing available updates and allowing only approved updates to be installed? Christopher has received authorization from the CEO of Heron Woods to add only the absolute minimum number of additional servers as required to provide the best solution for meeting the requirements. Christopher should configure all servers and client workstations to connect directly to the Microsoft Windows Update Web servers weekly to download and install any new security updates that are required. Christopher should install an SUS server at each of his locations, including the remote offices, that is configured to automatically synchronize each night with the Windows Update Web servers. Additionally, he should configure Automatic Updates to download and install any new security updates that are required on a nightly basis from the local SUS server. Christopher should install an SUS server at each of his locations, including the remote offices. The SUS server at the main office should be configured to automatically synchronize each night with the Windows Update Web servers. The SUS servers at each of the remote offices should be configured to synchronize each night using the SUS server at the main office as its source. Additionally, he should configure Automatic Updates to download and install any new security updates that are required on a nightly basis from the local SUS server. Christopher should install an SUS server at his main office that synchronizes nightly with the Windows Update Web servers. Automatic Updates for all clients , local and remote, should be configured to download and install all approved updates from the main office SUS server on a nightly basis.
2:	Andrea is the network administrator for Purple Pony Wear, Inc., a leading supplier of novelty clothing items. The Purple Pony network consists of 2 Windows Server 2003 computers and 34 Windows XP Professional client computers, 30 of which are laptops in use in various remote locations by sales personnel. Andrea wants to create and implement a PKI solution so that her users can use smart cards to log on to their laptop computers, thus increasing the security of the laptops and the Purple Pony network. Priscilla, the President of Purple Pony, is concerned about users removing their smart cards from their laptop computers during their sessions and leaving their laptops logged in without being in front of them. Priscilla would like all laptops to be configured to lock the workstation when the smart card is removed so open documents will not be lost. What option does Andrea need to configure to ensure the desired result is achieved? Do not allow smart card device redirection Interactive logon: Require smart card Account Lockout Policy Interactive logon: Smart card removal behavior
3:	You are the network administrator of a Windows Server 2003 Active Directory network. Your company policy states that the network access attempts of all temporary employees are to be tracked, regardless of what workstation they log on to. What auditing options do you need to configure to ensure that you can track the access of all temporary employees ? (Choose two correct options.) Audit Account Management Audit Directory Service Access Audit Logon Events Audit Privilege Use Audit System Events Audit Account Logon Events
4:	You are the administrator of a large Windows Server 2003 network. Your company is a leading provider of state of the art satellite communications services for customers all over the world. The CIO of your company is very concerned about user account properties being modified by users who should not have administrative permissions. As part of your efforts to determine who might be modifying user account properties, you have decided to implement auditing. What auditing option should you configure to help you determine who is changing the user account properties on your network? Audit Account Management Audit Object Access Audit Logon Events Audit Privilege Use Audit System Events Audit Account Logon Events
5:	You are the administrator of a large Windows Server 2003 network. Your company is a leading provider of state of the art satellite communications services for customers all over the world. The CIO of your company is very concerned about who is able to access files and folders located in a sensitive folder named Contacts. What auditing option should you configure to help you determine what users on your network are accessing the files and folders located within the Contacts folder? Audit Account Management Audit Object Access Audit Logon Events Audit Privilege Use Audit System Events Audit Account Logon Events
6:	You are the network administrator for Nebuchadnezzar Furnaces. The company's Windows Server 2003 domain consists of domain controllers, 2 member servers, and 765 Windows XP Professional workstations. Every summer you hire 30 to 40 temporary employees to assist with additional production and sales needs for the upcoming winter season . Each employee is issued a digital certificate for smart card usage to allow him or her to securely access the network. The digital certificates have a validity period of two years by default due to the configuration of the CA that has issued them. Allison, your CIO, has told you on more than one occasion that she does not like the idea of having unused digital certificates still active. What should you do to increase your network's level of security? Change the CSP key length. Revoke the unused digital certificates. Lock the user's accounts. Disable the unused digital certificates.
7:	You have just composed and sent an email message to a colleague who is located within a different Windows Server 2003 network than your own. Your email message has been digitally signed using your email certificate. Your Root CA uses a third-party certificate from a trusted third-party organization. What will your colleague need to have available to him to be able to read your email and verify it originated from you? Your private key Your public key The third-party CA's private key The third-party CA's public key
8:	You have just received an email message from a colleague who is located within a different Windows Server 2003 network than your own. The email message has been digitally signed by the public key for your email certificate. Her Root CA uses a third-party certificate from a trusted third-party organization. What will you need to have available to you to be able to read her email and verify it originated from her? Your public key Your colleague's public key The third-party CA's private key The third-party CA's public key
9:	Rick is the network administrator for Mr. Whippy's Ice Cream. Rick has recently installed and configured an Enterprise Root CA for his Windows Server 2003 network on a server named CHOCOLATE. He performed no configuration for this new CA other than what was required during the installation process. When he tries to access the Web Enrollment Web pages at `http://CHOCOLATE/certsrv` , he receives a 404 error from Internet Explorer. What is the most likely cause of this problem? Rick forgot to start the Certificate Services service following the completion of the installation process. Rick has not installed Terminal Services on his CA. Rick has not installed IIS on his CA. Rick did not create a new CNAME record for the CA.
10:	Hannah is the network administrator for the Wallops Island Rocket Company, Incorporated. Her network is required to maintain the highest level of security possible without adversely affecting the required operations of its users. For the past 10 weeks, six visiting rocket scientists have been working at her facility on a joint project with another company. Hannah issued each of these users a secure laptop including a smart cardallowing them to securely access and update the rocket systems data stored in the SQL databases. These six visiting users have completed their work and have now left the facility, leaving behind their laptop computers and smart cards as required. Hannah has just completed sanitizing their laptop computers; what should she do next? Delete the data created by the scientists during their stay. Degauss the hard drives installed in the laptop computers the scientists were using. Perform a background check with the FBI, NSA, and NCIS on the scientists. Revoke the smart card certificates the scientists were issued and immediately publish the CRL to all configured CDPs.
11:	Chris is the network administrator for Island Dreams Tour and Rentals, Inc. She is preparing to implement a smart card solution for her Windows Server 2003 network. All her client computers are Windows XP Professional desktops and laptops. Some users have both a desktop computer and a laptop computer. Chris wants users to be able to use a single smart card at all times, regardless of what computer they are logging in to the network from. Chris does not want any user to be able to log on to the network without using their assigned smart cards. What can she configure to enforce this requirement on her users? Do not allow smart card device redirection Interactive logon: Require smart card Account Lockout Policy Interactive logon: Smart card removal behavior
12:	Jim has recently completed a configuration change to one of his network's firewalls. Now multiple users have called the help desk complaining that they can no longer access external resources. What document did Jim most likely not have in hand which could well have prevented this problem? A Security Monitoring policy A Firewall Configuration policy A Change and Configuration Control policy A User Naming Convention policy
13:	Kim has requested a new smart card certificate from one of her organization's CAs. Her request was not automatically approved and thus has been placed in a queue for administrative approval. You are the network administrator for the organization where Kim is employed. What must you do to approve her smart card certificate request? You need to log in using Kim's user account and supply the approval key for her certificate request. You need to use the Active Directory Users and Computers console to locate the Pending Requests folder. You need to use the Certificates console to locate the Pending Requests folder. You need to use the Certification Authorities console to locate the Pending Requests folder.
14:	Kim has requested a new smart card certificate from one of her organization's CAs using the Web Enrollment pages. Her request was not automatically approved and thus has been placed in a queue for administrative approval. Kim wants to check on the status of her certificate request to see whether the certificate has been approved for issuance. Where can Kim most easily find this information and install the certificate if her request has been approved? Active Directory Users and Computers console Certificates console, Personal Store node Log on to the CA Web Enrollment pages again The Certificate Request Wizard
15:	Chris is the network administrator for Seashell Cruises, LTD. The Seashell network has recently been upgraded from a mixed environment consisting of Windows 98 clients with Windows NT 4.0 Server and Windows 2000 Server servers. All clients now run Windows XP Professional, and all servers now run Windows Server 2003. Some computers were upgraded in place, whereas others were clean installations. Chris has recently been hired by Seashell Cruises and wants to establish the security level of her network using the least administrative effort. She has approximately 200 client workstations and 30 servers spread over two different locations in the same geographic area all on the same IP subnet. What method can Chris use to most easily analyze all her computers and find security problems with them? Use Windows Update locally on each computer to download and install required security updates. Use Automatic Updates on each computer to download and install required security updates. Install and configure SUS on one of her servers and configure Automatic Updates on the clients to download and install approved, required security updates. Use the MBSA utility to scan her entire subnet to quickly identify security problems and missing security updates on all computers.

Answers to Review Questions


A1:	A certificate is a component that allows you to send and receive secure data over a network. It assures the recipient that you are whom you claim to be, and it assures the sender that the data will reach the recipient without being jeopardized. For more information, see the section "Certificates."

A2:	A Standalone CA is an excellent choice when Active Directory is not present or when you want to manually approve certificate requests. For more information, see the section "The Standalone CA."

A3:	When a CA is created, it is assigned a certificate. This certificate, like all certificates, is set to expire. When a certificate has or is about to expire, an administrator can choose to renew the certificate. For more information, see the section "Renewing CAs."

A4:	If you have large numbers of pre-Windows 2000 computers (that is, legacy clients), SUS is probably not the best solution for your updating needs. In this situation, you would most likely want to examine a solution such as SMS or a third-party solution that provides the same type of functionality. For more information, see the section "Planning for Software Update Services."

A5:	This problem is relatively easy to solve : You simply enable support for the languages that you will be supporting from the SUS Server Options page. In this case, you should select the Japanese language option. For more information, see the section "Planning for Software Update Services."

A6:	You can enable SSL support on the SUS Web site and thus require that all connections be SSL secured. For more information, see the section "Planning for Software Update Services."

Answers to Exam Questions


A1:	D. Because WAN link usage is not an issue in this scenario, and Christopher has received authorization to add only those new servers that are absolutely required, Christopher's best option is to install and configure one SUS server at the main office that synchronizes nightly with the Windows Update Web serves. All Automatic Updates clients will then be configured to receive their updates from the home office SUS server. For more information, see the section "Planning for Software Update Services."

A2:	D. By configuring the Smart card removal behavior option, located in the Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options node of the Group Policy Editor, for Lock Workstation, Andrea can achieve the desired results. For more information, see the section "Smart Card Group Policy Options."

A3:	C, F. When both the Audit Logon Events and the Audit Account Logon Events options are configured, logons and logoffs that use a domain account generate logon or logoff audit events on the local computer as well as the domain controller. A success audit generates an audit entry when a logon attempt succeeds, and a failure audit generates an audit entry when a logon attempt fails. For more information, see the section "Planning for Security Monitoring."

A4:	A. The Audit Account Management option configures auditing to occur for each event of account management on a computer. Typical account management events include creating a user, creating a group, renaming a user, disabling a user account, and setting or changing a password. A success audit generates an audit entry when any account management event is successful, and a failure audit generates an entry when any account management event fails. For more information, see the section "Planning for Security Monitoring."

A5:	B. The Audit Object Access option configures auditing to occur upon each user access of an object, such as a file, folder, printer, or Registry key that has its own SACL configured. To configure auditing for object access, you also need to configure auditing specifically on each object for which you want to perform auditing. A success audit generates an audit entry when a user successfully accesses an object, and a failure audit generates an audit entry when a user unsuccessfully attempts to access an object. For more information, see the section "Planning for Security Monitoring."

A6:	B. In this scenario, the best option for increasing security is to revoke any unused certificates and immediately publish the CRL to all CDPs. For more information, see the section "Configuring Active Directory for Certificate Publication."

A7:	B. All that is necessary to read the email and verify it came from you is your public key, which can be safely transferred to anyone you want. Your private key should never be given out. If your colleague were to install the third-party CA's root certificate, he would thus be able to verify the entire certificate chain for your digital certificate. For more information, see the section "Certificates."

A8:	A. In this scenario, because the email has been signed with your public key, you need to have access to your private key, which should not be any problem. Your private key can be used to verify messages signed with your public key and can be used to verify messages that can be decrypted with your public key. For more information, see the section "Certificates."

A9:	C. To use the Certificate Services Web Enrollment pages, Rick must ensure that IIS is installed and configured properly to allow ASP pages to function properly. For best results, Rick should have installed IIS before installing the CA. For more information, see the section "Installing and Configuring an Enterprise Root CA."

A10:	D. Hannah should revoke the smart card certificates and immediately publish the CRL next. After doing so, she should also delete any unused user accounts that may have been created for the scientists' use during their visit to Hannah's facility. For more information, see the section "Configuring Active Directory for Certificate Publication."

A11:	B. By configuring the Interactive Logon: Require smart card Group Policy setting, Chris can ensure that all her users are required to log on to the network using their smart cards. Smart cards are used to provide the highest level of user authentication available in Windows Server 2003 networks. A user uses a password or PIN to access the digital certificate on the smart card, thus protecting the user's identity from rogue applications and attackers . Through the use of on-card digital signatures, smart cards can ensure that a user's private key is never exposed. Perhaps the single best feature of smart cards is that theyunlike software-based private keyscan be moved at will from one computer to another with ease. You can prevent smart cards from being used to access the network after a preconfigured number of incorrect login attempts, protecting them further from dictionary attacksa type of password guessing attack where a password is guessed from a list, or dictionary, of common words and phrases. For more information, see the section "Smart Card Group Policy Options."

A12:	C. Had Jim used a Change and Configuration Control policy, along with an approved change request, he most likely would not have created the problem he did as a result of his configuration change on the firewall. For more information, see the section "Planning for Change and Configuration Management."

A13:	D. Queued certificates are located in the Pending Requests folder of the Certification Authorities console. You can find and issue this certificate for Kim from this location. For more information, see the section "Installing and Configuring an Enterprise Root CA."

A14:	C. The easiest way for Kim to check on the status of her requested certificate is to go back to the CA from which she requested it via its Web Enrollment pages. If the certificate request has been approved, she also can install the certificate from that location. For more information, see the section "Using the Web Enrollment Web Pages."

A15:	D. Chris only wants to determine the security status of her network at this time, not install any updates. Using the MBSA utility is the best option because she can configure a single scan of all computers located on her subnet. After MBSA has completed the scan, she can examine each computer's results separately from the others, quickly determining what areas of their security configuration are weak in addition to determining what security updates are missing on each computer. For more information, see the section "Planning for Software Update Services."