One of the steps in the plan a PTI in your organization is to define methods for cert distribution and
enrollment.
In addition during the certificate management process you might need to revoke certificates reasons
for revoking certificates can include a key becoming compromised or someone leaving the organization.
You need to ensure that network clients can determine which certificates you have revoked before accepting
authentication requests during the certificate lifecycle certificate or key recovery is one of the most
important management tasks.
If you lose your public and private keys you can use a quick archival and recovery agent for data recover.
You can also use automatic or manual key archival and key recovery methods to ensure that you can access
data.
If you lose your kids so after completing this section you'll be able to describe certificate enrollment
methods describe certificate auto enrolment.
Explain what an enrollment agent is.
Describe how certificate revocation works describe key archival and recovery.
You'll be able to describe how to configure automatic key archival and configure SC for a key archival
But as usual before we start let's answer two questions.
Question 1.
When do you revoke a certificate.
Where are the farm printout of the certificate published option 1.
CRL distribution point or CTP option to authority information access or a CIA.
Option 3 certificate revocation list or CRL option for 18 years.
Option 5 The on online responder servers response hero.
Think about the answer and the correct answer is option 3 certificate revocation list or CRL when you
revoke a certificate there's some print of the certificate publishes to the certificate revocation list
as cereal distribution point to your real location where the cereal is stored.
The Authority information access or a is that your railway the C certificate is located 80 days as a
well at location for a CTP but revoked certificates do not publish directly to ADT is an online responder
service.
Validate the status of a specific certificate by using a local copy of the CRL but revoked certificates
do not publish directly to an online responder or service and the second question which of the following
actions must you take to configure key or archival honor on an ADC S C option one configure the K R
a certificate template option to enroll a designated user for a key r a certificate option 3 publisher
key are a public key by using group policy option for configure a recovery agent all the C and the last
option configure desired certificate templates for key archival stop here and think about the answer
and the answer is Option 1 option 2 option 5 and option 4 to configure key archival You should configure
the key you are a certificate so that only trusted users can enroll for a certificate and role a trusted
user for the key are a certificate Step 3 configure a recovery agent on the C by using the GRC certificate
and step 4 configure the desired certificate templates for key archival You do not need to publish the
KRG public key by using group all is so next stop will be talking about certificate enrollment methods
I'll see you there.