Identity with Windows Server 2016 — Question 13

Your network contains an Active Directory forest named contoso.com. The forest contains an enterprise root certification authority (CA) on a server that runs
Windows Server 2016.
You plan to create and issue a custom subordinate CA template.
You need to prevent subordinate CAs from issuing subordinate certificates.
What should you configure in the template?

Answer options

• A. The Cryptography settings
• B. The Request Handling settings
• C. The Basic Constraints extension
• D. The Security settings

Correct answer: C

Explanation

The correct answer is C, as the Basic Constraints extension is used to specify whether the CA can issue certificates to other CAs. Options A, B, and D do not directly control the ability to issue subordinate certificates, making them unsuitable for this requirement.