Identity with Windows Server 2016 — Question 147

Your network contains an Active Directory domain named contoso.com.
You deploy a standalone root certification authority (CA) named CA1.
You need to autoenroll domain computers for certificates by using a custom certificate template.
What should you do first?

Answer options

• A. Modify the Policy Module for CA1.
• B. Modify the Exit Module for CA1.
• C. Install a standalone subordinate CA.
• D. Install an enterprise subordinate CA.

Correct answer: D

Explanation

The correct answer is D because installing an enterprise subordinate CA is necessary to support autoenrollment for domain-joined computers using Group Policy. The other options do not facilitate the autoenrollment process for certificates as effectively as installing an enterprise subordinate CA does.