Testbank Lesson 18 – Flashcards

b. Prevents users from needing to remember multiple usernames and passwords. Difficulty: Easy Section Ref: Understanding Active Directory Federation Services Explanation: Single Sign-On (SSO) for web-based applications prevents users from needing to remember multiple usernames and passwords, one for each application.

Answer: D d. All of the above Difficulty: Easy Section Ref: Implementing AD FS Explanation: AD FS supports the following attribute stores: • Active Directory Application Mode (ADAM) in Windows Server 2003 • Active Directory Lightweight Directory Services (AD LDS) in Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2 • Microsoft SQL Server 2005 (all editions) • Microsoft SQL Server 2008 (all editions) • A custom attribute store

a. Windows Server 2003 SP1 Answer: A Difficulty: Medium Section Ref: Implementing AD FS Explanation: The domain controllers must be running a minimum of Windows Server 2003 with SP1.

Answer: A, C Difficulty: Hard Section Ref: Implementing AD FS Explanation: The actual AD FS configuration settings (not the attribute store data) can either be stored in an SQL server instance or locally on the AD FS server within the Windows Internal Database.

d. Get-ADFSAttributeStore Difficulty: Hard Section Ref: Implementing AD FS Explanation: You will use the Get-ADFSAttributeStore cmdlet to list the attribute stores currently configured for AD FS

b. Windows Identity Foundation SDK 4.0 Difficulty: Medium Section Ref: Implementing Claims-Based Authentication Explanation: You would need to download and install the Windows Identity Foundation SDK 4.0 to create a sample WIF application for testing AD FS claims-based authentication.

a. Add the self-signed certificate to your computer's Trusted Root Certification Authorities store c. Issue a valid certificate from your internal CA Difficulty: Medium Section Ref: Implementing Claims-Based Authentication Explanation: You can either issue a valid certificate or configure your computer to trust the self-signed certificate

a. Import data about the claims provider through the federation metadata b. Manually configure the claims provider trust c. Import data about the claims provider from a file Answer: A, B, C Difficulty: Medium Section Ref: Configuring Claims Provider Trust Rules Explanation: If you are communicating with other organizations, you need to create additional claims provider trusts for each federated organization. The Claims Provider Trust has similar options to the relying party trusts. The options include: • Import data about the claims provider through the federation metadata. • Import data about the claims provider from a file. • Manually configure the claims provider trust.

Difficulty: Hard a. Map attributes c. Edit claims rules Section Ref: Configuring Claims Provider Trust Rules Explanation: Mapping attributes is a step of editing and configuring claims rules, which is performed when configuring a claims provider trust, but not a relying party trust.

d. Authentication policies Answer: D Difficulty: Medium Section Ref: Configuring Authentication Policies Explanation: In Windows Server 2012 R2, AD FS can be accessed with authentication policies and multi-factor authentication (including using user, device, location, and authentication data). The authentication policy specifies the type of authentication globally for applications and services that are secured by AD FS or for a particular application per relying party trust.

b. Multifactor access control Difficulty: Hard Section Ref: Configuring Multi-Factor Authentication Explanation: Using multifactor access control with AD FS in Windows Server 2012 R2 provides the following benefits: • Allows for flexible authorization policies that allow you to permit or deny access based on user, device, network location, and authentication state • Allows creating issuance authorization rules for relying party applications • Provides a rich UI experience for the common multifactor access control scenarios • Provides rich claims language and Windows PowerShell support for advanced multifactor access control scenarios • Allows you to use custom 'Access Denied' messages

a. Workplace Join Difficulty: Easy Section Ref: Configuring Workplace Join Explanation: With Workplace Join, users can join their devices to the organization network without joining the device to the Active Directory domain. You can then manage access based on a wide range of attributes.

c. Device Registration Service Difficulty: Medium Section Ref: Configuring Workplace Join Explanation: When the user joins the devices using Workplace Join, the device becomes a known device. The Device Registration Service (DRS) provisions a device object in AD DS and issues a certificate for the Workplace-Joined device. The certificate will be used to represent device identity when accessing organization resources.

b. fsconfig.exe CreateFarm Difficulty: Easy Section Ref: Implementing AD FS Explanation: You will need to use the fsconfig.exe CreateFarm command to configure a new AD FS farm using the Windows Internal Database

d. Claim Difficulty: Medium Section Ref: Understanding Active Directory Federation Services Explanation: Claims are statements made by a trusted entity about an object such as a user that includes key information identifying the user

a. Federation server proxy Difficulty: Medium Section Ref: Understanding Active Directory Federation Services Explanation: The Federation server proxy is an optional component that is usually deployed in a perimeter network such as DMZ that can receive externally and forward the packets to the internal federation server.

b. Claims provider Difficulty: Medium Section Ref: Understanding Active Directory Federation Services Explanation: The claims provider is the server that issues claims and authenticates users.

c. Relying party Difficulty: Medium Section Ref: Understanding Active Directory Federation Services Explanation: The Relying party is the application or web service that accepts claims from the claims provider.