You plan to distribute certificates to 500 Windows 10 devices using SCEP. NDES issues certificates from a subordinate CA. Based on the server topology shown, on which server is the required root CA certificate located?
Choose an answer
Tap an option to check your answer.
Correct answer: Server2.
Why this is the answer
Server2 is the correct answer because it hosts the Enterprise Root CA. For SCEP to function correctly and for devices to trust certificates issued by the subordinate CA (Server3), the devices must implicitly trust the entire certificate chain, which originates from the Root CA. The NDES server (Server4) and the subordinate CA (Server3) both rely on the Root CA for their own certificate issuance and trust. Server1 is a domain controller but not a CA. Therefore, the Root CA certificate, which is essential for establishing trust in the certificate hierarchy, resides on Server2.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed