220-1102 Question 88
Single answerCertificate Manager (certmgr.msc)A user can access an internal company website from Microsoft Edge on their Windows 11 laptop, but when they try to connect to the same site with a line-of-business application, the app reports that the server's certificate is not trusted. The help desk confirms the site's root CA certificate was distributed only to the current user's certificate store. You need to verify this and place the certificate where all applications on the PC can use it. Which action should you take?
- A
Open certmgr.msc, confirm the certificate is under Trusted Root Certification Authorities for the current user, then import the root certificate into the Local Computer Trusted Root Certification Authorities store
- B
Open certmgr.msc, delete the certificate from Personal, then reissue a new server certificate from the web server
- C
Open gpedit.msc and disable certificate revocation checking for all users on the computer
- D
Open services.msc and restart the Certificate Propagation service so the application can read the current user's trusted roots
Show answer and explanation
Correct answer: A
Explanation
This scenario tests the distinction between certificate stores and the practical use of Certificate Manager. certmgr.msc opens the current user's certificate store, which is useful for verifying where a certificate was placed. However, many trust-related issues are resolved by ensuring the required CA certificate is installed in the correct store. In Windows, trusted root CA certificates can exist in the Current User store or the Local Computer store. If a certificate is installed only for one user, some applications or services that rely on machine-wide trust may still fail. Best practice is to install internal root CA certificates into Trusted Root Certification Authorities only when they are approved and trusted by the organization, and to place them in the appropriate scope for the needed applications. Microsoft documentation for certificate stores and the Certificates snap-in distinguishes Current User and Computer Account stores, which is the key concept being tested here.
- A. Correct.
Correct. certmgr.msc manages certificates for the current user store, which is where the help desk says the root CA was placed. If some applications run in a different security context or rely on the computer-wide trust store, the certificate must also be in the Local Computer Trusted Root Certification Authorities store. Verifying the certificate in the current user's trusted roots and then importing it into the computer store addresses the trust problem for applications that do not use only the current user's store.
- B. Incorrect.
Incorrect. Deleting a certificate from the Personal store does not address a missing trust chain in Trusted Root Certification Authorities. Reissuing the server certificate is also unnecessary if the issue is that the client does not trust the issuing root CA. This option confuses server certificate deployment with client trust-store configuration.
- C. Incorrect.
Incorrect. Disabling certificate revocation checking is not an appropriate fix for an untrusted root CA and would reduce security. The problem described is about where the trusted root certificate is installed, not whether revocation status can be checked. This is a plausible distractor because certificate errors can involve revocation, but it does not match the scenario.
- D. Incorrect.
Incorrect. The Certificate Propagation service is primarily related to certificates from smart cards being propagated to the user store. Restarting it will not move a root CA certificate from the current user's store into the Local Computer store or resolve a trust issue caused by the certificate being installed in the wrong location.