Which tool should you use?

There is a similar question to this one but in the answers you have an option to choose Certificate Authority. You should choose that instead of Active Directory Users and Computers. It’s a tricky question.

I have premium file of 412 (10/1/15)
Here the asnwer are:
*A. Active Directory Users and Computers*

in other Q the correct answer are:
*D. The Certification Authority console* (if shown the answer this is the right one…)

Certificate Revocation:

Clients that have a cached copy of the previously-published CRL or delta CRL will continue using it until its validity period has expired, even though a new CRL has been published. Manually publishing a CRL does not affect cached copies of CRLs that are still valid; it only makes a new CRL available for systems that do not have a valid CRL.
http://technet.microsoft.com/en-us/library/cc778151(v=ws.10).aspx

By default, CAs publish CRLs weekly. You can change this setting through the Revoked Certificates Properties dialog box.
http://msdn.microsoft.com/en-us/library/bb727098.aspx#EDAA

Each CA is configured with a CRL publication setting. This setting defines when a CA will automatically publish an updated CRL known as the CRL publish period. When a CA is first installed, the publish period is set to one week, but can be manually configured.
A CRL is valid for a period that differs from this publish period. The validity period is the period of time that a CRL is considered authoritative for verifying an issued certificate. The validity period is extended to a length of time greater than the publication period to allow for Active Directory replication. By default, the validity period is defined to be 10% greater than the publication period, up to a maximum of 12 hours difference. For example, if your CRL publish period is set to 10 days, and then the validity period is set to 11 days. In addition, the validity period must be at least 1.5 times the skew value. Therefore, if the skew value is defined to be 10 minutes, then the validity period must be a minimum of at least 15 minutes.
You can alter the default settings by modifying the CRLOverlapPeriod and CRLOverlapUnits values located in the registry in the HKLM\ SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\\ hive. For example, to define validity period to be extended by two days, you would set CRLOverlapPeriod to be a value of “days” and CRLOverlapUnits to be a value of “2”.
Note: It is recommended to modify these registry values using Certutil –setreg, rather than directly modifying the registry. The following command(s) are provided as examples:
certutil -setreg ca\CRLOverlapPeriod days
certutil -setreg ca\CRLOverlapUnits 2
Finally, there is a clock skew of an additional 10 minutes added to the validity period on either side of the publish period, so a CRL will be valid 10 minutes before the beginning of its publish period to account for variances in computer clock settings. You can modify this setting by changing the value of ClockSkewMinutes in the same registry location.
http://technet.microsoft.com/en-us/library/cc700843.aspx#XSLTsection126121120120

You can also publish a CRL on demand at any time, such as when a valuable certificate becomes compromised. Choosing to publish a CRL outside the established schedule resets the scheduled publication period to begin at that time. In other words, if you manually publish a CRL in the middle of a scheduled publish period, the CRL publish period is restarted.
It is important to realize that clients that have a cached copy of the previously published CRL will continue using it until its validity period has expired, even though a new CRL has been published. Manually publishing a CRL does not affect cached copies of CRLs that are still valid; it only makes a new CRL available for systems that do not have a cached copy of a valid CRL.
http://technet.microsoft.com/en-us/library/cc782162(v=ws.10).aspx

CryptoAPI uses the following two caches for CRLs and OCSP responses:
• A disk cache, which maintains copies of all CRLs and OCSP responses retrieved during the revocation checking process on the local file system. All items in the disk cache are maintained until their validity period expires.
• A memory cache, which contains revocation information used by a specific process. The memory cache is maintained within the memory used by the calling process. When the process terminates, the memory is released and the memory cache is flushed. If an object exists in the disk cache, the object is read into the memory cache for the calling process.
For Windows XP or Windows Server 2003, it is now supported to delete items from the disk cache. There are different commands available for flushing the cache:
• To delete all cache entries:
certutil -urlcache * delete
For Windows Vista and Windows 2008, it is preferable to invalidate the memory cache instead of deleting the disk cache. You can do so by invalidating the cached CRLs and OCSP responses before the time specified in the object.
To invalidate the cache, you must run the following commands from an Administrative command prompt:
• To immediately invalidate all items from the cache:
• certutil -setreg chain\ChainCacheResyncFiletime @now
http://technet.microsoft.com/en-us/library/ee619754(v=ws.10).aspx

EXAM TIP
If you don’t want to wait for a CRL or delta CRL to be published according to the default
schedule, you can trigger CRL publication. It is important to note that in most cases a
client will check a certificate’s validity only periodically; a client will not check a certificate’s
validity each time the certificate is used. This period is based on the CRL publication
interval.
Exam Ref 70-412: Configuring Advanced Windows Server 2012 R2 Services, (J.C. MackinOrin Thomas)
CHAPTER 6 Configure access and information protection solutions
Page 323

Enrolling for a smart card certificate:
The recommended method for enrolling users for smart card-based certificates and keys is through the smart card enrollment station that is integrated with Certificate Services in Windows Server 2003, Standard Edition and Windows Server 2003, Enterprise Edition.
When an enterprise certification authority (CA) is installed, the installation includes the Smart Card Enrollment station. This allows an administrator to act on behalf of a user to request and install a Smart Card Logon certificate or Smart Card User certificate on the user’s smart card. Prior to using the Smart Card Enrollment station, the smart card issuer must have obtained a signing certificate based on the Enrollment Agent certificate template. The signing certificate signs the certificate request that is generated on behalf of the smart card recipient.
By default, only domain administrators are granted permission to request a certificate based on the Enrollment Agent template. A user other than a domain administrator can be granted permission to enroll for an Enrollment Agent certificate by means of Active Directory Sites and Services.
http://msdn.microsoft.com/en-us/library/cc775505(v=ws.10).aspx
Checklist: Deploying smart cards for logging on to Windows
http://msdn.microsoft.com/en-us/library/cc739063(v=ws.10).aspx

Smart Cards – Creating a Windows 2008 Certificate Authority & Enrolling Smart Card Users with a 2K8 CA
http://blogs.citrix.com/2011/07/15/smart-cards-creating-a-windows-2008-certificate-authority-enrolling-smart-card-users-with-a-2k8-ca

Events That Trigger Urgent Replication:
Urgent Active Directory replication is always triggered by certain events on all domain controllers within the same site. When you have enabled change notification between sites, these triggering events also replicate immediately between sites.
Immediate replication between Windows 2000–based domain controllers in the same site is prompted by the following:
• Assigning an account lockout, which prohibits a user from logging on after a certain number of failed attempts.
• Changing a Local Security Authority (LSA) secret, which is a secure form in which private data is stored by the LSA.
• Change in the relative identifier (known as a “RID”) master role owner, which is the single domain controller in a domain that assigns relative identifiers to all domain controllers in that domain.
http://technet.microsoft.com/en-us/library/cc961787.aspx

According to the above information the correct answer is either Active Directory Users and Computers, or Active Directory Administrative Center.

So it is A. Active Directory Users and Computers

I would have to agree with the AD users and computers or AD admin center. You would think that the purpose of the delta CRL would be to lock out accounts immediately, however, if not computers are set to look at the CRL at specific times, then even if you did a delta CRL, it would not prevent a lockout. The only way therefore, that I see, is to disable in AD, then do a force replication by options in sites and services. But really, I would think that it would defeat the purpose of smart cards, if the delta CRL is only looked at during set times on the local machine.

dont think about it too much. It is the right answer. In order to prevent user1 from logging in again is to disable the account or revoke the certificate. None of the above answer allows you to revoke a certificate. So the only choice is to disable the account. How do you disable the account? The answer allows you to.

日本最高級スーパーコピーブランド時計激安通販専門店,高品質時計コピー,2015最新作、国際ブランド腕時計コピー、業界唯一無二.世界一流の高品質ブランドコピー時計,当店はスーパーコピー時計専門店,販売以下世界一流ブランドコピー時計：ロレックスコピー、ウブロコピー、オメガコピー、シャネルコピー…ンプルに見えて目を奪われてしまう独創的なブルガリのラインアップです。１８８４年ブルガリの創始者ソティリオ?ブルガリが銀細工師の一族としてイタリ アにオープン。ブルガリ?ブルガリシリーズ。古代ローマの円形競技場をモチーフにした時計「アンフィテアトロ」、若い世代向けの腕時計「ソロテンポ」を発 表。２０００年には新会社ダニエル?ロード＆ジェラルド?ジェンダ オート?オルロジュリー社を設立しました。本物ブランド時計に間違える程のスーパーコピー時計通販！スーパーコピーは業界n級品最高品質に挑戦!ロレックスコピー,パネライコピー,ウブロコピー,オメガコピー,ルイ?ヴィトンコピー,エルメスコピーを初め世界中有名なスーパーコピーブランドを激安で通販しております！HERMES（バッグ、時計） CHANEL（バッグ、時計）LOUIS VUITTON（バッグ、時計） BVLGARI時計Christian Dior（バッグ、小物） COACH（バッグ)GUCCI（バッグ、小物） ROLEX（時計）OMEGA（時計） IWC（時計） http://www.ooowatch.com/kabann/vuitton/index.html

Agreed. This has zero to do with the encryption of the connection. If you disable/change his account PW this is pushed immediately.

The secure connection may still be made but the log on attempt will fail.

オメガによれば、オメガスピードマスタームーンウォッチのこのバージョンのために美的なインスピレーションの時計を着用shirra宇宙飛行士ワリーによって1962年にnasaシグマ7ミッションは彼が地球を軌道に乗った。この空間における最初の腕時計でない間（ロシアの時計があった）、1962年の任務は、オメガの空間であった最初の時をマークした。このように、「第1のオメガスピードマスターにおける空間」のコレクションが生まれました。それは面白い、オメガからの情報によると、shirra購入オメガスピードマスターは、彼自身の任務のために、これはnasaとの公式関係も以前にありました。
プラダ 偽物 見分け方 カード http://www.gowatchs.com/brand-231-b51-min0-max0-attr0.html

ロレックス 通販専門店

★経営理念:
1.信用第一，品質保証，最も合理的な価格で商品を消費者に提供致します.
2.弊社の商品品数大目で、商品は安めです！★商品現物写真★
3.数量制限無し、一個の注文も、ＯＫです.
4.1個も1万個も問わず、誠心誠意対応します.
5.不良品の場合、弊社が無償で交換します.

営業種目:
高級腕時計，スーパーコピー時計（N級品），財布（N級品）
バッグ（N級品），靴（N品），指輪（N級品），ベルト（N級品），マフラー（N級品）
ロレックス，カルティエ，IWC，オメガ，パネライ，ブランド時計等も豊富に取り揃えております

価格が特恵を与えて、信用の第1、品質の100%は保証します
シャネル時計 ムーブメント 100均 http://www.gginza.com/%E6%99%82%E8%A8%88/panerai/index.html

This question came in the exam today with the following options:

A. Active Directory Sites and Services
B. Active Directory Administrative Centre
C. Server Manager
D. Certificate Templates

Since “Active Directory users and computers” weren’t an option I chose B

ブランドコピーブランド時計N品級激安販売-通販店

最高品質ブランドコピーブランド時計、バッグ、財布（N級品）新作最新入荷。

★100%品質保証！満足保障！リピーター率100％!
★商品数も大幅に増え、品質も大自信です。
★スタイルが多い、品質がよい、価格が低い！
★顧客は至上 誠実 信用。

当社の商品は絶対の自信が御座います。ぜひ一度ご覧 ください。送料は無料です(日本全国)

ホームページ上でのご注文は24時間受け付けております