What should you recommend for each certificate?

###BeginCaseStudy###
Topic 3, Contoso Ltd,
Overview General Overview Contoso. Ltd. is an international company that has 3,000 employees.
The company has sales, marketing, research, and human resource departments.
Physical Locations
Contoso has two main offices. The offices are located in New York and Chicago. Each moffice has a data center.
The New York office uses a network subnet of 10.1.0.0/16. The Chicago office uses a mnetwork subnet of
10.128.0.0/16.
The offices connect to each other by using a WAN link. Each office connects directly to the Internet.
Existing Environment
Active Directory The network contains an Active Directory forest named contoso.com. The forest mcontains a
single domain. All domain controllers run Windows Server 2012 R2. The forest mfunctional level is Windows
Server 2012 R2.
The forest contains six domain controllers configured as shown in the following table.

The forest is configured as a single Active Directory site.
Active Directory administrators manage the Active Directory schema. Exchange Server madministrators do not
have access to modify the schema.
Contoso has deployed Active Directory Rights Management Services (AD RMS).
Current Business Model
Contoso partners with a company names Fabrikam. Inc. on manufacturing initiatives. The partnership between
Contoso and Fabrikam requires that both companies share confidentialm information frequently.
Requirements
Business Goals
Contoso plans to install Exchange Server 2016 to provide messaging services for its users.
It must be as easy as possible for the users at Contoso to share free/busy information with mthe users at
Fabrikam.
As much as possible Contoso plans to minimize the costs associated with purchasing hardware and software.
Planned Changes
Contoso plans to implement the following changes before installing Exchange Server 2016:
Install hardware Network Load Balancing (NLB) in the New York and Chicago offices.
Implement Microsoft Office Online Servers in the New York and Chicago offices.
Provide Contoso users with company-approved tablets.
Planned Messaging Infrastructure
You plan to create an Exchange Server 2016 organization named Contoso. You plan to deploy seven servers
that will have Exchange Server 2016 installed. The servers will be configured as mshown in the following table.

All of the servers will be members of a database availability group (DAG) named DAG01.
Client Access Requirements
Contoso identifies the following client access requirements for the planned deployment:
Users must be able to configure their tablet to synchronize email by using Autodiscover.
Users must be able to access the Exchange Server organization by using the following names:
 Mail.contoso.com
 Autodiscover.contoso.com
Users must be able to access Outlook on the web internally and externally from their tablet.
Users must be able to access Office Online Server by using the URL of office-online.contoso.com.
Security Requirements
Contoso identifies the following security requirements for the planned deployment:
Exchange Server mailbox databases must be encrypted while at rest.
Users must be prevented from using Outlook on the web while they are offline.
Contoso users must be able to share Calendar details with approved external domains only.
Email messages sent to the users in the fabrikam.com SMTP domain must be encrypted automatically.
Whenever possible, client computers must be directed to the same Exchange server for log collection.
Users must be able to access their mailbox by using Exchange ActiveSync on the company approved tablets
only.
Email messages sent from the users in the human resources department of Contoso must be protected by
using AD RMS. regardless of the mail client.
Availability Requirements
Contoso identifies the following high-availability requirements for the planned deployment:
Servers must be able to complete a restart without administrative intervention.
The network load balancer must be able to probe the health of each workload.
If a data center fails, the databases in the other data center must be activated automatically.
Redundant copies of all email messages must exist in the transport pipeline before and after mdelivery.
Email messages must be made highly available by the Exchange Server organization before and after delivery.
If you manually mount the databases following the data center failure, the databases in the failed site must be
prevented from mounting automatically.

###EndCaseStudy###

HOTSPOT
You deploy an Exchange Server 2016 organization. The organization contains two servers. The servers are
configured as shown in the following table.

The default self-signed certificates are installed on both servers.
All of the users in the organization work from home and from customer locations.
You purchase a Layer 7 hardware-based load balancer. You configure SSL bridging without session affinity for
Outlook on the web connections. The load balancer has an internal fully qualified domain name (FQDN) of Ib1
contoso.local.
DNS servers are configured to resolve mail.contoso.com names to the external IP address of the load balancer.
You need to recommend which names must be included in the certificates installed on the load balancers and
the Exchange servers.
What should you recommend for each certificate? To answer, select the appropriate options in the answer
area.

###BeginCaseStudy###
Topic 3, Contoso Ltd,
Overview General Overview Contoso. Ltd. is an international company that has 3,000 employees.
The company has sales, marketing, research, and human resource departments.
Physical Locations
Contoso has two main offices. The offices are located in New York and Chicago. Each moffice has a data center.
The New York office uses a network subnet of 10.1.0.0/16. The Chicago office uses a mnetwork subnet of
10.128.0.0/16.
The offices connect to each other by using a WAN link. Each office connects directly to the Internet.
Existing Environment
Active Directory The network contains an Active Directory forest named contoso.com. The forest mcontains a
single domain. All domain controllers run Windows Server 2012 R2. The forest mfunctional level is Windows
Server 2012 R2.
The forest contains six domain controllers configured as shown in the following table.

The forest is configured as a single Active Directory site.
Active Directory administrators manage the Active Directory schema. Exchange Server madministrators do not
have access to modify the schema.
Contoso has deployed Active Directory Rights Management Services (AD RMS).
Current Business Model
Contoso partners with a company names Fabrikam. Inc. on manufacturing initiatives. The partnership between
Contoso and Fabrikam requires that both companies share confidentialm information frequently.
Requirements
Business Goals
Contoso plans to install Exchange Server 2016 to provide messaging services for its users.
It must be as easy as possible for the users at Contoso to share free/busy information with mthe users at
Fabrikam.
As much as possible Contoso plans to minimize the costs associated with purchasing hardware and software.
Planned Changes
Contoso plans to implement the following changes before installing Exchange Server 2016:
Install hardware Network Load Balancing (NLB) in the New York and Chicago offices.
Implement Microsoft Office Online Servers in the New York and Chicago offices.
Provide Contoso users with company-approved tablets.
Planned Messaging Infrastructure
You plan to create an Exchange Server 2016 organization named Contoso. You plan to deploy seven servers
that will have Exchange Server 2016 installed. The servers will be configured as mshown in the following table.

All of the servers will be members of a database availability group (DAG) named DAG01.
Client Access Requirements
Contoso identifies the following client access requirements for the planned deployment:
Users must be able to configure their tablet to synchronize email by using Autodiscover.
Users must be able to access the Exchange Server organization by using the following names:
 Mail.contoso.com
 Autodiscover.contoso.com
Users must be able to access Outlook on the web internally and externally from their tablet.
Users must be able to access Office Online Server by using the URL of office-online.contoso.com.
Security Requirements
Contoso identifies the following security requirements for the planned deployment:
Exchange Server mailbox databases must be encrypted while at rest.
Users must be prevented from using Outlook on the web while they are offline.
Contoso users must be able to share Calendar details with approved external domains only.
Email messages sent to the users in the fabrikam.com SMTP domain must be encrypted automatically.
Whenever possible, client computers must be directed to the same Exchange server for log collection.
Users must be able to access their mailbox by using Exchange ActiveSync on the company approved tablets
only.
Email messages sent from the users in the human resources department of Contoso must be protected by
using AD RMS. regardless of the mail client.
Availability Requirements
Contoso identifies the following high-availability requirements for the planned deployment:
Servers must be able to complete a restart without administrative intervention.
The network load balancer must be able to probe the health of each workload.
If a data center fails, the databases in the other data center must be activated automatically.
Redundant copies of all email messages must exist in the transport pipeline before and after mdelivery.
Email messages must be made highly available by the Exchange Server organization before and after delivery.
If you manually mount the databases following the data center failure, the databases in the failed site must be
prevented from mounting automatically.

###EndCaseStudy###

HOTSPOT
You deploy an Exchange Server 2016 organization. The organization contains two servers. The servers are
configured as shown in the following table.

The default self-signed certificates are installed on both servers.
All of the users in the organization work from home and from customer locations.
You purchase a Layer 7 hardware-based load balancer. You configure SSL bridging without session affinity for
Outlook on the web connections. The load balancer has an internal fully qualified domain name (FQDN) of Ib1
contoso.local.
DNS servers are configured to resolve mail.contoso.com names to the external IP address of the load balancer.
You need to recommend which names must be included in the certificates installed on the load balancers and
the Exchange servers.
What should you recommend for each certificate? To answer, select the appropriate options in the answer
area.

Answer:

Show Hint

Leave a Reply 8

Your email address will not be published. Required fields are marked *

Marco

Marco

With SSL bridging, the loadbalancer will terminate the SSL connection and will need the name in the certificate that the users connect to. In this case, that’s mail.contoso.com.
The loadbalancer will initiate a new SSL connection to the internal Exchange servers. It’s allowed that you use internal certificates for this. So, each Exchange server uses his own name in it’s internal certificate: ex01.contoso.local and ex02.contoso.local.

http://searchexchange.techtarget.com/tip/Examining-your-Exchange-Server-SSL-configuration-options

The answer is:

mail.contoso.com
ex01.contoso.local
ex02.contoso.local

Reply

robin

robin

Thanks Marco

Reply

dskyo

dskyo

Why .local and not.com? Is it because when they were installed they got the default self-signed certificate and there’s no .com certificate for them?

Reply

JackP

JackP

Marco correct

“https://blogs.technet.microsoft.com/exchange/2015/10/08/load-balancing-in-exchange-2016/”

Reply

Bo bo the clown

Bo bo the clown

Marco is incorrect and the reason is that in an SSL bridging configuration, the SSL termination point is not the loadbalancer. It is the Exchange Servers. They are ultimately what must establish an SSL encrypted channel with the client.

Per Microsoft’s best practices: https://technet.microsoft.com/en-us/library/dd351044(v=exchg.150).aspx

“The host names you must include in your Exchange certificates are the host names used by client applications to connect to Exchange.”

All of the certs have to have mail.contoso.com, but really we’re only talking about one certificate that is distributed across all the Exchange servers, and the loadbalancer.

Reply