Exam MD-102 topic 1 question 308 discussion

https://learn.microsoft.com/en-us/mem/intune/protect/microsoft-cloud-pki-configure-ca#step-3-create-certificate-profiles

To issue certificates, you must create a trusted certificate profile for your root and issuing CAs. The trusted certificate profile establishes trust with the Cloud PKI certificate registration authority supporting the SCEP protocol. A trusted certificate profile required for each platform (Windows, Android, iOS/iPad, macOS) that's issuing Cloud PKI SCEP certificates. This step requires you to: Create a trusted certificate profile for the Cloud PKI root CA. Create a trusted certificate profile for a Cloud PKI issuing CA. Create an SCEP certificate profile for a Cloud PKI issuing CA.

To implement a Microsoft Cloud PKI solution that deploys personal user certificates to all Windows devices using Microsoft Intune, you need to create the following configuration profiles: Trusted Certificate Profile: This profile is used to deploy the root CA certificate to the devices, ensuring that the devices trust the issuing CA. SCEP Certificate Profile: This profile is used to request and deploy the user certificates to the devices. Therefore, the minimum number of configuration profiles required to support the solution is two.

To implement a Microsoft Cloud PKI solution that deploys personal user certificates to all Windows devices using Microsoft Intune, it is necessary to create two configuration profiles: a Trusted Certificate Profile and a PKCS Certificate Profile.

You need Root, Issusing and SCEP hence why it is 3

SCEP Certificate Profile: This profile is used to configure the device to request and install a personal certificate from a certificate authority (CA). User Certificate Profile: This profile is used to assign the certificates to individual users.

ITS 2 : Trusted Certificate Profile for the Cloud PKI root CA. SCEP Certificate Profile for the issuing CA.

C: need 3 certificates: one for the trusted root certificate, one for the user certificates, and one for the configuration that links Intune with the on-premises PKI infrastructure. https://learn.microsoft.com/en-us/mem/intune/protect/microsoft-cloud-pki-overview#:~:text=Before%20the%20device%20checks%20in%20to%20the%20Intune,profiles.%20This%20flow%20isn%27t%20shown%20in%20the%20diagram.

Answer is correct: 2 To deploy personal user certificates to all Windows devices using Microsoft Cloud PKI in Microsoft Intune, you would need at least two configuration profiles: Root CA Configuration Profile: This profile sets up the root certificate authority (CA) in the cloud. It acts as the trust anchor for your PKI hierarchy2. Issuing CA Configuration Profile: This profile creates the issuing CA, which is responsible for issuing the personal user certificates to the devices. These profiles ensure that the PKI infrastructure is properly configured to issue and manage certificates for your devices. https://learn.microsoft.com/en-us/mem/intune/protect/microsoft-cloud-pki-configure-ca