PKI Practice Tests: 160 Questions Explained

Do you build or run a Public Key Infrastructure? These practice tests check what a PKI administrator needs to know: the cryptography behind certificates, designing a two-tier hierarchy with an offline root CA, publishing CRLs and CA certificates, and running Active Directory Certificate Services day to day - templates, autoenrollment, key archival, OCSP and CA backup.

You get 4 practice tests with 160 questions in total (40, 40, 40, 40). Every question was checked twice before release: once by the author against the official documentation, and once by an independent reviewer who answered it blind - any disagreement was settled with a source.

What makes the explanations useful

Each answer tells you why the right option is right and why each wrong option is wrong. The wrong options are real features, commands and settings that are easy to pick by mistake - that is where most of the learning is.

How the tests are built

• Practice Test 1: Cryptography and Certificate Fundamentals: symmetric and asymmetric encryption, AES, RSA, ECC, Diffie-Hellman, hashing, digital signatures, the TLS handshake, X.509 v3 extensions and EFS.
• Practice Test 2: Designing and Deploying a PKI with AD CS: CA hierarchies, offline root CA, standalone and enterprise CAs, CAPolicy.inf, key length and validity, CDP and AIA, base and delta CRLs, IIS distribution points and certutil.
• Practice Test 3: Templates, Enrollment, Revocation and CA Management: certificate templates and permissions, autoenrollment, web enrollment, NDES, enrollment agents, key archival and recovery, OCSP, role-based administration, auditing, backup and renewal.
• Practice Test 4: Full Mock Exam: a mixed exam across all three areas - take it last, in one sitting.

Questions use single-answer and multiple-answer formats; the number of answers to pick is always stated. Suggested time: 60 minutes per test.

Versions: Active Directory Certificate Services on Windows Server 2022 and Windows Server 2025 (Certification Authority, Web Enrollment, Online Responder, NDES, CNG key storage providers), X.509 v3, TLS 1.2 and TLS 1.3, RSA 2048/4096, ECC, SHA-256, AES, EFS, certutil and the ADCSAdministration PowerShell module, as of October 2026.

Please note: these are original practice questions written by an instructor. This course is not affiliated with or endorsed by Microsoft; Windows Server, Active Directory and Active Directory Certificate Services are Microsoft trademarks.