DRAG DROP
You have a server named Server1 that runs Windows Server 2012 R2. Server1 has the Network
Policy and Access Services server role installed.
All of the VPN servers on your network use Server1 for RADIUS authentication.
You create a security group named Group1.
You need to configure Network Policy and Access Services (NPAS) to meet the following
requirements:
Ensure that only the members of Group1 can establish a VPN connection to the VPN servers.
Allow only the members of Group1 to establish a VPN connection to the VPN servers if the members
are using client computers that run Windows 8 or later.
Which type of policy should you create for each requirement?
To answer, drag the appropriate policy types to the correct requirements. Each policy type may be
used once, more than once, or not at all. You may need to drag the split bar between panes or scroll
to view content.
Answer: 
For network policies there are conditions, constraints, and settings that allow you to specify which users are allowed to under what circumstances connect to the
network.
With connection request policies, there are conditions and settings that allow network administrators to RADIUS server (Remote Authentication Dial-In User
Service) can determine which are performed authentication and authorization of connection requests that the Network Policy Server Network Policy Server (NPS)
receives from RADIUS clients.
Health policies consist of at least a System Health Validator (System Health Validator , SHV) and other settings that you can define computer the client computer
configuration requirements for the NAP-capable (Network Access Protection Network Access Protection), the attempt to connect to the network.
On the Exam they throw in a second group call Group2 that is all Vista, and asked you to only apply to Win8. WMI Filter is add in as an option.