DRAG DROP
Your network contains an Active Directory domain named contoso.com. The domain
contains five servers. The servers are configured as shown in the following table.
You plan to implement Network Access Protection (NAP) with IPSec enforcement on all
client computers.
You need to identify on which servers you must perform the configurations for the NAP
deployment.
Which servers should you identify? To answer, drag the appropriate servers to the correct
actions. Each server may be used once, more than once, or not at all. You may need to drag
the split bar between panes or scroll to view content.)
Answer: 
Explanation:
Believe these should all be Server3.
NAP enforcement is configured on NAP client or through Group Policy (Server1- Domain Controller)
We came across a cool web page which you might delight in. Take a appear for those who want.
My guess is the key words here are “configure the method.” You can tell NPS to use AD authentication, but you have to configure the clients to use 802.1x using group policy.
https://msdn.microsoft.com/en-us/library/dd314162(v=ws.10).aspx