You need to configure WebApp1 to meet the following requirements:

Your network contains a server that runs Windows Server 2008 R2.
The server has Microsoft SharePoint Foundation 2010 installed.
You create a new Web application named WebApp1.

You need to configure WebApp1 to meet the following requirements:

* Internal users must be authenticated by using Kerberos authentication.
* External users must be authenticated by using NTLM authentication.

What should you do first?

A.
Extend WebApp1.

B.
Modify the User Policy.

C.
Modify the Permissions Policy.

D.
Configure the Alternate Access Mappings.

Explanation:
Extend a Web application

If you want to expose the same content in a Web application to different types of users by using additional URLs or authentication methods, you can extend an existing Web application into a new zone. When you extend the Web application into a new zone, you create a separate Internet Information Services (IIS) Web site to serve the same content, but with a unique URL and authentication type.

An extended Web application can use up to five network zones (Default, Intranet, Internet, Custom, and Extranet). For example, if you want to extend a Web application so that customers can access content from the Internet, you select the Internet zone and choose to allow anonymous access and grant anonymous users read-only permissions. Customers can then access the same Web application as internal users, but through different URLs and authentication settings. For more information, see Configure anonymous access for a claims-based Web application (SharePoint Foundation 2010), and Plan authentication methods (SharePoint Foundation 2010).

Source: http://technet.microsoft.com/en-us/library/cc288162.aspx