Your network contains an Active Directory domain named contoso.com. The domain contains a
server named NPS1 that has the Network Policy Server server role installed. All servers run Windows
Server 2012 R2.
You install the Remote Access server role on 10 servers.
You need to ensure that all of the Remote Access servers use the same network policies.
Which two actions should you perform? (Each correct answer presents part of the solution. Choose
two.)
A.
Configure each Remote Access server to use the Routing and Remote Access service (RRAS) to
authenticate connection requests.
B.
On NPS1, create a remote RADIUS server group. Add all of the Remote Access servers to the
remote RADIUS server group.
C.
On NPS1, create a new connection request policy and add a Tunnel-Type and a Service-Type
condition.
D.
Configure each Remote Access server to use a RADIUS server named NPS1.
E.
On NPS1, create a RADIUS client template and use the template to create RADIUS clients.
Explanation:
Connection request policies are sets of conditions and settings that allow network administrators to
designate which RADIUS servers perform the authentication and authorization of connection
requests that the server running Network Policy Server (NPS) receives from RADIUS clients.
Connection request policies can be configured to designate which RADIUS servers are used for
RADIUS accounting.
When you configure Network Policy Server (NPS) as a Remote Authentication Dial-In User Service
(RADIUS) proxy, you use NPS to forward connection requests to RADIUS servers that are capable of
processing the connection requests because they can perform authentication and authorization in
the domain where the user or computer account is located. For example, if you want to forward
connection requests to one or more RADIUS servers in untrusted domains, you can configure NPS as
a RADIUS proxy to forward the requests to the remote RADIUS servers in the untrusted domain.
To configure NPS as a RADIUS proxy, you must create a connection request policy that contains all of
the information required for NPS to evaluate which messages to forward and where to send the
messages.http://technet.microsoft.com/en-us/library/cc730866(v=ws.10).aspx
Isn’t it C and E?
C and E are correct
C & E = correct
Would anyone explain why C?
I think the answer is D & E.
(E) RADIUS Clients: This template type makes it possible for you to configure RADIUS client settings that you can reuse by selecting the template in the appropriate location in the NPS console.
(10 Remote Access servers are to use the same network policies)
https://technet.microsoft.com/en-us/library/ee663945(v=ws.10).aspx
(D) NPS acts as a RADIUS server, authenticating and authorizing the connection request. If the policy settings match and the policy requires that the NPS server forwards the message, NPS acts as a RADIUS proxy and forwards the connection request to a remote RADIUS server for processing.
https://msdn.microsoft.com/en-us/library/cc753603.aspx
Would anyone explain why C?
I think the answer is D & E.
(E) RADIUS Clients: This template makes it possible for you to configure RADIUS client settings that you can reuse by selecting the remplate in the appropriate location in the NPS console.
https://technet.microsoft.com/en-us/library/ee663945(v=ws.10)
(D) NPS acts as a RADIUS server, authenticating and authorizing the conectin request. If the policy settings match and the policy requires that the NPS server forwards the message, NPS acts as a RADIUS proxy and forwards the connection requests to a remote RADIUS server for processing.
https://msdn.microsoft.com/en-us/library/cc753603.aspx
D & E
When you first configure NAP for VPN in the console it creates the default connection policies for VPN connection. You don’t need to add a extra connection policy. Just test in your lab you will know.