PrepAway - Latest Free Exam Questions & Answers

What should you create on each NPS server?

DRAG DROP
Your network contains an Active Directory forest named contoso.com. The forest contains a
Network Policy Server (NPS) server named NPS1 and a VPN server named VPN1. VPN1 forwards all
authentication requests to NPS1.
A partner company has an Active Directory forest named adatum.com. The adatum.com forest
contains an NPS server named NPS2.
You plan to grant users from adatum.com VPN access to your network.
You need to authenticate the users from adatum.com on VPN1.
What should you create on each NPS server?
To answer, drag the appropriate objects to the correct NPS servers. Each object may be used once,
more than once, or not at all. You may need to drag the split bar between panes or scroll to view
content.

PrepAway - Latest Free Exam Questions & Answers

Answer:

14 Comments on “What should you create on each NPS server?

  1. JF says:

    It’s wrong.

    NPS2 must have Remote Radius Server Group to forward all the authentication request to NPS1.
    NPS1 must have Radius Client (NPS2 identification) and a Network Policy in order to set rules for access.
    So, answer is:

    NPS1: Radius Client / Network Policy
    NPS2: Remote Radius Server Group




    1



    0
  2. JF says:

    Correcting post above:

    NPS2 must have Remote Radius Server Group to forward all the authentication request to NPS1.
    NPS1 must have Radius Client (NPS2 identification) and a Connection Request Policy in order to set rules for access.
    So, answer is:

    NPS1: Radius Client / Connection Request Policy
    NPS2: Remote Radius Server Group




    0



    0
    1. jay z says:

      check this:
      I think provided answer is correct:
      – adatum.com clients pass by using VPN1
      – VPN1 forwards to NPS1
      – to get adatum.com users authenticated you have to forward their requests (using an appropriate filter) from NPS1 to NPS2 by setting up a Connection Request Policy on NPS1 (right answer point 1)
      – to configure a Connection Request Policy to forward requests you HAVE to choose a remote RADIUS server group, even if it’s a single server, then this group has only one member. therefore create this group on NPS1 that has NPS2 as member (right answer point 2)
      – because NPS1 is forwarding requests to NPS2 it is mandatory to have NPS1 configured as a RADIUS client in NPS2 (right answer point 3)

      and why not using network policy? because nps1 already has a network policy (for contoso.com users) that will be processed also for the adatum.com users right after the forwarded authentication requests are succsessfully handeled…and network policy will be handeled by NPS1, not by NPS2! NPS2 only does processing the authentication request, as soon as this is done NPS1 will continue processing network policy…




      0



      0
  3. Chris says:

    The answer provided is correct.
    Your RADIUS server (NPS1) must have the Remote Radius Server Group (so that it knows where to authenticate the remote adatum.com users. You must also specify a Connection Request Policy on NPS1, so that it knows under what conditions to forward authentication requests to adatum.com (such as an IPv4 condition or username condition).
    NPS2 (adatum.com) will need to add a Radius client, so that your server (NPS1) can authenticate against NPS2.




    0



    0

Leave a Reply