You are the systems administrator for your company. You install Windows Essential Business Server 2008 on the network. You configure Forefront Threat Management Gateway (TMG) on the Security Server. You want to create a site-to-site virtual private network (VPN) connection.

Which permission will you require for this purpose?

A.
membership in the Domain Admins group

B.
membership in the Enterprise Admins group

C.
membership in the local Administrators group on the Security Server

D.
membership in the local Administrators group on the Management Server

Explanation:
You will require membership in the Domain Admins group. A site-to-site connection is used to connect two separate private networks through the Internet. You can use the Create Site-to-Site Connection Wizard in Forefront TMG to configure site-to-site VPN connections. You should perform the following steps to create a site-to-site VPN connection:

1. Open the Windows EBS Console by clicking Start > All Programs > Windows Essential Business Server > Windows Essential Business Server Administration Console.
2. Click the Security tab, click Network firewall, and then in the tasks pane, click the Create a site-to-site VPN connection option. The Create Site-to-Site Connection Wizard in Forefront TMG appears.
3. Follow the instructions in the wizard to create a site-to-site VPN connection.

You must use an account that is a member of the Domain Admins group to perform this procedure.

All other options are incorrect because to create a site-to-site VPN connection in Forefront TMG, you must use an account that is a member of the Domain Admins group. Members of the local Administrators group on a server can only perform administrative tasks locally on that server. Members of the local Administrators group can perform tasks such as back up files and directories, change the system time, enable computer and user accounts to be trusted for delegation, and force a shutdown from a remote system. The Enterprise Admins group provides its members full control of all domains in the forest. By default, the Enterprise Admins group is a member of the Administrators group on all domain controllers in the forest, and hence can perform all of the tasks that members of Administrators group can perform.