You are the network administrator for your company. The network consists of a single Active Directory domain. The functional level of the domain is Windows Server 2003. The domain contains a Windows Server 2003 computer named Server1 that is running Routing and Remote Access. The domain contains a universal group named Managers and a global group named Operations. User accounts in the Managers group require remote access between the hours of 8:00 A.M. and 8:00 P.M. User accounts in the Operations group require remote access 24 hours per day. You configure a remote access policy on Server1 named RA_Managers with the appropriate settings for the Managers group, and you configure a second remote access policy named RA_Operations on Server1 with the appropriate settings for the Operations group. The default remote access policies on Server1 remain unmodified. Members of the Managers group report that they can establish a remote access connection to Server1, but members of the Operations group report that they cannot establish a remote access connection to Server1. You open the Routing and Remote Access administrative tool and note that the remote access policies are in the order presented in the following table.

You need to enable the appropriate remote access for the members of the Managers and Operations groups while restricting remote access to all other users.

What should you do?

A.
Delete the Connections to other access servers policy.

B.
Move the RA_Operations policy up so that it is the second policy in the order.

C.
Re-create the Operations global group as a universal group.

D.
Move the Connections to Microsoft Routing and Remote Access server policy up so that it is the first policy in the order.

Explanation:
The remote access policies are processed in order. If a user meets a condition in a policy, the user is allowed or denied access according to that policy. No other policies are checked. The Connections to Microsoft Routing and Remote Access server policy is being processed before the RA-Operations policy. The users meet the condition in the Connections to Microsoft Routing and Remote Access server policy and are being denied access. The RA-Operations policy isn’t being checked. Therefore, we need to move the RA-Operations policy above the Connections to Microsoft Routing and Remote Access server policy.

Reference:

J. C. Mackin, Ian McLean, MCSA/MCSE self-paced training kit (exam 70-291): implementing, managing, and maintaining a Microsoft Windows Server 2003 network infrastructure, Microsoft Press, Redmond, Washington, 2004, p. 1: 17