Your network contains an Active Directory forest. The forest contains a member server named VPN1 that runs Windows Server 2008 R2.

You configure VPN1 as a VPN server.

You need to ensure that only client computers that have windows Update enabled can establish VPN connections to VPN1.

What should you install on VPN1?

A.
Windows Server Update Services (WSUS)

B.
Network Policy Server (NPS)

C.
Health Registration Authority (HRA)

D.
Connection Manager Administration Kit (CMAK)

Explanation:
http://technet.microsoft.com/en-us/library/cc754378.aspx