MCTS 70-642 Network Access Protection (NAP) & Network Policy Server 2 — Questions and Answers
Question 1: When NAP is deployed with DHCP enforcement, how are non-compliant clients restricted?
- They receive no IP address from the DHCP server
- They receive an IP address with a restrictive subnet mask and routes that limit connectivity (Correct answer)
- They are redirected to a captive portal for remediation
- Their MAC addresses are blocked at the switch level
Correct answer: They receive an IP address with a restrictive subnet mask and routes that limit connectivity
With DHCP enforcement, non-compliant clients receive a limited IP configuration (restricted routes and no default gateway) that allows access only to remediation servers.
Question 2: Which component is required on the server side to issue health certificates to compliant clients in an IPsec NAP deployment?
- Network Policy Server (NPS)
- Health Registration Authority (HRA) (Correct answer)
- Routing and Remote Access Service (RRAS)
- Active Directory Federation Services (AD FS)
Correct answer: Health Registration Authority (HRA)
The Health Registration Authority (HRA) is an IIS-based component that requests and issues health certificates from a CA to compliant NAP clients.
Question 3: How should you configure client computers to enable NAP in a Windows Server 2008 domain environment?
- Manually install the NAP client software on each computer
- Enable the NAP client through Group Policy settings (Correct answer)
- Use Windows Deployment Services to push NAP agent configuration
- Configure NAP client settings through the registry editor on each machine
Correct answer: Enable the NAP client through Group Policy settings
Group Policy is the recommended method to configure and enable NAP enforcement clients on domain-joined computers at scale.
Question 4: In a NAP with VPN enforcement scenario, which server role must be co-located with or connected to the NPS server?
- Active Directory Domain Services
- Routing and Remote Access Service (RRAS) (Correct answer)
- Active Directory Certificate Services
- Windows Internet Name Service (WINS)
Correct answer: Routing and Remote Access Service (RRAS)
RRAS acts as the VPN server and RADIUS client, forwarding authentication and health validation requests to NPS for policy evaluation.
Question 5: What happens to a NAP client in 'monitor only' mode when it fails a health check?
- The client is denied all network access immediately
- The client is placed in the quarantine network
- The client receives full network access but the non-compliance is logged (Correct answer)
- The client receives a warning dialog and must reboot
Correct answer: The client receives full network access but the non-compliance is logged
In monitor-only (reporting) mode, non-compliant clients are not restricted; instead, their non-compliance is logged to help administrators assess the environment before enforcing policies.
Question 6: Which NAP component determines what remediation actions a quarantined client should take?
- NAP Administration Server
- System Health Validator (SHV) (Correct answer)
- Quarantine Server
- NAP Agent on the client
Correct answer: System Health Validator (SHV)
The SHV on the NPS server evaluates client health reports and specifies which health requirements are not met, guiding the client's remediation steps.
Question 7: Which protocol does NAP use to communicate health information between the NAP client and the NPS server over a RADIUS infrastructure?
- SNMP
- Statement of Health (SoH) encapsulated in RADIUS attributes (Correct answer)
- WMI over DCOM
- LDAP over SSL
Correct answer: Statement of Health (SoH) encapsulated in RADIUS attributes
NAP uses Statement of Health (SoH) messages encapsulated within RADIUS access-request packets to transmit client health information to the NPS server.
MCTS 70-642 Network Access Protection (NAP) & Network Policy Server 2
When NAP is deployed with DHCP enforcement, how are non-compliant clients restricted?