Chapter 7 - Implement Network Connectivity and Remote Access Solutions Flashcards

Question

You are the administrator for your company network. You have a Windows Server 2016 server named Server1 that is configured as a VPN server. Server1 is configured to allow domain users to establish VPN connections from 6:00 a.m. to 6:00 p.m. every day of the week. What should you do if you need to ensure that domain users can establish VPN connections Monday through Friday only? A. Configure the Properties of Server1 from Routing and Remote Access. B. Modify the Access Policies on Server1 from Server Manager. C. Modify the Dial-in Properties of the computer accounts from Active Directory Users and Computers. D. Modify the Network Policy on Server1 from Network Policy Server.

Answer 1

B. Access policies are a list of roles and the resources with which roles are to be provi- sioned or deprovisioned. Access policies are used to automate the provisioning of target systems to users.

Answer 2

D. The Set-DAClient cmdlet configures the properties related to a DirectAccess (DA) cli- ent. The -ComputerName parameter specifies the IPv4 or IPv6 address, or host name, of the computer on which the Remote Access server computer–specific tasks should be run.

Answer 3

D. Teredo traffic uses UDP port 3544. UDP Port 3544 must be open to ensure that Teredo clients can successfully communicate with the Teredo server.

Answer 4

Y B. 6to4 traffic uses Internet Protocol (IP) ID 41. 6to4 is a special usage of protocol 41. A 6to4 address starts with the digits 2002, followed by the IPv4 address of its router. Here’s an example of a 6to4 address: 2002:CB00:71FF:0:fe64:3486:d398:3346.

Answer 5

C. Internet Protocol - Hypertext Transfer Protocol Secure (IP-HTTPS) traffic uses Trans- mission Control Protocol (TCP) 443. HTTPS URLs begin with https:// and use port 443. HTTP Secure (HTTPS) is an extension of the Hypertext Transfer Protocol (HTTP) for secure communication over a computer network and is widely used on the Internet.

Answer 6

B. The route.exe command is an MS-DOS executable for Windows. It is used to block IP connections to the system by adding IP addresses to a routing table. The syntax is Route [command] [destination] [subnet mask] [gateway] [metric]. add: Adds a route. destination: Specifies the host. subnet mask: Specifies the subnet mask value for the route entry. The default is 255.255.255.255. gateway: Specifies the gateway. metric: Specifies the metric (the cost for the destination). Metrics are cost values used by routers to determine the best path to a destination network.

Answer 7

B, C, F. In order, you would want to deploy a site-to-site VPN, configure BGP Peering, and then advertise all of the routes on all of the BGP routers. A site-to-site VPN connec- tion lets branch offices use the Internet as a means for accessing the main office’s intranet. BGP is the standard routing protocol commonly used on the Internet to exchange routing and reachability information between two or more networks. BGP enables the Azure VPN gateways and your on-premises VPN devices, called BGP peers or neighbors, to exchange “routes” that will inform both gateways on the availability and reachability of those pre- fixes to go through the gateways or routers. For each prefix in the routing table, the routing protocol process selects a single best path, called the active path. Unless you configure BGP to advertise multiple paths to the same destination, BGP advertises only the active path. Peering is a process by which two Internet networks connect and exchange traffic. It allows them to directly hand off traffic between each other’s customers, without having to pay a third party to carry that traffic across the Internet for them.

Answer 8

C. NAT64 is an IPv6 transition mechanism that facilitates communication between IPv6 and IPv4 hosts by using a form of Network Address Translation (NAT). The NAT64 gate- way is a translator between IPv4 and IPv6 protocols. It needs at least one IPv4 address and an IPv6 network segment comprising a 32-bit address space. DNS64 describes a DNS server that synthesizes the AAAA records from the A records. The first part of the synthe- sized IPv6 address points to an IPv6/IPv4 translator, and the second part embeds the IPv4 address from the A record. The translator in question is usually a NAT64 server.

Answer 9

B. The Get-BgpRouter PowerShell cmdlet allows you to see the configuration information for BGP routers.

Answer 10

B. The Get-DAClient cmdlet allows you to see the list of client security groups that are part of the DirectAccess deployment and the client properties.

Answer 11

A. The logman.exe utility can be used to create and manage Event Trace Session and Per- formance logs and allows an administrator to monitor many different applications through the use of the command line.

Answer 12

B. The Get-RemoteAccess cmdlet shows the configuration of a DirectAccess and VPN server.

Answer 13

D. The higher the RADIUS priority number, the less often the RADIUS server gets used. To make sure that RADIUS Server4 is used only when Server2 and Server3 are unavail- able, you would set the RADIUS priority from 1 to 10. This way, it will be used only when Server2 and Server3 are having issues or are unresponsive.

Answer 14

B. The Set-DAServer cmdlet allows an administrator to set the properties specific to the DirectAccess server. This cmdlet configures properties that are applicable globally to the entire DA deployment; properties that are applicable per-server or per-cluster in a load-balancing scenario; or properties that are applicable per-site, such as in a multisite deployment.

Answer 15

C. The Set-VpnAuthType cmdlet is used only to toggle from one authentication type to another. This cmdlet cannot be used to explicitly add any RADIUS servers if RADIUS authentication is being used. Administrators use the Set-VpnAuthType cmdlet to set the authentication type to be used for a VPN connection.

Answer 16

B. Add-RemoteAccessRadius adds a new external RADIUS server for VPN authentica- tion, accounting for DirectAccess (DA) and VPN, or one-time password (OTP) authentica- tion for DA. The AccountingOnOffMsg indicates the enabled state for sending accounting on or off messages. The acceptable values for this parameter are Enabled or Disabled. Disabled is the default value. This parameter is applicable only when the RADIUS server is being added for remote access accounting.

Answer 17

C. The Add-RemoteAccessRadius cmdlet adds a new external RADIUS server. This cmd- let allows an administrator to add a new external RADIUS server for VPN or DirectAccess connectivity.

Answer 18

D. The Link Control Protocol (LCP) handles the details of establishing and configuring the lowest-level PPP link. In that regard, you can think of LCP as if it were almost part of the Physical layer.

Answer 19

A. You can configure DirectAccess clients to send all of their traffic through the tunnels to the DirectAccess server with force tunneling. When force tunneling is configured, DirectAccess clients detect that they are on the Internet, and they remove their IPv4 default route. With the exception of local subnet traffic, all traffic sent by the DirectAccess client is IPv6 traffic that goes through tunnels to the DirectAccess server.

Answer 20

D. Layer 2 Tunneling Protocol (L2TP) is more secure than Point-to-Point Tunneling Protocol (PPTP). PPTP uses Microsoft Point-to-Point Encryption (MPPE) for security, which is less secure than the IPsec encryption method, which is what L2TP uses for security.

Answer 21

E. Secure Socket Tunneling Protocol (SSTP) is the tunneling protocol that uses the HTTPS protocol over TCP port 443 to pass traffic through firewalls and web proxies that might block PPTP and L2TP/IPsec traffic.

Answer 22

D. By default, each server logs its data in systemroot\system32\LogFiles. You can change this location to wherever you want.

Answer 23

A. The General tab of the Connection Properties dialog box is where you specify either the IP address of the VPN server or the modem and phone number to use with this particular connection. With the General tab, you can set VPN options by entering the VPN server address or host name and specifying whether to dial another connection automatically first and then specify the connection to dial.

Answer 24

B. The Network Policy Server (NPS) snap-in allows you to set up RADIUS servers and determine which RADIUS server would accept authentication from other RADIUS servers. You can do your entire RADIUS configuration through the NPS snap-in.

Answer 25

A. When an administrator chooses Multitenant mode, Cloud Service Providers (CSPs) and Enterprise networks can use RAS Gateways to allow datacenter and cloud network traffic routing between both virtual and physical networks. For multitenant mode, it is recommended that you deploy RAS Gateways on virtual machines that are running Win- dows Server 2016.

Answer 26

B. The Disconnect-VpnUser cmdlet disconnects a VPN connection originated by a spe- cific user or originating from a specific client computer. A VPN connection can be discon- nected in one of the following two ways: by the username of the user who originated the connection, or by the tunnel IP address assigned by the VPN server. Just note that only one of these methods can be used at a time.

Answer 27

B. SHVs settings define the requirements for client computers that connect to your net- work. They are configured using the Network Policy Server console. Using this feature allows you to specify different network policies for different sets of health requirements based on a specific configuration of the SHV.

Answer 28

C, E. MS-CHAPv2 provides encrypted and mutual authentication between the respective RRAS locations. MPPE works with MS-CHAPv2 and provides encryption for all of the data between the locations. CHAP provides encrypted authentication, but MS-CHAPv2 is needed for MPPE to work. PAP is the lowest level of authentication providing passwords, but it sends passwords in clear text, which is not the most secure solution. L2TP needs to team up with IPsec to provide the data encryption for the secure transfer of information between the locations.

Answer 29

A. Windows Server 2016 comes with EAP-TLS. This allows you to use public key certifi- cates as an authenticator. TLS is similar to the familiar Secure Sockets Layer (SSL) protocol used for web browsers and 802.1X authentication. When EAP-TLS is turned on, the client and server send TLS-encrypted messages back and forth. EAP-TLS is the strongest authen- tication method you can use. EAP-TLS supports smartcards. EAP-TLS requires your NPS server to be part of the Windows Server 2016 domain.

Answer 30

D, E. PEAP-MS-CHAP v2 is an EAP type protocol that is easier to deploy than EAP-TLS. It is easier because user authentication is accomplished by using password-based credentials (username and password) instead of digital certificates or smartcards. Both PEAP and EAP use certificates with their protocols.

Answer 31

D. One advantage of NPS is that you can use the accounting part of NPS so that you can keep track of what each department does on your NPS server. This way, departments pay for the amount of time they use on the SQL server database. Configuring Network Policy Server Accounting, you can use the following log types: ■■ Event logging: Used primarily for auditing and troubleshooting connection attempts. You can configure NPS event logging by obtaining the NPS server properties in the NPS console. ■■ Logging user authentication and accounting requests to a local file: Used primarily for connection analysis and billing purposes. Also used as a security investigation tool because it provides you with a method of tracking the activity of a malicious user after an attack. You can configure local file logging using the Accounting Configuration Wizard. ■■ Logging user authentication and accounting requests to a Microsoft SQL Server XML- compliant database: Used to allow multiple servers running NPS to have one data source. Also provides the advantages of using a relational database. You can configure SQL Server logging by using the Accounting Configuration Wizard.

Answer 32

A. Connection request policies are sets of conditions that allow network administrators to designate which RADIUS servers perform the authentication and autho- rization of connection requests that the server running NPS receives from RADIUS clients. NPS allows you to set up policies on how your users could log into the network. NPS allows you to set up policies that systems need to follow, and if they don’t follow these poli- cies or rules, they will not have access to the full network.

Answer 33

C. CHAP—as well as MS-CHAPv2 and PAP—allow the client to authenticate itself to the server. This authentication functions much like a regular network logon; once the client presents its logon credentials, the server can figure out what access to grant.

Answer 34

D. Encapsulation allows the client to take a packet with some kind of private content, wrap it inside an IP datagram, and send it to the server. The server, in turn, processes the IP data- gram, routing real datagrams normally and handling any encapsulated packets with the appropriate protocol.

Answer 35

C, D. A VPN Device IP Address is a public-facing IPv4 address of your on-premises VPN device that you’ll use to connect to Azure. The VPN device cannot be located behind a NAT. You need at least one or preferably two publicly visible IP addresses. One of the IP addresses is used on the Windows Server 2016 machine that acts as the VPN device by using RRAS. The other optional IP address is to be used as the default gateway for out- bound traffic from the on-premises network.

Answer 36

B. Windows Server 2016’s VPN support includes several worthwhile features; one is that you can set up account lockout policies for dial-up and VPN users. This capacity has existed for network and console users for some time. When you’re using Windows Server 2016 and enabling the VPN client access, a system policy rule named Allow VPN Clients to Firewall is enabled. This allows a maximum of 1,000 VPN clients to connect simultane- ously in Standard Edition and 16,000 in Enterprise Edition. VPNs do not auto-connect to a network, DirectAccess does auto-connect, and you can connect to a RADIUS server using most Windows clients (not just Windows 10).

Answer 37

D. The client sends a VPN connection request to the server. The exact format of the request varies, depending on whether the VPN is using PPTP, L2TP, or SSTP.

Answer 38

A. Software at each level of the OSI model has to see header information to figure out where a packet is coming from and where it’s going. However, the payload contents aren’t important to most of those components, and the payload is what’s encapsulated. By fabri- cating the right kind of header and prepending it for whatever you want in the payload, you can route foreign traffic types through IP networks with no trouble.

Answer 39

B. The answer to this question would be phase 2, the client answers with an encrypted response. The phases are as follows: 1. The server sends a challenge message to the client. 2. The client answers with an encrypted response. 3. The server checks the response to see whether the answer is right. The challenge- response process allows the server to determine which account is trying to make a connection. 4. The server determines whether the user account is authorized to make a connection. 5. If the account is authorized, the server accepts the inbound connection; any access controls or remote access restrictions still apply.

Answer 40

C. The answer to this question would be phase 2: during the TCP session, SSL negotiation takes place. The phases are as follows: 1. The client connects to the server through the Internet using port 443. 2. During the TCP session, SSL negotiation takes place. 3. During the SSL authentication phase, the client machine receives the server certificate. 4. The client machine will send HTTPS requests on top of the encrypted SSL session. 5. The client machine will then also send SSTP control packets on top of the HTTPS session. 6. PPP negotiation now takes place on both ends of the connection. 7. After PPP is finished, both ends are ready to send IP packets to each other.

Answer 41

A. You can use the PPP tab of the RRAS server’s Properties dialog box to control the PPP layer options available to clients that call in. The settings you specify here control whether the related PPP options are available to clients; you can use remote access policies to control whether individual connections can use them.

Answer 42

D. The Multilink Connections check box is selected by default. It controls whether the server will allow clients to establish multilink connections when they call in

Answer 43

B. A VPN sits between your internal network and the Internet, accepting connections from clients in the outside world.

Answer 44

C. The General tab of the server’s Properties dialog box allows you to specify whether your RRAS server is a router, a Remote Access server, or both. The first step in converting your existing RRAS server to handle VPN traffic is to make sure that the IPv4 Remote Access Server or the IPv6 Remote Access Server check box is selected on this tab.

Answer 45

A. The Remote Access Connections (Inbound Only) check box must be activated in order to accept VPN connections with this port type. To disable a VPN type (for instance, if you want to turn off L2TP), deselect this box.

Answer 46

B. The Maximum Ports control lets you set the number of inbound connections that this port type will support. By default, you get 5 PPTP and 5 L2TP ports when you install RRAS; you can use from 0 to 250 ports of each type by adjusting the number here.

Answer 47

C. Sometimes the simplest solutions are overlooked. The first thing you will want to check is that your clients can make the underlying connection to their ISP.

Answer 48

B. A standard RRAS installation will always log some data locally, but that’s pretty useless unless you know what gets logged and where it goes. Each RRAS server on your network has its own set of logs, which you manage through the Remote Access Logging folder. Within that folder, you’ll usually see a single item labeled Local File, which is the log file stored on that particular server.

Answer 49

A. The Log Errors Only radio button instructs the server to log errors and nothing else. This gives you an adequate indication of problems after they happen, but it doesn’t point out potential problems noted by warning messages.

Answer 50

D. The huge advantage of NAT is the ability for you to share a single public IP address and a single Internet connection between multiple locations using private IP addressing schemes. The nodes on the private network use nonroutable private addresses. NAT maps the private addresses to the public address.

Answer 51

B. To program the route, you would need to use the Route command. To add a route, you would type Route add and the parameters of the route path. route.exe is an MS-DOS executable for Windows. It is used to block IP connections to the system by adding IP addresses to a routing table.

Answer 52

A. Microsoft uses the Routing Information Protocol (RIP) to automatically program routes. RIP is a broadcast-based protocol that can be added to any Microsoft router. The downside to using RIP is the extra broadcast traffic. So if you have only a few routers, it’s best to configure the routes manually. On a large network with many subnets, you may want to consider using RIP.

Answer 53

B. The General tab has a field where you enter the VPN server address or host name. The First Connect group lets you specify which dial-up connection, if any, you want brought up before the VPN connection is established.

Answer 54

D. The Web Application Proxy feature allows applications running on servers inside the corporate network to be accessed by any device outside the corporate network. The pro- cess of allowing an application to be available to users outside of the corporate network is known as publishing.

Answer 55

B. Active Directory Federation Services (AD FS) must always be deployed with WAP. AD FS gives you features such as Single Sign-On (SSO), which allows you to log in one time with a set of credentials and use that set of credentials to access the applications over and over. AD FS also allows you to set up security so that only authorized users can access the applications through AD FS.

Answer 56

C. To establish this connection, DirectAccess uses IPsec and IPv6. IPsec provides a high level of security between the client and the server, and IPv6 is the protocol that the machines use.

Answer 57

A. As with any software package, role, or feature, when you install any one of these, there are always prerequisites that you must deal with. DirectAccess is no different. With DirectAccess Server with Advanced Settings, a public key infrastructure must be deployed.

Answer 58

B. By using Ad Hoc mode, wireless network computers connect directly to each other with- out the use of an access point (AP) or bridge.

Answer 59

D. The Password Authentication Protocol (PAP) is the simplest authentication protocol. It transmits all authentication information in clear text with no encryption, which makes it vul- nerable to snooping if attackers can put themselves between the modem bank and the Remote Access server. However, this type of attack is unlikely in most networks. PAP is the most widely supported authentication protocol, and therefore you may find that you need to leave it enabled.

Answer 60

C. The Add-DAAppServer cmdlet allows an administrator to add a new application server security group to DirectAccess.

Answer 61

D. Remote Access is a server role that provides administrators with a dashboard for man- aging, configuring, and monitoring network access. The Remote Access server role is a logi- cal grouping of Remote Access Service (RAS), Routing, and Web Application Proxy. These technologies are the role services of the Remote Access server role. When you install the Remote Access server role with the Add Roles and Features Wizard or with Windows Pow- erShell, you can install one or more of these role services.

Answer 62

B, D. Connection request policies are sets of conditions and settings that allow admin- istrators to designate which RADIUS servers authenticate and authorize the connection requests that the server running Network Policy Server (NPS) receives from the RADIUS clients. The default connection request policy uses NPS as a RADIUS server and processes all authentication requests locally. If you do not want the NPS server to act as a RADIUS server and process connection requests locally, you can delete the default connection request policy.

Answer 63

G. Deploying the application as a published application on the Remote Desktop server will use no disk space on the tablets. Users will be able to access the application by using Remote Desktop Connections. This will also ensure that the application is isolated from other applications on the tablets. You can use Remote Desktop Connection “redirection” to ensure that the application can access files stored on an internal SSD on the tablets. The redirection enables access to local resources such as drives and printers in a Remote Desk- top Connection.

Answer 64

B. Access policies are a list of roles and the resources with which roles are to be provi- sioned or deprovisioned. Access policies are used to automate the provisioning of target systems to users.

Answer 65

D. The Set-DAClient cmdlet configures the properties related to a DirectAccess (DA) cli- ent. The -ComputerName parameter specifies the IPv4 or IPv6 address, or host name, of the computer on which the Remote Access server computer–specific tasks should be run.

Answer 66

D. Teredo traffic uses UDP port 3544. UDP Port 3544 must be open to ensure that Teredo clients can successfully communicate with the Teredo server.

Answer 67

C. You will first install the Routing and Remote Access Service (RRAS). In the wizard you have to select NAT and then add an interface for NAT. Then, add the public interface to the NAT configuration, right-click NAT, and click New Interface. Select the interface con- nected to the network, and then click OK.