70-411(Nps Policies,nap, Radius)

Front 1

is a set of permissions or restrictions that are used by remote access authenticating servers that determine who, when ,and how a client can connect to a network

Back 1

NPS policy

Front 2

A policy that establishes sets of conditions and settings that specify which Radius Servers perform the authentication, authorization, and the accounting of radius messages(connection request) received by the NPS server from its Radius Clients, and it can also be used to designate which Radius Servers are used for Authenticating and Accounting.

Back 2

Connection Request Policy

Front 3

A policy that establishes sets of conditions, constraints, and settings that specify who is authorized to connect to the network and the circumstances under which they can or cannot connect.

Back 3

Network Policies

Front 4

A policy that establishes one or more system health validators and other settings that enable you to define client computer configuration requirements for the Network Access Policy(NAP)-capable computers that attempt to connect to your network.

Back 4

Health Policies

Front 5

These policies are applied to NPS as a RADIUS server or RADIUS proxy.

Back 5

Connection Request Polices

Based on:
.Time of the day and week
.The realm name(user condition)
.The type of connection requested
.The IP address of the Radius Client

Front 6

When you create connection request policies, what parameters do I define?

Back 6

.Type of network access server such as RAS(VPN)
.Condition that specifies who or what can connect to the network based on one or more Radius Attributes
.Settings that are applied to an incoming RADIUS message, such as authentication, accounting, and attribute manipulation.

Front 7

these are processed or forwarded by NPS only if the settings of the incoming message match at least one of the connection request polices configured on the NPS server(RADIUS server)

Back 7

RADIUS Access-Request messages

Front 8

these conditions are on or more RADIUS attributes that are compared to the attributes of the incoming RADIUS-Access Request message

Back 8

Connection request policy of the RADIUS server

Front 9

CONDITIONS USED IN CONNECTION REQUEST POLICIES.

Back 9

1.Username(Group)/Username(Attribute): Designates the user name(realm/domain name) that is used by the access client.

2.Connection Properties(Group) /Access Client Ipv4 Address(Attribute):address of the access client that request access from the Radius Client.

3.Day & Time Restriction(Group) /Day&Time Restriction(Attribute)

4.Identitiy Type(Group)/Identity Type(Attribute):Used to restrict policy to only clients that can be identified through NAP, and give a statement of heald(SOH)

5.RADIUS Client Properties(Group) /Calling Station ID(Attribute):Designates the phone number used by the caller

etc..etc...etc

Front 10

A nps policy evaluates remote connections based on what 3 components?

Back 10

1.Condition
2.Constratints
3.Settings

Front 11

These allow you to control which packets are allowed through a network connection based on IP address.

Back 11

IP Filters

Front 12

What are the six NPS templates that are available in Template Management?

Back 12

1.Radius Clients
2.Remote Radius Server Group
3.Remediation Servers
4.IP Filters
5.Shared Secrets
6.Health Policies

Front 13

This encryption is used with a 40-bit key

Back 13

Basic Encryption(MPPE 40-Bit)

Front 14

This encryption is used with a 56-bit key

Back 14

Strong Encryption(MPPE 56-bit)

Front 15

This encryption is used with a 128-bit key

Back 15

Strongest Encryption(MPPE 128 bit)

Front 16

To stop a NPS server from acting as a radius server(performing authentication on its on)?

Back 16

Delete the default connection request policy

Front 17

To configure a server running NPS to act as a RADIUS PROXY and forward connection request to other RADIUS servers?

Back 17

1.Configure a Remote Radius Server Group
2.Add a New Connection Request Policy that specifies the conditions that must match the radius servers.

Front 18

What are connection request policies' remote connections based on

Back 18

1.Conditions
2.Settings

Front 19

This condition designates the user name(realm name/domain name) and a user account that is used by the access client in the RADIUS message

Back 19

User Name attribute



Group:Username

Front 20

This condition designates the ipv4 address of the Access client the request access from the RADIUS client

Back 20

Access Client IPv4 Address



Group: Connection Properties

Front 21

This condition designates the ipv6 address...

Back 21

Access Client Ipv6 Address



Group: Connection Properties

Front 22

This condition designates the type of framing for incoming packets, such as Point-To-Point Protocol, serial line...etc

Back 22

Framed Protocol



Group: Connection Properties

Front 23

This condition designates the type of service requested

Back 23

Service Type



Group: Connection Properties

Front 24

Designates the type of VPN to use

Back 24

Tunnel Type



Group: Connection Properties

Front 25

Designates the day of the week and time a connection can be made

Back 25

Day & Time Restriction



Group: Day & Time Restriction

Front 26

Used to restrict policy to only clients that can be identified through the special mechanism, such a NAP , and give a statement of health (SOH)

Back 26

Identity Type



Group: Identity Type

Front 27

This condition designates the phone number used by the caller(the access client)

Back 27

Calling Station ID


Group: RADIUS Client Properties

Front 28

Designates the name of the RADIUS Client computer that request authentication.

Back 28

Client Friendly Name


Group: RADIUS Client Properties

Front 29

Specifies the ipv4 or ipv6 address of the RADIUS client that forwarded the connection request to NPS.

Back 29

Client IPV6 or Client IPV4 Address


Group: RADIUS Client Properties

Front 30

Specifies the name of the vendor of the RADIUS client that sends connection request to NPS

Back 30

Client Vendor


Group: RADIUS Client Properties

Front 31

Specifies a character string that is the telephone number of the network access server

Back 31

Called Station ID



Group: Gateway

Front 32

Specifies a character string that is the name of the NAS

Back 32

NAS Identifier


Group: Gateway

Front 33

Designates the IPv4 or IPv6 address for the network access server(Radius Client)

Back 33

NAS IPV4 Address

Group: Gateway

Front 34

NAS Port Type condition specifies the type of media used by the access client, such as analog phone lines, ISDN, VPN connection, IEEE 802.11 wireless, and Ethernet switches

Back 34

NAS Port Type

Front 35

is Microsoft's software for controlling network access for computers based on the health of the host

Back 35

NAP

Front 36

This enforcement method uses DHCP configuration information to ensure that NAP clients remain in compliance

Back 36

DHCP Enforcement


weakest form, because it can be bypassed with static ip addresses or adding a route to the table

Front 37

This enforcement method has been secured by specially configured PKI certificates know as health certificates, which are issued to clients that meet the defined health standards.

Back 37

IPSEC ENFORCEMENT

Front 38

This enforcement method restricts the level of network access that a remote access client can obtain based on the health information that client computer presents when the VPN connection is made

Back 38

VPN ENFORCEMENT

Front 39

This enforcement method has aware network access points, such as network switches, or wireless access points(Deals with a supplicant, authenticator, and authentication server)

Back 39

802.1x ENFORCEMENT

Front 40

This enforcement method allows authorized remote users to connect to resources from any Internet connecting device

Back 40

RD GATEWAY ENFORCEMENT

Front 41

What 3 Things must be configured on the client to execute NAP correctly?

Back 41

1.Nap Agent Service
2.Enforcement group policy
3.Security Center

Front 42

What must be configure on the DHCP that is going to be used with NAP

Back 42

Install the NPS server and configure a connection request policy to the remote radius group

Enable NAP on all scopes

Front 43

How do you configure NAP ENFORCEMENT FOR VPN?

Back 43

1.Install NPS on the VPN Server
2.Configure the VPN server and have it use PEAP-based authentication(MS-chap or peap-tls)
3.Configure the SHV, Health Policy, Network Policy, buy running the nap wizard; Define the computer or user groups, shared secret, radius client(vpn server), remediation servers, and the nap-non capable computers.
4.Enable the DHCP Quarantine Enforcement Client in Group Policy, enable the NAP service and Security Center for the nap-capable clients

Front 44

What do remediation servers typically consist of?

Back 44

1. DHCP server
2.AD RODC/DNS Server
3.WSUS/AV Server

OPTIONAL:

4.Internet Proxy Servers so none compliant clients can access the Internet
5.HRA to issue health certificate

Front 45

To verify a client is running the NAP agent service?

Back 45

cmd: netsh nap client show state

Front 46

What is the strongest enforcement type?

Back 46

IPSEC ENFORCEMENT

Front 47

What is Window's built in SHA?

Back 47

Windows Security Center

Front 48

What defines the requirements for client computers to connect to a network that is connected?

Back 48

SHV(System Health Validator)

Front 49

Which server is used as the Health policy server?

Back 49

NPS

Front 50

Requirements for HRA automatic discovery?

Back 50

1.Client Computers must be running Vista SP1 or XPsp3
2.HRA server must be configured with a SSL Certificate
3.Enable discovery registry key must be on nap client computers
4.DNS SRV records be configured
5.Trusted server group configuration in group policy must be cleared