70-413 Exam Network Access Services 2 — Questions and Answers
Question 1: What is the primary purpose of the Network Location Server (NLS) in a DirectAccess deployment?
- To authenticate DirectAccess clients using digital certificates
- To allow DirectAccess clients to detect whether they are on the internal or external network (Correct answer)
- To assign IPv6 addresses to DirectAccess clients on the corporate network
- To distribute CRL information to DirectAccess clients
Correct answer: To allow DirectAccess clients to detect whether they are on the internal or external network
The NLS is an internal HTTPS server that DirectAccess clients probe; if reachable, the client knows it is on the internal network and suppresses DirectAccess tunnels.
Question 2: How are DirectAccess client configuration settings deployed to Windows client computers in an enterprise environment?
- Via a DirectAccess Client Settings Group Policy Object linked to the client OU (Correct answer)
- Via the Remote Access Server Settings GPO applied at the domain root
- Via a Network Policy Settings GPO configured on NPS
- Via manual registry edits pushed through a login script
Correct answer: Via a DirectAccess Client Settings Group Policy Object linked to the client OU
The DirectAccess setup wizard automatically creates a GPO containing client-side DirectAccess settings, which administrators link to OUs containing the target client computers.
Question 3: Which Windows Server role must be installed on the server designated as a DirectAccess gateway?
- Network Policy and Access Services
- Remote Access (Correct answer)
- Active Directory Certificate Services
- Web Services (IIS)
Correct answer: Remote Access
The Remote Access server role contains the DirectAccess and VPN (RAS) role service, which must be installed and configured to enable DirectAccess gateway functionality.
Question 4: When DirectAccess clients behind NAT devices cannot use Teredo because UDP port 3544 is blocked, what automatic fallback mechanism ensures connectivity?
- The client automatically falls back to IP-HTTPS for connectivity (Correct answer)
- A Teredo relay server is deployed on the internal network to assist
- The client switches to 6to4 tunneling as an alternative
- ISATAP is configured as a secondary tunneling mechanism
Correct answer: The client automatically falls back to IP-HTTPS for connectivity
When Teredo fails due to blocked UDP traffic, DirectAccess clients automatically fall back to IP-HTTPS, which uses TCP port 443 and works through most NAT and firewall configurations.
Question 5: Which PKI requirement must be satisfied before deploying DirectAccess with IPsec in an enterprise environment?
- Self-signed certificates installed only on the DirectAccess server
- Computer certificates issued by an internal CA deployed to both the DA server and all DA clients (Correct answer)
- User certificates obtained from a trusted public certificate authority
- Wildcard certificates covering the entire internal DNS namespace
Correct answer: Computer certificates issued by an internal CA deployed to both the DA server and all DA clients
DirectAccess uses IPsec for tunnel authentication, which requires computer certificates issued by a trusted internal CA to be installed on both the DirectAccess server and all participating client computers.
Question 6: What is the function of the Name Resolution Policy Table (NRPT) in a DirectAccess deployment?
- To block all external DNS lookups while connected via DirectAccess
- To direct DNS queries for internal namespaces to internal DNS servers while using public DNS for external names (Correct answer)
- To cache DNS responses on the DirectAccess server to reduce query latency
- To authenticate DNS queries using DNSSEC for internal zones
Correct answer: To direct DNS queries for internal namespaces to internal DNS servers while using public DNS for external names
The NRPT is a table of rules that maps DNS suffixes to specific DNS servers; it ensures internal names resolve against corporate DNS via DirectAccess tunnels while external names use the client's public DNS.
Question 7: Which Windows client operating system editions support DirectAccess in a Windows Server 2012 R2 environment?
- Windows XP SP3 Enterprise and Windows Vista Business
- Windows Vista Enterprise and Ultimate editions only
- Windows 7 Enterprise or Ultimate and later Enterprise/Education editions (Correct answer)
- Windows 8 Pro and Windows 10 Pro or higher
Correct answer: Windows 7 Enterprise or Ultimate and later Enterprise/Education editions
DirectAccess requires Windows 7 Enterprise or Ultimate (or later Enterprise/Education editions), as these SKUs include the necessary DirectAccess client components and domain-join requirements.
70-413 Exam Network Access Services 2
What is the primary purpose of the Network Location Server (NLS) in a DirectAccess deployment?