Title: Lesson 10: Quiz
Course: RITA MC - ITNW 1354 > Section: Lesson 10: Configuring VPN and Routing

Q: Why are phone lines and ISDN not used today for remote access services (RAS)?
- They’re too expensive.
- They’re not secure enough.
- They create dedicated access.
- They no longer supply acceptable bandwidth.
A: They no longer supply acceptable bandwidth.
Feedback: By todays networking standards and bandwidth requirements, the phone and ISDN system do not have the bandwidth needed. Therefore, this method typically is not used today.

Q: What special hardware configuration should a RAS server have?
- two network interface cards
- a dedicated phone line
- a dedicated Internet connection
- secure access to the Internet
A: two network interface cards
Feedback: Because the remote access computer connects an organizations internal private network with the Internet, the server should have two network cards.

Q: Why would you set Verify Caller ID on a remote dial-up connection for a user?
- for enhanced security
- because you don’t trust the user
- because you want users to call in only from specific numbers
- because it’s the default setting
A: for enhanced security
Feedback: If the Verify Caller ID check box is selected, the server verifies the callers phone number. If the phone number does not match the configured phone number, the connection attempt is denied, assuming that the caller, the phone system between the caller and the server, and the remote access server all support caller ID.

Q: What is the most efficient way to deploy VPN (virtual private network) configurations to hundreds of users?
- Create and distribute a document that explains all the settings.
- Create and distribute an executable file that contains all the settings.
- Configure all the client systems manually.
- Have the users bring in their systems individually for configuration.
A: Create and distribute an executable file that contains all the settings.
Feedback: Configuring multiple clients to connect to a remote server can require a lot of work and you can easily make an error. To help simplify administration of the VPN client into an easy-to-install executable, you can use the RAS Connection Manager Administration Kit (CMAK), which can also be installed as a feature in Windows Server 2012. After an executable file is created that includes all the VPN settings, the executable file is deployed on the client computers.

Q: When would you want to use a split tunnel for users?
- if your users work only from the office
- if your users might compromise security by browsing to insecure sites
- if your users have laptop computers and work from home or office
- if your users often need remote assistance
A: if your users have laptop computers and work from home or office
Feedback: If you want to route your Internet browsing through your home Internet connection rather than go through the corporate network, you can disable the Use Default Gateway on Remote Network option. By disabling this option, you are using a split tunnel.

Q: What term is defined as private data placed in a packet with a header containing routing information that allows the data to traverse a transit network, such as the Internet?
- routing
- VPN
- encapsulation
- tunneling
A: encapsulation
Feedback: Encapsulation is defined as private data encapsulated or placed in a packet with a header containing routing information that allows the data to traverse a transit network, such as the Internet.

Q: What is the result of enabling security on the RRAS interface in your RAS server?
- You can’t connect to the Internet on that interface.
- You can’t ping that interface.
- You can’t provide network address translation (NAT) services to a local-area network.
- You can’t use DHCP.
A: You can’t ping that interface.
Feedback: If you intend instead to use a firewall to protect your RRAS server, do not enable the Enable security on the selected interface by setting up static packet filters option. Also, if you enable this option, by default you cant ping the IP address of the public network adapter because Internet Control Message Protocol (ICMP) packets are blocked by the packet filters.

Q: Why use a VPN for client-to-server connections over the Internet?
- VPN traffic is protected by a firewall.
- VPN traffic is encrypted.
- VPN traffic goes undetected on the Internet.
- VPN traffic is proxy-proof.
A: VPN traffic is encrypted.
Feedback: VPNs link two computers or network devices through a wide-area network (WAN) such as the Internet. Because the Internet is public and considered insecure, the data sent between the two computers or devices is encapsulated and encrypted.

Q: How is data verified when transferred through the Internet?
- by cryptographic checksum
- by RAS callback options
- by correct firewall settings
- by using PPTP for VPN connections
A: by cryptographic checksum
Feedback: Data integrity verifies that the data sent over the VPN connection has not been modified in transit. This is usually done with a cryptographic checksum based on an encryption key known only to the sender and receiver.

Q: Of the four VPN tunneling protocols, which has the weakest encryption?
- L2TP
- IKEv2
- SSTP
- PPTP
A: PPTP
Feedback: PPTP is easy to set up but has weak encryption technology. PPTP-based VPN connections do not provide data integrity (proof that the data was not modified in transit) or data origin authentication (proof that the data was sent by the authorized user).

Q: Which authentication method is weakest (least secure)?
- PAP
- CHAP
- MS-CHAPv2
- EAP-MS-CHAPv2
A: PAP
Feedback: Password Authentication Protocol (PAP) uses plain text (unencrypted passwords). PAP is the least secure authentication and is not recommended.

Q: Which authentication protocol allows you to change an expired password during the connection process?
- PAP
- CHAP
- MS-CHAPv2
- EAP-MS-CHAPv2
A: MS-CHAPv2
Feedback: MS-CHAP v2 is the only authentication protocol that Windows Server 2012 provides that allows you to change an expired password during the connection process.

Q: Which VPN protocol provides constant connectivity?
- L2TP
- IKEv2
- SSTP
- PPTP
A: IKEv2
Feedback: To provide constant connectivity, you use Internet Key Exchange version 2 (IKEv2), which automatically establishes a VPN connection when Internet connectivity is available.

Q: When is it appropriate to use Windows Server 2012 as a router between two networks?
- for heavy traffic on large networks
- for heavy traffic on small networks
- for light traffic on large networks
- for light traffic on small networks
A: for light traffic on small networks
Feedback: Windows Server 2012 is a software-based router that you can use for lightly trafficked subnets on a small network. For more complex network with heavy network traffic, you should use a hardware-based router, which would give you more reliability and improved network performance.

Q: How are routing tables created dynamically?
- through the use of RIP
- with static routes
- by using the routing table protocol (RTP)
- by using a layer 2 switch
A: through the use of RIP
Feedback: The routing tables are manually created with static routes, or are dynamically created with routing protocols such as Routing Information Protocol (RIP).

Q: Which Windows Server 2012 R2 server role is used to install the Web Application proxy for AD FS?
- AD FS
- Remote Access
- Remote Desktop
- Web Services
A: Remote Access
Feedback: The Web Application proxy is a Remote Access role service introduced in Windows Server 2012 R2 that provides reverse proxy functionality for web applications inside an organization network so users can access applications externally no matter what device they are using.

Q: In Windows Server 2012 R2, what is used as a reverse proxy?
- Web Application proxy
- Reverse Lookup
- AD FS proxy
- Reverse Web
A: Web Application proxy
Feedback: A Web reverse proxy is a proxy server that retrieves resources from servers on behalf of a client by publishing internal applications to external users or publishing applications (although mostly external) to internal users. In Windows Server 2012 R2, a reverse proxy is provided by a Remote Access Role service: the Web Application proxy.

Q: Setting up a NAT gateway is an excellent way to provide Internet access to a LAN. What is the best reason for setting up Internet access via NAT?
- to allow multiple computers access to the Internet
- to provide a type of firewall for a group of computers
- to provide proxy services to a LAN
- to use private IP addresses on the LAN
A: to provide a type of firewall for a group of computers
Feedback: NAT enables a LAN to use one set of IP addresses for internal traffic and a second set of addresses for external traffic. The NAT computer or device is usually a router (including routers made for home and small-office Internet connections) or a proxy server. As a result, you can provide a type of firewall by hiding internal IP addresses.

Q: What is the first thing to check when troubleshooting VPN problems?
- network connectivity
- usernames and passwords
- DNS lookups
- firewall settings
A: network connectivity
Feedback: With network connectivity problems, you need to make sure that you are connected to the network and that name resolution works properly. If your VPN connection is to operate over the Internet, make sure that you have Internet access.

Q: For Dial-up RAS connectivity, what is the most secure setting to use?
- deny access
- a static IP address
- verify caller ID
- always call back to a particular number
A: always call back to a particular number
Feedback: When the Always Callback To option is selected, you must specify a number that the server always uses during the callback process. This option helps to make sure that only users from a certain number can call in. If the username and password have been compromised for a user, the user can still call in only from a specified number.

Q: RRAS has multiple options from which you can select one or more services to provide to your users. Select the correct description for the Virtual private network (VPN) access and NAT option.
- sets up the server to provide NAT services to clients on the private network that need to access the Internet
- sets up a demand-dial or persistent connection between two private networks
- sets up the server to support incoming VPN connections and to provide NAT services
- sets up the server to accept incoming remote access connections (dial-up or VPN)
A: sets up the server to support incoming VPN connections and to provide NAT services
Feedback: The Virtual private network (VPN) access and NAT option sets up the server to support incoming VPN connections and to provide NAT services.

Q: RRAS has multiple options from which you can select one or more services to provide to your users. Select the correct description for the Remote access (dial-up or VPN) option.
- sets up the server to provide NAT services to clients on the private network that need to access the Internet
- sets up a demand-dial or persistent connection between two private networks
- sets up the server to support incoming VPN connections and to provide NAT services
- sets up the server to accept incoming remote access connections (dial-up or VPN)
A: sets up the server to accept incoming remote access connections (dial-up or VPN)
Feedback: The Remote access (dial-up or VPN) option sets up the server to accept incoming remote access connections (dial-up or VPN).

Q: RRAS has multiple options from which you can select one or more services to provide your users. Select the correct description for the Secure connection between two private networks option.
- sets up the server to provide NAT services to clients on the private network that need to access the Internet
- sets up a demand-dial or persistent connection between two private networks
- sets up the server to support incoming VPN connections and to provide NAT services
- sets up the server to accept incoming remote access connections (dial-up or VPN)
A: sets up a demand-dial or persistent connection between two private networks
Feedback: The Secure connection between two private networks option sets up a demand-dial or persistent connection between two private networks.

Q: RRAS has multiple options from which you can select one or more services to provide your users. Select the correct description for the Network Address Translation (NAT) option.
- sets up the server to provide NAT services to clients on the private network that need to access the Internet
- sets up a demand-dial or persistent connection between two private networks
- sets up the server to support incoming VPN connections and to provide NAT services
- sets up the server to accept incoming remote access connections (dial-up or VPN)
A: sets up the server to provide NAT services to clients on the private network that need to access the Internet
Feedback: The Network Address Translation (NAT) option sets up the server to provide NAT services to clients on the private network that need to access the Internet.