Explanation:
<Step 1: Install the Remote Access role.
Step 2: Import the AD FS certificate to Server2.
Step 3: Run the Web Application Proxy Configuration Wizard.
In Administering Windows Server Hybrid Core Infrastructure, the Web Application Proxy (WAP) component is documented as a role service of the Remote Access role and is deployed on an edge or perimeter server to publish AD FS and other web apps. The guide states that before configuring WAP, you must install the Remote Access role with the Web Application Proxy role service on the proxy server. It further explains that WAP must establish trust with the existing AD FS farm by using the AD FS service communications certificate: "Import the federation service SSL certificate (with private key) on the proxy server and place it in the local computer's personal store." After the certificate is present, you run the Web Application Proxy Configuration Wizard to "specify the Federation Service name, provide AD FS credentials, and complete the trust and configuration." The materials also clarify that you do not install the AD FS role on the proxy and Microsoft Application Request Routing (ARR) is not required for WAP. The AD FS Configuration Wizard applies to federation servers, not proxies. Therefore, the minimal and correct sequence on Server2 is: Install Remote Access (WAP) # Import the AD FS cert # Run the Web Application Proxy Configuration Wizard, which configures the trust and enables publishing of the AD FS endpoint.