JN Number: Passing Score: 800 Time Limit: 120 min File Version: 1.0. Vendor: Juniper. Exam Code: JN0-335

Transcription

1 JN0-355 Number: Passing Score: 800 Time Limit: 120 min File Version: Vendor: Juniper Exam Code: JN0-335 Exam Name: Junos Pulse Secure Access, Specialist (JNCIS-SA) Sections 1. Cluster 2. Pulse Connection 3. Administration Configuring 4. HostCheck 5. Troubleshooting

2 Exam A QUESTION 1 When adding a new cluster member, the cluster node state is indicated by a yellow radio button icon in the Admin UI. Which cluster node state is correct? A. The node is enabled, not accepting user requests. B. The node is transitioning. C. The node is enabled, unreachable. D. The node is disabled. Correct Answer: B Section: Cluster /Reference: While the new node synchronizes its state with the existing cluster member, each node s status indicates Enabled, Enabled, Transitioning, or Enabled, Unreachable. QUESTION 2 What are two properties of an active/passive cluster configuration? (Choose two.) A. Cluster VIP B. LAN cluster C. high availability D. WAN cluster Correct Answer: AB Section: Cluster /Reference:

3 QUESTION 3 You are connected with a VPN tunnel on a wired interface and notice that your VPN session drops when you enable your wireless interface. What would cause this drop to occur? A. split tunneling B. route monitor C. split monitor D. route precedence Correct Answer: B

4 Section: Pulse Connection /Reference: QUESTION 4 Which Junos Pulse Secure Access Service component controls the user login URL mapping to the appropriate backend authentication service? A. authentication server B. authentication realm C. resource policy D. sign-in policy Correct Answer: D /Reference: QUESTION 5 A user is mapped to two roles. The first role assigned has a maximum session length of 240 minutes. The second role assigned has a maximum session length of 480 minutes. Which maximum session length in minutes will the user receive? A. 60 B. 240 C. 480 D. 720 Correct Answer: C /Reference: QUESTION 6

5 Which statement accurately describes Host Checker? A. Host Checker is a clientless process that removes residual data, such as temporary files or application caches, left on a user's machine after a Pulse Secure Access session. B. Host Checker is a client-side agent that removes residual data, such as temporary files or application caches, left on a user's machine after a Pulse Secure Access session. C. Host Checker is a clientless process that performs endpoint health and security checks for hosts that attempt to connect to the Pulse Secure Access Service. D. Host Checker is a client-side agent that performs endpoint health and security checks for hosts that attempt to connect to the Pulse Secure Access Service. Correct Answer: D Section: HostCheck /Reference: QUESTION 7 Which statement is true about the MAG Series devices? A. The MAG2600, MAG4610, MAG6610, and MAG6611 have fixed configurations. B. The MAG2600, MAG4610, MAG6610, and MAG6611 have modular configurations. C. The MAG2600 and MAG4610 have fixed configurations and the MAG6610 and MAG6611 have modular configurations. D. The MAG2600 and MAG4610 have modular configurations and the MAG6610 and MAG6611 have fixed configurations. Correct Answer: C /Reference:

6 QUESTION 8 You have configured VPN Tunneling using Junos Pulse with minimal components and deployed it to your employees. You decide to configure a Host Checker policy for your employees and apply it to their role. Which behavior will the user experience on the client machine the next time they sign in using Junos Pulse? A. Junos Pulse will prompt the user with a certificate warning. B. Junos Pulse will prompt the user to install Host Checker. C. Junos Pulse will prompt the user to sign in using the Web UI. D. Junos Pulse will prompt the user to upgrade the Junos Pulse client software. Correct Answer: D Section: Pulse Connection QUESTION 9 What are three benefits of choosing Junos Pulse for VPN tunneling? (Choose three.) A. Endpoint security is integrated with Junos Pulse.

7 B. ESP transport methods are available for Windows, Macintosh, and Linux platforms. C. WSAM integration is available for Microsoft Windows platforms. D. Support is available for a variety of mobile devices. E. SSL transport methods are available for Linux platforms. Correct Answer: ACD Section: Pulse Connection /Reference: QUESTION 10 You want to use Host Checker to verify that users have a specific version of application software. Which two Host Checker rules in the Admin UI would achieve this? (Choose two.) A. Predefined RulE. OS Checks B. Custom RulE. Patch Assessment C. Custom RulE. Registry Setting D. Custom RulE. NetBIOS Correct Answer: BC Section: HostCheck /Reference:

8 QUESTION 11 You want to restrict role access to only users who have the required client certificate and pass a Host Checker policy. Which two methods in the Admin UI would set this restriction? (Choose two.) A. Enable the Host Checker and certificate role restrictions. B. Require and enforce the Host Checker and certificate authentication policies. C. Use a custom expression to map users to the role based on the client certificate and Host Checker policy. D. Use Secure Virtual Workspace to restrict access to the role based on the client certificate and Host Checker policy. Correct Answer: AC /Reference:

9 QUESTION 12 You want to create a Host Checker policy that prevents a user with an Apple ios device from connecting to the network if the device limitations imposed by Apple have been altered or removed. Which Host Checker rule type in the Admin UI should you create? A. Predefined RulE. Mobile Security Suite (MSS) B. Predefined RulE. Rooting Detection C. Predefined RulE. Jail Breaking Detection D. Predefined RulE. Check Operating System Correct Answer: C /Reference:

10 QUESTION 13 A customer requires licensing to support a total of 1,000 concurrent users for a new Junos Pulse Secure Access Service cluster deployment consisting of two nodes. The Junos Pulse Secure Access Service will run software release 7.2. What is the minimum license configuration needed to support this requirement? A. one 500-user ADD on the first node and one 500-user CL license on the second node "First Test, First Pass" Juniper JN0-355 Exam B. one 1000-user ADD on the first node and one 500-user CL license on the second node C. two 500-user ADD licenses, one on each node D. two 1,000-user ADD licenses distributed equally across the two nodes Correct Answer: C Section: Cluster /Reference:

11 QUESTION 14 You would like to set up a meeting using Junos Pulse Collaboration for the Sales division tomorrow morning. In the user interface, which setting should you select? A. Instant Meeting B. Support Meeting C. Schedule Meeting D. Join Meeting Correct Answer: C /Reference: QUESTION 15 You want to use ESP for your VPN Tunneling transport mechanism. Which port must you have open on your firewall to the Junos Pulse Secure Access Service in a default configuration? A. UDP 500 B. TCP 500 C. UDP 4500 D. TCP 4500 Correct Answer: C Section: Pulse Connection /Reference:

12 QUESTION 16 The Junos Pulse client connects to which two Juniper Networks services? (Choose two.) A. Junos Pulse Secure Access Service B. Junos Pulse Access Control Service C. Unified Threat Management D. Intrusion Detection Prevention Correct Answer: AB /Reference: QUESTION 17 You are logged in to the Junos Pulse Secure Access Service on your laptop using the wired connection on your docking station. You undock your machine and move over to a wireless network and your session does not reconnect. Why did this happen? A. The browser request follow through was disabled. B. The roaming session was disabled. C. The persistent session was disabled. D. The enable session extension was disabled. Correct Answer: B Section: Pulse Connection /Reference:

13 QUESTION 18 Which two server instances would be used as secondary authentication servers on the Junos Pulse Secure Access Service? (Choose two.) A. RADIUS server B. anonymous server C. Active Directory server D. certificate server Correct Answer: AC QUESTION 19 Which two statements describe the functionality of the client standalone installer? (Choose two.) A. All Windows clients are available as standalone installers, except Host Checker. B. Juniper Installer Service client deployment requires administrative privileges. C. Juniper Installer Service client can be deployed using the automated Microsoft Systems Management Server (SMS) service. D. Clients deployed using Juniper Installer Service require post-installation machine reboot. Correct Answer: BC QUESTION 20 Which statement is correct about VPN tunneling clients? A. Network Connect supports the use of client certificates on Windows and Linux systems only. B. The Junos Pulse client supports the use of client certificates on Windows systems only. C. Network Connect supports the use of client certificates on smart phones and PDAs. D. Junos Pulse supports the use of client certificates on ios and Android OS devices. Correct Answer: D Section: Pulse Connection QUESTION 21 Which three elements are required to deploy the Service Provider Edition (SPE) virtual appliance? (Choose three.) A. a MAG Series device acting as license server

14 B. user subscription licensing C. a server that hosts the virtual appliances D. LDAP authentication E. Device Management Interface (DMI) Correct Answer: ABC /Reference: QUESTION 22 You must perform daily backup operations of logging information as well as configuration. What should you choose in the Admin UI to achieve this? A. Syslog B. Local Backups C. SNMP D. Archiving Servers Correct Answer: D /Reference:

15 QUESTION 23 A user is currently not able to sign in to the Junos Pulse Secure Access Service. LDAP authentication is currently configured for all users. You run a TCP dump during the authentication attempt and notice that the response from the LDAP server lists resultcode. invalidcredentials (49).

16 Which type of issue is the user experiencing? A. authentication B. authorization C. resource policy D. role restriction Correct Answer: A Section: Troubleshooting /Reference: QUESTION 24 A Web site is available to all users but it does not display correctly when using basic Web access. You want to provide an alternate method for accessing the Web site through the Junos Pulse Secure Access Service while continuing to provide all other Web content using basic Web access. In the Admin UI, which two actions must be performed for users to access the Web site? (Choose two.) A. Create a Web Proxy policy. B. Create a Do Not Rewrite Selective Rewrite policy. C. Configure Junos Pulse to provision Layer 3 access. D. Configure a proxy connection on your browser. Correct Answer: BC Section: Troubleshooting /Reference: QUESTION 25 You must plan the deployment of Junos Pulse to hundreds of end users on various client platforms including Windows laptops, smartphones running Google Android, and ipad users. What are three delivery methods that you would use to complete this task? (Choose three.) A. Users can connect to the Secure Access Gateway Web portal and install Junos Pulse from the start page. B. You can distribute a default installer to endpoints, install it, and let users create their own connections. C. You can configure a Host Checker policy to detect if Junos Pulse is installed and deliver the installation to the endpoint during pre-authentication. D. Smartphone users can download the Junos Pulse installer from the mobile application section of the Web portal start page. E. You can create an.msi installer that contains connection settings and services along with the Junos Pulse installer and deliver this to endpoints using a software distribution process. Correct Answer: ABE /Reference: QUESTION 26 Your customer requires some users to be mapped to a specific role. The Active Directory (AD) administrator frequently changes users from one AD group to another. Which role mapping rule type should you use?

17 A. the user's group membership returned by the realm's authentication server B. the result of a host check rule for machine certificate C. the authentication realm accessed D. the user's username and NetBIOS name Correct Answer: A QUESTION 27 As an administrator, what would you do to synchronize the state after configuring a license server on a virtual application? A. Pull the leasing state from the license server on the virtual appliance. B. Copy the leasing state from the license server on the virtual appliance. C. Push the leasing state from the license server to the virtual appliance. D. Post the leasing state from the license server to the virtual appliance. Correct Answer: A QUESTION 28 You are implementing several Host Checker policies on your users, however, you must block access to a specific Web server when users fail one specific Host Checker policy. Which Host Checker implementation allows you to satisfy this requirement? A. Implement your Host Checker policy as an initial policy (pre sign-in). B. Implement your Host Checker policy at the authentication realm to evaluate only. C. Implement Host Checker policies at the user role where the users with different Web access requirements belong to different roles with different Host Checker policies defined. D. Implement a Web access resource policy that contains a detailed rule with conditions on specific Host Checker policies as conditions for access. Correct Answer: C Section: HostCheck /Reference: QUESTION 29 You are performing initial configuration steps on a MAG Series Junos Pulse Service Gateway using the serial cable that came with the appliance. You have connected one end of the cable to the serial port on a PC and you need to connect the other end to the appliance. There are several ports on the front of the MAG Series chassis. Which port must you use? A. USB port B. serial terminal port C. A0 D. console port

18 Correct Answer: D QUESTION 30 Which statement about Public Key Infrastructure (PKI) is true? A. PKI negotiates a secure connection between a client and a server. B. PKI specifies the use of a shared key. C. PKI uses digital certificates to bind public keys to an entity. D. PKI requires the use of a certificate authority and a registration authority. Correct Answer: C QUESTION 31 You are asked to deploy Windows (RDP) and Citrix terminal services for a large financial firm. The customer requests that you enable role terminal service security settings. In the Admin UI, which two restriction settings apply? (Choose two.) A. Control access to printers B. Control wireless machine interface C. Control client access to external drives D. Deny access to Oracle Expense reporting application Correct Answer: AC /Reference: QUESTION 32 Which statement describes how the JunOS Pulse Secure Access Service processes cookies? A. The device intercepts all cookies sent by internal servers and replaces them with session cookies. B. The device intercepts all cookies sent by Junos Pulse clients and replaces them with session cookies. C. The device intercepts all cookies sent by internal servers and replaces them with persistent cookies. D. The device intercepts all cookies sent by internal servers based on the defined Web Caching policy. Correct Answer: A /Reference:

19 QUESTION 33 You have just created a Host Checker policy that limits role access to only users who sign in with companyissued computers. All users who do not pass the policy will be remediated to a different role with fewer features. Which two steps in the Admin UI must you configure to enforce the policy? (Choose two.) A. For the Host Checker Authentication Policy, choose "Require and Enforce". B. For the Host Checker Authentication Policy, choose "Evaluate Policies". C. For the Host Checker Role Restriction, allow all users. D. For the Host Checker Role Restriction, allow only users who meet the selected Host Checker policy. Correct Answer: BD Section: HostCheck /Reference: QUESTION 34 What are two characteristics of active/active clustering? (Choose two.) A. clustering of up to four nodes B. load balancing C. cluster synchronization using the external port D. failover using a virtual IP (VIP) address Correct Answer: AB Section: Cluster /Reference: QUESTION 35 In the Admin UI, which two connection types are in a Junos Pulse connection set? (Choose two.) A. SSL VPN or UAC (L3) B. Netscreen Firewall C. UAC (802.1X) D. ipass Mobile Connect Correct Answer: AC Section: Pulse Connection /Reference:

20 QUESTION 36 You are attempting to sign in to the Junos Pulse Secure Access Service and receive the error, You are not allowed to sign in. Which two restrictions would cause this issue? (Choose two.) A. You are missing a required client certificate. B. The administrator forgot to assign you any roles. C. You are not allowed to access resources. D. You typed an invalid username or password. Correct Answer: AB QUESTION 37 You are asked to add another gateway to an existing three-unit SA cluster. Which two actions should you perform? (Choose two.) A. Add a new cluster member, IP addresses, and default gateways under the existing cluster definition. B. Upgrade the new cluster member to match the same software release of the cluster. C. Set the existing cluster to active/passive state. D. Configure cluster name, cluster password, and existing member address on the new cluster member. Correct Answer: AD Section: Cluster /Reference:

21 If you add the Secure Access Service running a previous version service package to a cluster, the Secure Access Service automatically detects the mismatch, gets the newer package from the cluster, and joins the cluster QUESTION 38 A customer wants to implement X.509 certificate authentication on their users. They want to extract the username from each certificate for accounting and single sign-on purposes. The correct username syntax lies within the common name portion of the certificate's subject field. Which username template should you use on the certificate authentication server's configuration? A. <certdn.cn> B. <certdn.sn> C. <certattr.altname.cn> D. <certattr.altname.sn> Correct Answer: A /Reference:

22 QUESTION 39 How are Web access policies processed by the Junos Pulse Secure Access Service? A. Web access policies are processed in a top-down fashion for the first match. B. Web access policies are processed in a top-down fashion for the last match. C. Web access policies are processed in a top-down fashion for the best match. D. Web access policies are processed in a top-down fashion for all possible matches. Correct Answer: A /Reference: QUESTION 40 You want to ensure that untrusted computers that connect the Junos Pulse Secure Access Service have residual data removed after the user session is complete. Which two Endpoint Security features in the Admin UI achieve this? (Choose two.)

23 A. Cache Cleaner B. Host Checker C. Secure Virtual Workspace (SVW) D. Enhanced Endpoint Security (EES) Correct Answer: AC QUESTION 41 What does Junos Pulse Collaboration provide? A. group instant messaging services B. Web-based meeting services C. corporate file sharing services D. conference call services Correct Answer: B /Reference: QUESTION 42 You are the presenter of a Junos Pulse Collaboration meeting and attendees indicate that the presentation seems to have a problem with color quality. How would you resolve this issue? A. Stop sharing the application and try to reshare again. B. Enable True Color Presentations in the meeting. C. Reboot the MAG Series device. D. Enable True Color Presentations globally. Correct Answer: D /Reference: QUESTION 43 You are configuring the Junos Pulse client to be installed and launched the first time the user logs in to the Junos Pulse Secure Access Service start page. What should you do? A. Under the User Role > VPN Tunneling; select Junos Pulse and Auto-launch. B. Under Junos Pulse > Connections; your connection set, select Dynamic connections. C. Under Junos Pulse > Connections; create a connection set of the SA or IC type. The client will be installed

24 and executed automatically. D. Under Junos Pulse > Components; your component set, select All components. Correct Answer: A Section: Pulse Connection /Reference: QUESTION 44 Which Junos Pulse Secure Access Service element controls the location awareness rules settings for the Junos Pulse client? A. Junos Pulse component set B. Junos Pulse connection set C. User role restrictions D. User role session options Correct Answer: B /Reference:

25 QUESTION 45 The Junos Pulse client for ipad supports which three types of host checks? (Choose three.) A. jailbreak detection B. virus detection enabled C. operating system version D. Mobile Security Suite (MSS) registration E. firewall enabled Correct Answer: ACD Section: HostCheck /Reference: QUESTION 46 You are asked to perform an automatic two-unit cluster upgrade. Which action must you perform? A. Remove the backup node from the cluster prior to upgrading the code. B. Upgrade both cluster nodes to the new software release. C. Delete all active user sessions. D. Use Central Manager to perform the cluster upgrade. Correct Answer: D QUESTION 47 Which sequence describes the processing order when a user authenticates to a Junos Pulse Secure Access Service?

26 A. sign-in policies, roles, authentication realms, resource policies B. sign-in policies, authentication realms, resource policies, roles C. sign-in policies, resource policies, roles, authentication realms D. sign-in policies, authentication realms, roles, resource policies Correct Answer: D QUESTION 48 A Junos Pulse Secure Access Service has a device certificate issued for sa.pulse.local. Users accessing sales.pulse.local and finance.pulse.local receive a certificate warning any time they access the Junos Pulse Secure Access Service. As an administrator, which two actions would resolve the issue? (Choose two.) A. Install a wildcard certificate for *.pulse.local. B. Remove the sa.pulse.local device certificate. C. Install certificates for sales.pulse.local and finance.pulse.local on the same interface. D. Load multiple server certificates (one for each hostname), and create a virtual port to associate the specific URL. Correct Answer: AD QUESTION 49 Which two features does the Junos Pulse Secure Access Service offer that enhance security on the corporate network? (Choose two.) A. enforcement of endpoint compliance B. secure OSPF routing C. firewall filtering D. support for multiple client types Correct Answer: AC /Reference: QUESTION 50 What are two operational functions of the VPN Tunneling client? (Choose two.) A. It provides the ability to select applications that use a tunneling service. B. It supports dual transport modes, ESP or SSL C. It supports Windows domain single sign-on. D. It requires Web browser-based user authentication. Correct Answer: BC Section: Pulse Connection /Reference:

27 QUESTION 51 You want to use canonical formats to specify the following resource for a resource policy: :80/employee/% Which directory path matches this resource? A :80/employee/payroll/data.html B. C :80/employee/data.html D. Correct Answer: C /Reference: * Matches ALL characters % Matches any character except dot (.)? Matches exactly one character QUESTION 52 How are user role-mapping rules processed by the Junos Pulse Secure Access Service gateway? A. All rules are processed in a top-down fashion for the best match. If no match is found, the user is not allowed to sign in to the realm. B. All rules are processed in a top-down fashion for the best match. If no match is found, the user is assigned to the default role. C. All rules are processed in a top-down fashion for all eligible matches. If no match is found, the user is not allowed to sign into the realm. D. All rules are processed in a top-down fashion for all eligible matches. If no match is found, the user is assigned to the default role. Correct Answer: C /Reference: Wenn keine Stop Regel definiert ist QUESTION 53 You want to create a policy that grants access only to the server directory called Sales and access inside that directory only to.doc files. Which two policies will satisfy the requirement? (Choose two.) A. \\ \sales\*.doc B. \\ \sales\%.doc C. \\ \%sales%\*.doc D. \\ \*\%.doc Correct Answer: AB

28 /Reference: * Matches ALL characters % Matches any character except dot (.)? Matches exactly one character QUESTION 54 You are asked to set up Junos Pulse Secure Access Service in a high availability, active/active cluster configuration. In the Admin UI, which two cluster settings are available? (Choose two.) A. Internal VIP B. Member Name C. Synchronize user-defined bookmarks D. Synchronize log messages Correct Answer: BD Section: Cluster /Reference:

29 QUESTION 55 A Network Connect (NC) user attempts to start a VPN tunnel and receives the error message shown below: "The secure gateway denied the connection request from this client". What are two reasons why this error would occur? (Choose two.) A. There is no IP address pool defined for the user's role in the NC Connection Profile. B. A firewall is blocking access between the client and Secure Access Gateway. C. The DHCP server configured to assign IP Addresses in the NC Connection Profile is not responding. D. A DNS profile has not been configured in the NC Connection Profile. Correct Answer: AC

30 QUESTION 56 You are deploying a VPN tunneling client and are asked to configure a restrictive set of tunneling policies. In the Admin UI, which two VPN Tunneling role settings apply? (Choose two.) A. Split Tunneling B. VPN Tunneling Access Control C. Route Monitor D. Connection Settings Correct Answer: AC Section: Pulse Connection /Reference: QUESTION 57 Which two types of traffic does the Host Checker connection control policy block on the client? (Choose two.) A. all incoming TCP traffic B. all outgoing TCP traffic C. all outgoing DNS traffic D. all incoming UDP traffic Correct Answer: AD Section: HostCheck /Reference:

31 QUESTION 58 Certain users within your organization have an LDAP attribute named userattr.employeelevel. You want to map these users to a specific role if the value of the attribute is 65 or higher. In the Admin UI, which role mapping rule type will perform this operation? A. Username B. Group Membership C. Custom Expression D. Certificate Attribute Correct Answer: C /Reference:

32 QUESTION 59 The MAG Series Junos Pulse Gateway provides which three functions? (Choose three.) A. deep packet inspection B. centralized policy management C. dynamic routing D. check compliance E. authenticate users Correct Answer: BDE QUESTION 60 Which three describe clustering on the MAG Series Junos Pulse Gateway? (Choose three.) A. load balancing B. configuration synchronization C. aggregate interfaces D. high availability E. WAN support

33 Correct Answer: ABD Section: Cluster QUESTION 61 Which two statements describe the Content Intermediation Engine (CIE)? (Choose two.) A. The CIE is responsible for the redirect function. B. The CIE is responsible for processing incoming requests and outgoing content. C. The CIE rewrites Web content. D. The CIE rewrites application content using Junos Pulse. Correct Answer: BC /Reference: CIE Overview One of the core technologies that Secure Access offers is the Content Intermediation Engine (CIE), a highly advanced parser and rewriter. The CIE retrieves Web-based content from internal Web servers and changes URL references and Java socket calls so that all network references point to Secure Access. For instance, when an authenticated user clicks a link, the request goes to Secure Access. Secure Access performs intermediation by parsing the incoming link to determine the internal destination server and then forwarding the request to that internal server on behalf of the end-user. In other words, Secure Access acts as the internal server to the end-user and acts as an end-user to the internal server. This intermediation process provides protection and clear separation between end-users and internal resources. In order to successfully intermediate Web applications, the CIE must successfully locate all links within a page and rewrite them accurately. This document provides guidelines to Web application developers and user interface designers for creating Web applications that the CIE can successfully intermediate. The document provides general recommendations, lists the content-types that Secure Access supports, the level of support that Secure Access provides for each of the content types, and the language constructs to avoid. Note: The Content Intermediation Engine does not intermediate all types of links. For instance, it does not intermediate ftp, rtsp, mms, and mailto links. Content Types Supported Through the CIE The Content Intermediation Engine fully supports Web applications written in standard HTML, JavaScript, VBscript, and Java. There are a few corner cases, however, in which these content types are sensitive to intermediation and parsing. If this document does not contain information about a content type, the Content Intermediation Engine does not officially support it, but the content type may still work through Secure Access. QUESTION 62 What does Secure Virtual Workspace (SVW) provide? A. a virtual desktop on a client desktop B. protected file storage on a remote server C. a protected workspace on a client virtual machine D. a protected workspace on the client desktop Correct Answer: D

34 /Reference: The Secure Virtual Workspace guarantees the integrity of Secure Access session data on a client machine running Windows 2000 or Windows XP by creating a protected workspace on the client desktop. By enabling the Secure Virtual Workspace, you ensure that any end-user signing in to your intranet must perform all interactions within a completely protected environment. If the user s applications and interactions result in data being written to disk or to the registry, the Secure Virtual Workspace encrypts that information. When the Secure Access session is complete, the Secure Virtual Workspace destroys all information pertaining to itself or to the session, by default. However, you can configure the state of this type of information to suit your particular needs. For example, you might decide to allow data to persist across Secure Virtual Workspace sessions. QUESTION 63 Which three actions are performed when configuring WSAM for Junos Pulse? (Choose three.) A. Configure a WSAM resource profile. B. Enable route monitor in the user role. C. Enable Junos Pulse in the User role. D. Configure a Junos Pulse client connection and component set. E. Under the user role, SAM, select the Auto-launch Secure Application Manager box. Correct Answer: ACE /Reference: QUESTION 64 Remote access users must maintain connectivity to printers on their local network when they launch their VPN tunnel and are connected with split tunneling disabled. In the Admin UI, which VPN Tunneling setting would allow this? A. Enable Tunnel routes under Route Precedence. B. Enable Route Monitor. C. Enable Endpoint routes under Route Precedence.

35 D. Disable Route Monitor. Correct Answer: C Section: Pulse Connection /Reference: QUESTION 65 Which platform supports the Junos Pulse Secure Access Service? A. MX Series B. SRX Series C. MAG Series D. EX Series Correct Answer: C /Reference: QUESTION 66 You have just launched a meeting using Junos Pulse Collaboration. You examine the Collaboration toolbar and notice several buttons. Which three features are available? (Choose three.) A. Voice B. Chat C. Annotation D. Upload File E. Meeting Info Correct Answer: BCE /Reference:

36 QUESTION 67 Which two statements about certificate-based authentication are true? (Choose two.) A. Certificate-based user authentication requires OCSP with CRL as a backup. B. Certificate-based user authentication requires CRL. C. Certificate-based authentication might require user input during the login process. D. Certificate attributes can be used to assign users to roles. Correct Answer: CD QUESTION 68 You are asked to configure enterprise Web services access. In the Admin UI, which two Web role actions apply? (Choose two.) A. Add bookmarks. B. Allow automount shares. C. Auto-launch Secure Application Manager.

37 D. Mask host names while browsing. Correct Answer: AD /Reference: QUESTION 69 You have configured a Web Resource Profile to allow access to your company's Intranet site and assigned the Web role to the profile. A bookmark to the site was configured and will be displayed on the user's start page. You also enabled the Web URL browse bar. You did not modify any of the default auto-allow policies. What will users in the Web role be able to access? A. Users will not be able to access any Web sites. B. Users will have access to any Web site in the domain. C. Users will only have access to the bookmark on the start page. D. Users will need the administrator to create additional bookmarks to access other sites. Correct Answer: B /Reference: QUESTION 70 You want to create a VPN tunneling role that allows access to the corporate network but still allows users to access the Internet outside of the VPN tunnel. In the Admin UI, which VPN tunneling policy must you configure? A. Access Control B. Connection Profile C. Bandwidth Management D. Split-Tunneling Networks

38 Correct Answer: D Section: Pulse Connection QUESTION 71 Which two statements are true about Online Certificate Status Protocol (OCSP)? (Choose two.) A. OCSP provides real-time certificate verification. B. The Revocation Checking option must be disabled in OCSP. C. OCSP must have the Allow Clock Discrepancy field set to zero. D. The Junos Pulse Secure Access Service is an OCSP client. Correct Answer: AD /Reference: QUESTION 72 Users access the Junos Pulse Secure Access Service from home using a specific connection. When the same users access secured resources in the office, they must connect to the Junos Pulse Access Control Service using a different connection. You want to make the user connection automatic when they launch Junos Pulse. Which Junos Pulse feature should you configure? A. Connection Awareness B. Location Awareness C. Location Services D. Connection Services Correct Answer: B Section: Pulse Connection /Reference: QUESTION 73

39 You are asked to configure a user's bookmark page to present the appropriate customer-facing corporate branding. Which two user interface role configurations apply? (Choose two.) A. corporate logo image B. corporate font type C. text color D. Flash video message Correct Answer: AC /Reference: QUESTION 74 A customer wants to verify that users satisfy a minimum Windows operating system and service pack (SP) level. Which type of endpoint security policy would be the simplest way to verify this? A. Use a Host Checker policy with a rule type of "PredefineD. OS Checks." B. Use a Host Checker policy with a rule type of "Custom: Patch Assessment." C. Use a realm authentication policy to verify user-agent strings sent by the user's browser. D. Use a role restriction policy to verify user-agent strings sent by the user's browser. Correct Answer: A Section: HostCheck /Reference:

40

41 QUESTION 75 In a SAML profile, which two SSO methods are used to communicate with the SAML server? (Choose two.) A. Push

42 B. Artifact C. Pull D. Post Correct Answer: BD /Reference: QUESTION 76 You are configuring a Web resource policy and you want to ensure that a user can only access the URL intranet.example.com/employees and exactly one level below /employees. Which policy will satisfy this requirement? A. B. C. D. Correct Answer: D /Reference: * Matches ALL characters % Matches any character except dot (.)? Matches exactly one character QUESTION 77 You have just upgraded the Junos Pulse Secure Access Service, but now Host Checker is not operational. Host Checker functioned normally before the upgrade. Which Host Checker setting should you verify is enabled in the Admin UI?

43 A. Perform dynamic policy reevaluation B. Endpoint Security Assessment Plug-In (ESAP) versions C. Auto-update virus signatures list D. Auto-upgrade Host Checker Correct Answer: D /Reference: QUESTION 78 What are three reasons for using certificates? (Choose three.) A. for role mapping B. to acquire an IP address C. for server authentication D. for user authentication E. for ESP negotiation Correct Answer: ACD QUESTION 79 Which three statements describe virtual desktops? A. Virtual desktops enable users to run personal computer instances on a remote central server. B. Virtual desktops remove workspace data when a session ends. C. Virtual desktops provide a real-time malware scan and remove the malware if detected. D. Virtual desktops lower administrative, support, and hardware costs associated with individual PCs. E. Virtual desktop support includes Citrix XenDesktop. Correct Answer: ADE

44 /Reference: QUESTION 80 Referring to the exhibit, which two statements are correct? (Choose two.) IVE - [ ] Root::System()[] - License Server Protocol Error: Code=(0x23) Error="No Such Client" A. The lease client ID does not match to the one configured on the licensing server. B. The lease client ID is not configured on the licensing server. C. The time difference on the lease client and licensing server is more than 3600 seconds. D. The lease client ID is not yet registered to the licensing server. Correct Answer: BD Section: Troubleshooting /Reference: QUESTION 81 After performing the initial configuration, you browse to the Admin sign-in page for the first time and a certificate error is displayed as shown in the exhibit. What is causing this error? A. The device is using an SSL certificate that has expired. B. The device certificate is using an invalid cipher. C. The device certificate authority has been revoked. D. The device is using a self-signed certificate. Correct Answer: D Section: Troubleshooting /Reference:

45 QUESTION 82 You are unable to access a Web page through the Junos Pulse Secure Access Service. You run a policy trace in the Admin UI to troubleshoot the issue. Referring to the exhibit, what is causing the issue? Info PTR /04/25 20:53:35 - SA - [ ] - Root::hugo(LDAPRealm)[All Employees] - Evaluating Policy Rule 1... Info PTR /04/25 20:53:35 - SA - [ ] - Root::hugo(LDAPRealm)[All Employees] - Condition [( logintime.dayofweek = (Sat TO Sun) AND logintime = (8:00AM TO 5:00PM)) OR groups = 'Clockworks']evaluated to false Info PTR /04/25 20:53:35 - SA - [ ] - Root::hugo(LDAPRealm)[All Employees] - No Policy Rule applies to resource [etc...] Info PTR /04/25 20:53:35 - SA - [ ] - Root::hugo(LDAPRealm)[All Employees] - Evaluating Policy Rule 1... Info PTR /04/25 20:53:35 - SA - [ ] - Root::hugo(LDAPRealm)[All Employees] - Action [Deny access] is returned Info PTR /04/25 20:53:35 - SA - [ ] - Root::hugo(LDAPRealm)[All Employees] - Policy [Pulse, Inc. Intranet] applies to resource A. A role restriction is denying access to the resource. B. A detailed rule is denying access to the resource. C. The resource policies are not in the proper order. D. A Host Checker policy is limiting access to the realm. Correct Answer: A Section: Troubleshooting /Reference: QUESTION 83 A user should be able to access a Web resource but instead is receiving an error that access to the site is blocked. Referring to the exhibit, which policy must be modified to allow access to the resource? Root::user1(patch management)[web Users] - Start Policy [WEBURL/REWRITING] evaluation for resource Root::user1(patch management)[web Users] - Applying Policy [Initial Rewrite Policy]... Root::user1(patch management)[web Users] - Action [Rewrite Content (auto-detect content type)] is returned Root::user1(patch management)[web Users] - Policy [Initial Rewrite Policy] applies to resource Root::user1(patch management)[web Users] - Passthrough proxy policies are not applicable for Root::user1(patch management)[web Users] - Start Policy [WEBURL/ACCESS] evaluation for resource Root::user1(patch management)[web Users] - Applying Policy [Web]... Root::user1(patch management)[web Users] - Evaluating Policy Rule 1... Root::user1(patch management)[web Users] - Resource filter [ does not match Root::user1(patch management)[web Users] - No Policy Rule applies to resource Root::user1(patch management)[web Users] - Applying Policy [Initial Open Policy]... Root::user1(patch management)[web Users] - User roles [Web Users] do not match with configured roles [Exclusive:Web Users] Root::user1(patch management)[web Users] - No Policy applies to resource Root::user1(patch management)[web Users] - Start Auto Allow evaluation on WEBURL for resource Root::user1(patch management)[web Users] - No Auto Allow resources configured

46 A. pass-through proxy policy B. initial open policy C. selective rewrite policy D. initial rewrite policy Correct Answer: B Section: Troubleshooting /Reference: QUESTION 84 You must perform daily backup operations of logging information as well as configuration. What should you choose in the Admin UI to achieve this? A. Syslog B. Local Backups C. SNMP D. Archiving Servers Correct Answer: D QUESTION 85 Referring to the exhibit, which statement is correct? A. A role-mapping rule has not been defined for the user. B. The user has mistyped their username or password. C. The authentication server that the user is authenticating to has rejected their credentials. D. The user has attempted to sign in using an invalid authentication server. Correct Answer: A Section: (none) /Reference: QUESTION 86 Which two statements are correct regarding the MAG6611 Junos Pulse Gateway in an active/active cluster configuration? (Choose two.)

47 A. Virtual IP (VIP) is available. B. It supports up to two devices. C. It supports up to four devices. D. External load balancing is preferred. Correct Answer: CD Section: Cluster QUESTION 87 What is the function of the smart caching setting within a Web caching policy? A. to send the cache control compress header to the client B. to remove the cache control headers from the origin server C. to not modify the cache control header from the origin server D. to send the appropriate cache control header based on Web content. Correct Answer: D /Reference: QUESTION 88 You have configured RADIUS authentication on the Junos Pulse Secure Access Service. Users report that their authentication is rejected. The RADIUS administrator reports that the RADIUS server requires a specific attribute that identifies the Junos Pulse Secure Access Service on the RADIUS server. In the Admin UI, which configuration parameter will address this issue? A. Name B. NAS-Identifier C. RADIUS Server D. Shared Secret Correct Answer: B /Reference:

48 QUESTION 89 What are three benefits that resource profiles provide over resource policies? (Choose three.) A. Resource profiles provide automatic mapping of users to roles. B. Resource profiles provide a simplified process for creating bookmarks and resource policies. C. One profile can be assigned to multiple roles. D. Resource options can be customized for each profile. E. Resource profiles provide a simplified process for configuring applications such as VPN tunneling. Correct Answer: BCD /Reference: QUESTION 90 You must deploy VPN tunneling using Network Connect to multiple Microsoft Windows devices. Due to access

49 restrictions, the users do not have permission to install WSAM. Which component resolves this issue? A. Juniper Installer Service B. Host Checker C. third-party integrity measurement verifier D. Windows Secure Application Manager scriptable launcher Correct Answer: A QUESTION 91 You want to use ESP for your VPN Tunneling transport mechanism. Which port must you have open on your firewall to the Junos Pulse Secure Access Service in a default configuration? A. UDP 500 B. TCP 500 C. UDP 4500 D. TCP 4500 Correct Answer: C Section: Pulse Connection /Reference: QUESTION 92 Users report that they cannot download a PowerPoint presentation when accessing a Web site using basic Web access. Which resource policy in the Admin UI will resolve this issue? A. Selective Rewrite Policy

50 B. Web Caching Policy C. Web Proxy Policy D. Single Sign-On Policy Correct Answer: A /Reference: QUESTION 93 Which two access transport protocols are used with Junos Pulse for an Apple OS X computer? (Choose two.) A. ESP B. SSH C. SSL D. IKEv2 Correct Answer: AC Section: (none) QUESTION 94 What would be used to configure the management port on the MAG4610 Junos Pulse Gateway? A. USB port B. custom scripts C. serial console D. Admin UI Correct Answer: D Section: (none) /Reference: QUESTION 95 What are three ways a Junos Pulse connection is initiated to a Junos Pulse Secure Access Service? (Choose three.)

51 A. The connection is initiated when the Web browser requires that a VPN tunnel be established. B. The connection is initiated after the user signs in to the PC. C. The user manually initiates a connection. D. The connection is initiated after the PC starts. E. The connection is initiated only if application acceleration is enabled. Correct Answer: BCD Section: (none) QUESTION 96 You are asked to define role settings for Windows file bookmarks with a certain set of access policies. In the Admin UI, which two Windows file restrictions apply? (Choose two.) A. network file share browsing B. persistent password caching C. read-write access D. source IP address role restriction Correct Answer: AC Section: (none) /Reference:

52 QUESTION 97 Which action must you perform to use CRLs to validate user certificates? A. Configure an OCSP responder. B. Validate a trusted server CA. C. Import as a trusted client the root certificate of the CA issuing the CRL. D. Configure a CA chain. Correct Answer: C Section: (none)

53 QUESTION 98 Users sign in to the Junos Pulse Secure Access Service using LDAP authentication. Users must also access Outlook Web Access using the same LDAP credentials. You would like to make this authentication process automatic so that users do not need to submit the same credentials twice. In the Admin UI, which two will address this concern? (Choose two.) A. Kerberos B. Anonymous access C. Windows Terminal Services D. Remote form POST Correct Answer: AD Section: (none) /Reference: QUESTION 99 Users are reporting that they cannot log in to the Junos Pulse Secure Access Service. In the user access log on the Junos Pulse Secure Access Service, you discover a series of messages shown in the exhibit. What is the cause of the problem? Info AUT :20:06 - ive - [ ] jsmith(users)[] - Login failed using auth server Corp (LDAP Server). Reason: Failed Info AUT :20:06 - ive - [ ] jsmith(users)[] - Primary authentication failed for jsmith/corp from Minor AUT :20:06 - ive - [ ] jsmith(users)[] - Could not connect to LDAP server 'Corp': Failed binding to admin DN: [49] Invalid credentials: ADCorp.acme.com:389 Info AUT :20:01 - ive - [ ] rbook(users)[] - Login failed using auth server Corp (LDAP Server). Reason: Failed Info AUT :20:01 - ive - [ ] rbook(users)[] - Primary authentication failed for jsmith/corp from Minor AUT :20:01 - ive - [ ] rbook(users)[] - Could not connect to LDAP server 'Corp': Failed binding to admin DN: [49] Invalid credentials: ADCorp.acme.com:389 A. The Junos Pulse Secure Access Service cannot reach the LDAP authentication server. B. The Junos Pulse Secure Access Service cannot authenticate to the LDAP authentication server. C. The users are failing authentication because their LDAP credentials are invalid. D. The users are failing authentication because they do not exist in the LDAP directory. Correct Answer: B Section: (none) /Reference: