Free 1Y0-351 Exam Dumps PDF Preview

Question 1

Single choice

The upgrade script copies the updated NetScaler kernel file to the __________ NetScaler directory. (Choose the correct option to complete the sentence.)

A
/var
B
/flash
C
/nsconfig
D
/flash/boot

Reveal answer details Close answer details

Correct answerB

Question 2

Single choice

A network engineer should use a HTTP-ECV monitor type to control the status of a load balanced web server resource when __________. (Choose the correct option to complete the sentence.)

A
checking for multiple HTTP response codes
B
wanting to use a customized HTTP Request
C
checking for a specific pattern in the HTTP Response body
D
checking for a specific pattern in the HTTP Response header

Reveal answer details Close answer details

Correct answerC

Question 3

Single choice

Scenario: A NetScaler Engineer has created an SSL virtual server that utilizes SSL services. The engineer needs to configure certificate authentication from the NetScaler to the backend web services.

What should the engineer do to meet the requirements outlined in the scenario?

A
Bind a CA Certificate to the SSL Services.
B
Bind a Client Certificate to the SSL Services.
C
Create an SSL policy to present the Client Certificate to the web services.
D
Enable Client Authentication and set Client Certificate to mandatory on the virtual server.

Reveal answer details Close answer details

Correct answerB

Question 4

Single choice

Scenario: A user browses to a page and is presented with a warning that he is trying to enter a web site with an untrusted certificate. The network engineer had added the correct certificate to the SSL virtual server.

What could be the cause of this issue?

A
TLS is disabled on the virtual server.
B
The certificate is not linked to the intermediate CA.
C
The certificate has expired and needs to be renewed.
D
The CA certificate has not been added to the SSL virtual server.

Reveal answer details Close answer details

Correct answerB

Question 5

Single choice

Scenario: A NetScaler engineer is adding a new SSL certificate to a NetScaler device. During the process the engineer receives an error message:

"Certificate with key size greater than RSA512 or DSA512 bits not supported."

The same process has been followed previously on the same model of NetScaler successfully.

What is the likely cause of this error?

A
The certificate hostname is invalid.
B
RSA authentication has been added to the VIP.
C
The NetScaler has not been licensed correctly.
D
The CSR has not been submitted to the certificate authority.

Reveal answer details Close answer details

Correct answerC

Question 6

Single choice

Scenario: A network engineer has bound four policies to a virtual server as follows:

- PolicyA has a priority of 10

- PolicyB has a priority of 20

- PolicyC has a priority of 30

- PolicyD has a priority of 0

Which policy will be evaluated first?

A
PolicyA
B
PolicyB
C
PolicyC
D
PolicyD

Reveal answer details Close answer details

Correct answerD

Question 7

Single choice

A public SSL certificate on a virtual server is about to expire and the NetScaler engineer needs to renew the certificate before it expires.

Which step must the engineer take to renew the SSL Certificate?

A
Generate a new CSR
B
Recreate the Private Keys
C
Execute CRL Management
D
Update the existing certificate

Reveal answer details Close answer details

Correct answerD

Question 8

Single choice

Scenario: For security reasons, the NSIP needs to be configured to only be accessible on interface 0/1, which is VLAN 300.

The NSIP address is 10.110.4.254 and the subnet mask is 255.255.255.0.

How would the network engineer achieve this configuration?

A
set ns config -nsvlan 300 -ifnum 0/1
B
set ns ip 10.110.4.254 -gui ENABLED -vrID 300
C
add vlan 300
set ns ip 10.110.4.254 -mgmtAccess ENABLED
D
set ns config -IPAddress 10.110.4.254 -netmask 255.255.255.0

Reveal answer details Close answer details

Correct answerA

Question 9

Multiple choice

Which two compression actions could a NetScaler engineer use? (Choose two.)

A
bzip2
B
deflate
C
compress
D
pack200-gzip

Reveal answer details Close answer details

Correct answersB, C

Question 10

Multiple choice

A security test has been completed on an SSL offload implementation and it has been determined that the certificate key length is too short and must be increased.

Which two steps must the network engineer complete to resolve this? (Choose two.)

A
Bind the certificate to an SSL service group.
B
Bind the certificate to an SSL Offload virtual server.
C
Add a new SSL policy to the SSL offload virtual server.
D
Use the "Client certificate wizard" to generate a CSR, request a certificate and import.
E
Use the "Server certificate wizard" to generate a CSR, request a certificate and import.

Reveal answer details Close answer details

Correct answersB, E

Question 11

Single choice

A NetScaler is configured with two-factor authentication. A user reported that authentication failed.

How can an engineer determine which factor of the authentication method failed?

A
Check NSlog
B
Use nsconmsg
C
Check the dashboard
D
Use cat aaad.debug command

Reveal answer details Close answer details

Correct answerD

Question 12

Single choice

Which outcome does the minify JavaScript option of the Front End Optimization (FEO) feature provide?

A
It will replace characters with shorter names.
B
It will change all uppercase letters to lowercase.
C
It will remove all comments from the JavaScript.
D
It will compress JavaScript with the GZIP algorithm.

Reveal answer details Close answer details

Correct answerC

Question 13

Single choice

Which built-in TCP profile should a NetScaler Engineer choose to optimize backend server connections, where the servers reside on the same LAN as the appliance?

A
nstcp_default_tcp_lfp
B
nstcp_default_tcp_lnp
C
nstcp_default_tcp_lan
D
nstcp_default_profile

Reveal answer details Close answer details

Correct answerC

Question 14

Single choice

Which setting would a NetScaler Engineer disable in order to stop the NetScaler from acting as a router for non-NetScaler owned IP addresses or entities?

A
Layer 2 mode
B
Layer 3 mode
C
MAC-based forwarding
D
Use Subnet IP (USNIP)

Reveal answer details Close answer details

Correct answerC

Question 15

Multiple choice

What are two valid ways of checking that a back-end web server is reachable from the NetScaler SNIP address using port 80? (Choose two.)

A
Run traceroute.
B
Run telnet using the -srcip option.
C
Bind a DNS monitor to a service group containing the web server.
D
Bind a HTTP monitor to a service group containing the web server.
E
Run the ping command between the NetScaler and the web server.

Reveal answer details Close answer details

Correct answersB, D

Question 16

Single choice

Scenario: A website that provides hotel bookings lists each hotel through their membership number on the site URL. For example, the Martello Tower member ID is 6754 and its web presence is at http://www.hoteltestwebsite.com/hotels/6754/index.html.

There are 20,000 hotels in the database of the website. The website business owner no longer wants to

display the hotel sites for hotel numbers 1-10000, inclusive. A NetScaler Engineer must configure an appropriate responder page to indicate that these sites are unavailable.

Which expression will meet the requirements of the business owner?

A
HTTP.REQ.URL.PATH.GET(2).TYPECAST_NUM_T(DECIMAL).BETWEEN(0, 10000)
B
HTTP.REQ.URL.AFTER_STR("hotels").TYPECAST_NUM_T(DECIMAL).BETWEEN(0, 10000)
C
HTTP.REQ.URL.BEFORE_STR("index.html").TYPECAST_NUM_T(DECIMAL).BETWEEN(0, 10000)
D
HTTP.REQ.URL.PATH.GET(1).TYPECAST_NUM_T(DECIMAL).GT(0) &&
HTTP.REQ.URL.PATH.GET(1).TYPECAST_NUM_T(DECIMAL).LT(10000)

Reveal answer details Close answer details

Correct answerA

Question 17

Single choice

While binding a certificate key pair where the key is a 2048-bit, a NetScaler Engineer receives the following error message:

"Certificate with key size greater than RSA512 or DSA512 bits not supported"

What could be causing this error?

A
The certificate being used is invalid.
B
The license file is saved in UTF-8 format.
C
The NetScaler does NOT have an SSL offloading card.
D
The NetScaler appliance does NOT have an appropriate license.

Reveal answer details Close answer details

Correct answerD

Question 18

Single choice

Scenario: A network engineer is managing a NetScaler environment that has two NetScaler devices running as a high availability pair. The engineer must upgrade the current version from NetScaler 9 to NetScaler 10.5.

Which action must the engineer take?

A
Upgrade the primary node and perform HA sync.
B
Upgrade the secondary node and then upgrade the primary node.
C
Upgrade the primary node and then upgrade the secondary node.
D
Break the high availability pair, upgrade each NetScaler device, and then reconfigure high availability.

Reveal answer details Close answer details

Correct answerB

Question 19

Single choice

Which feature could a Network Engineer configure in order to restrict client connections to a specific bandwidth limit?

A
Spillover
B
Rate Limiting
C
SureConnect
D
Filter Policies

Reveal answer details Close answer details

Correct answerB

Question 20

Single choice

Which load-balancing method is used in connection mirroring and firewall load balancing?

A
URL Hash
B
Source IP Soure Port Hash
C
Destination IP Hash
D
Call ID Hash

Reveal answer details Close answer details

Correct answerB

Question 21

Single choice

Scenario: A call center has deployed Access Gateway Enterprise to provide its employees with access to work resources from home. Due to the number of available licenses, only selected employees should access the environment remotely based on their user account information.

How could the engineer configure access to meet the needs of this scenario?

A
Configure a Pre-authentication Policy.
B
Configure an Authentication Server using a search filter.
C
Configure an Authentication Policy using Client based expressions.
D
Add the selected employee accounts to the Local Authentication policy.

Reveal answer details Close answer details

Correct answerB

Explanation

http://support.citrix.com/article/CTX111079

When you type log in credentials on the log in page of the NetScaler VPN and press Enter, the credentials are sent to the Active Directory for validation. If the user name and password are valid, then the Active Directory sends the user attributes to the NetScaler appliance. The memberOf attribute is one of the attributes that the Active Directory sends to the NetScaler appliance. This attribute contains the group name of which you are defined as a member in the Active Directory. If you are a member of more than one Active Directory group, then multiple memberOf attributes are sent to the NetScaler appliance. The NetScaler appliance then parses this information to determine if the memberOf attribute matches the Search filter parameter set on the appliance. If attribute matches, then you are allowed to log in to the network.

The following are the sample attributes that the Active Directory can send to NetScaler appliance:

dn: CN=johnd,CN=Users,DC=citrix,DC=com changetype: add

memberOf: CN=VPNAllowed,OU=support,DC=citrix,DC=com cn: johnd

givenName: john

objectClass: user

sAMAccountName: johnd

Configuring a NetScaler Appliance to Extract the Active Directory Group To configure a NetScaler appliance to extract the Active Directory group and enable clients to access the NetScaler VPN based on the Active Directory groups by using the Lightweight

Directory Access Protocol (LDAP) authentication, compete the following procedure:

Determine the Active Directory Group that has access permission. To configure the NetScaler appliance for Group Extraction, you must define the group a user needs to be a member of to allow access to the network resources. Note: To determine that exact syntax, you might need to refer to the Troubleshooting Group Extraction on the NetScaler appliance section.

Determine the Search Filter syntax.

Enter the appropriate syntax in the Search Filter field of the Create Authentication Server dialog box, as shown in the following sample screenshot:

Note: Ensure that you start the value to the Search Filter filed with memberOf= and do not have any embedded spaces in the value.

To configure the LDAP authentication with Group Extractions from the command line interface of the NetScaler appliance with the values similar to the ones in the preceding screenshot, run the following command:

add authentication ldapaction LDAP-Authentication

-serverip 10.3.4.15

-ldapBase "CN=Users,DC=citrix,DC=com"

-ldapBindDn "CN=administrator,CN=Users,DC=citrix,DC=com" -ldapBindDnPassword ..dd2604527edf70

-ldapLoginName sAMAccountName

-searchFilter "memberOf=CN=VPNAllowed,OU=support,DC=citrix,DC=com" -groupAttrName memberOf

-subAttributeName CN

Note: Ensure that you set the subAttributeName parameter to CN. Troubleshooting Group Extraction on the NetScaler appliance To troubleshoot group extraction on the NetScaler appliance, consider the following points:

If the LDAP policy fails after configuring it for Group Extraction, it is best to create a policy that does not have the group extraction configured to ensure that LDAP is configured appropriately. You might need to use the LDAP Data Interchange Format Data Exchange (LDIFDE) utility from Microsoft that extracts the attributes from the Active Directory server to determine the exact content of the memberOf group.

You need to run this utility on the Active Directory server. The following is the syntax for the command to run the LDIFDE utility:

ldifde -f <File_Name> -s <AD_Server_Name> -d "dc=<Domain_Name>,dc=com" -p subtree -r "(& (objectCategory=person)(objectClass=User)(givenname=*))" -l"cn,givenName,objectclass,samAccountName,memberOf"

When you run the preceding command, a text file, with the name you specified for File_Name parameter, is created. This file contains all objects from the Active Directory. The following is an example from a text file so created:

dn: CN=johnd,CN=Users,DC=citrix,DC=com changetype: add

memberOf: CN=VPNAllowed,OU=support,DC=citrix,DC=com cn: johnd

givenName: john

objectClass: user

sAMAccountName: johnd

Question 22

Single choice

Scenario: A NetScaler Engineer is using the following policy to forward traffic when performing content switching:

add cs action cs1_act -targetVserverExpr "HTTP.REQ.HOSTNAME"

add cs policy cs1_switch_policy -rule true -action cs1_act

bind cs vserver CS1-VIP -policyName cs1_switch_policy -priority 10

In order to make sure the policy works correctly, the engineer must name the __________ to match the hostname. (Choose the correct option to complete the sentence.)

A
load-balancing servers
B
load-balancing services
C
load-balancing virtual servers
D
content-switching virtual server

Reveal answer details Close answer details

Correct answerC

Question 23

Single choice

Scenario: A network engineer would like to prevent blacklisted remote clients from accessing NetScaler hosted application services. An IP address blacklist database is maintained by an external company and available to query over the Internet.

The engineer would like to reject any connections from IP addresses that are contained in the blacklist.

What could the engineer configure to achieve this goal?

A
SSL offload
B
HTTP callout
C
URL transformation
D
SSL certification revocation list check

Reveal answer details Close answer details

Correct answerB

Question 24

Multiple choice

In order to create a three-node NetScaler cluster, all nodes must __________ and __________. (Choose the two correct options to complete the sentence.)

A
be physical appliances
B
have Platinum licensing
C
be using the same build
D
be the same platform model

Reveal answer details Close answer details

Correct answersC, D

Question 25

Single choice

Scenario: A network engineer needs to generate a certificate on the NetScaler appliance. The environment requires a private key with 4096-bit encryption.

To generate a new SSL certificate from a NetScaler Appliance, the engineer must first create __________. (Choose the correct option to complete the sentence.)

A
CSR
B
DSA key
C
RSA key
D
Diffie-Hellman key

Reveal answer details Close answer details

Correct answerC

Question 26

Single choice

A network engineer needs to configure load balancing for an FTP site.

Which type of session persistence method can the engineer select for this scenario?

A
Rule
B
Source IP
C
Cookie Insert
D
Custom Server ID

Reveal answer details Close answer details

Correct answerB

Question 27

Single choice

Server Name Indication (SNI) is required when __________. (Choose the correct option to complete the sentence.)

A
TLS 1.1/1.2 is enabled exclusively
B
a SAN extension certificate is used
C
multiple certificates are used on multiple domains on the same VServer
D
configuring a content switching SSL VServer with a single domain certificate

Reveal answer details Close answer details

Correct answerC

Question 28

Multiple choice

Scenario: A Network Engineer needs to provide a solution for mobile users who use devices that do NOT
support basic access authentication.

Which three steps should be included as part of the engineer's plan to implement this requirement using NetScaler? (Choose three.)

A
Configure an OCSP responder.
B
Create an authentication VServer.
C
Configure a Pre-Authentication policy.
D
Create an LDAP authentication policy and bind it to the authentication server.
E
Enable and configure the authentication option on a VServer to use 401-based authentication.
F
Enable and configure the Authentication option on a load balancing VServer to use form-based authentication.

Reveal answer details Close answer details

Correct answersB, D, F

Question 29

Single choice

What is the purpose of binding Certificate Authority (CA) certificates to a virtual server?

A
For SSL Offload
B
To validate the server certificate
C
For client certificate authentication
D
To provide intermediate certificates to the client

Reveal answer details Close answer details

Correct answerC

Question 30

Multiple choice

Which two content types are, by default, compressible content on the NetScaler? (Choose two.)

A
zip
B
png
C
css
D
jpeg
E
html

Reveal answer details Close answer details

Correct answersC, E

Question 31

Single choice

A network engineer needs to upgrade both appliances of a High Availability (HA) pair.

In which order should the network engineer upgrade the appliances?

A
Disable high availability and upgrade one node at a time.
B
Upgrade the primary node first without disabling high availability.
C
Upgrade the secondary node first without disabling high availability.
D
Perform the upgrade simultaneously without disabling high availability.

Reveal answer details Close answer details

Correct answerC

Question 32

Single choice

Multiple Subnet IPs (SNIPs) are defined in the same network.

A NetScaler Engineer could specify the SNIP to use to communicate with servers on that network by configuring a __________. (Choose the correct option to complete the sentence.)

A
net profile
B
listen policy
C
traffic domain
D
policy-based route

Reveal answer details Close answer details

Correct answerA

Question 33

Single choice

Scenario: A network engineer needs to provide web server administrators with access to monitoring and reporting after changing the default root password during the initial setup of the NetScaler. The engineer needs to ensure that the web server administrators can perform this task.

What should the engineer do in order to ensure that the administrators are able to log on to the NetScaler?

A
Create a group.
B
Create user accounts.
C
Create an authorization policy.
D
Create an authentication policy.

Reveal answer details Close answer details

Correct answerB

Question 34

Multiple choice

ESTION NO: 118

Which two options could a NetScaler Engineer configure to ensure that a revoked client certificate CANNOT be used for a client certificate authentication? (Choose two.)

A
Server Name Indication (SNI)
B
Certificate Revocation List (CRL)
C
Certificate Signing Request (CSR)
D
Online Certification Status Protocol (OCSP)

Reveal answer details Close answer details

Correct answersB, D

Question 35

Single choice

How could a NetScaler Engineer ensure that a content-switching virtual server is marked as DOWN if all target load-balancing servers show as DOWN?

A
Specify a monitor
B
Enable State Update
C
Specify a route monitor
D
Configure a backup virtual server

Reveal answer details Close answer details

Correct answerB

Question 36

Single choice

Scenario: A client connecting to an SSL virtual server receives the following error:

"Invalid Server Certificate.
The server certificate is invalid. Do you wish to accept this certificate and connect to the server anyway?"

What is a possible cause of this error message?

A
The private key is NOT password-protected.
B
The certificate key pair is password-protected.
C
The intermediate CA certificate is NOT linked to the server certificate.
D
Certificate Revocation Lists (CRLs) have NOT been defined on the NetScaler.

Reveal answer details Close answer details

Correct answerC

Question 37

Single choice

Scenario: Users in an organization need to access several web applications daily. Management has asked a NetScaler Engineer to reduce the amount of times users have to enter credentials when accessing web applications.

What should the engineer configure to meet this requirement?

A
A load-balancing VServer and an authorization policy
B
An authentication VServer and an authorization policy
C
An authentication VServer and an authentication policy
D
A content switching VServer and an authentication profile

Reveal answer details Close answer details

Correct answerC

Question 38

Single choice

Which service setting would a NetScaler Engineer use in the command-line interface to limit connections to server resources?

A
-maxReq
B
-maxClient
C
-monThreshold
D
-maxBandwidth

Reveal answer details Close answer details

Correct answerB

Question 39

Single choice

A network engineer is investigating issues and suspects that a new server that has been recently added to the environment has the same IP address as a virtual server that is configured on the NetScaler.

Which command could the engineer run to check the logs that will contain such details?

A
nsconmsg -K newnslog -d stats
B
nsconmsg -K /var/nslog/newnslog -d consmsg
C
nsconmsg -K /var/nslog/newnslog -s ConLb=1 -d oldconmsg
D
nsconmsg -K /var/nslog/newnslog -s ConMon=x -d oldconmsg

Reveal answer details Close answer details

Correct answerB

Question 40

Single choice

Company policy states that all passwords should travel the network in encrypted packets except SNMP.

Which command should the network engineer execute to comply with this policy?

A
set ns ip 10.20.30.40 -ssh disabled -telnet disabled -gui enabled
B
set ns ip 10.20.30.40 -telnet disabled -gui secureonly -ftp disabled
C
set ns ip 10.20.30.40 -mgmtaccess disabled -restrictaccess enabled
D
set ns ip 10.20.30.40 -gui secureonly -ssh enabled -restrictaccess enabled

Reveal answer details Close answer details

Correct answerB

Question 41

Single choice

Scenario: When the NetScaler was set up, compression was enabled. The network engineer would like to disable compression ONLY for a particular virtual server.

How could the engineer accomplish this?

A
Uncheck Compression in the system basic features.
B
Create a policy with a NOCOMPRESS action, bound to the global request point.
C
Disable compression on the services or service groups bound to the virtual server.
D
Create a policy with a NOCOMPRESS action, bound the virtual server Compression (request) point.

Reveal answer details Close answer details

Correct answerC

Explanation

Question 42

Single choice

A NetScaler Engineer plans to deploy a third-party application that will perform scheduled configuration auditing by using NITRO API with a REST interface.

Which management protocol should the engineer enable to allow NITRO API access?

A
SSH
B
HTTP
C
Telnet
D
SNMP

Reveal answer details Close answer details

Correct answerB

Question 43

Single choice

Scenario: A NetScaler Engineer needs to perform a network packet trace on a NetScaler appliance. For
troubleshooting purposes the engineer needs to capture traffic only from interfaces 1/3 and 1/4; traffic from
other interfaces should NOT be captured. The resulting file should be saved in NetScaler format.

What should the engineer do to accomplish this task?

A
Run the nstcpdump.sh command from the NetScaler shell and specify the interface
B
Run the nstcpdump.sh command from the NetScaler shell and specify the filter parameter
C
Run the start nstrace command from the NetScaler command-line interface and specify the filter parameter
D
Run the start nstrace command from the NetScaler command-line interface and specify the PerNIC parameter

Reveal answer details Close answer details

Correct answerC

VOL	TYPE	QUESTIONS
1	Single choice	36
2	Multiple choice	7