Citrix CCP-N 1Y0-351 Questions & Answers

• Question 41:

  A company has a new CEO and wants to update their website with the new CEO's name. What could the engineer do on the website while this modification is being made?

  A. Insert the new name on the header requests using Rewrite policies.

  B. Hide the current name on the header request using Rewrite policies.

  C. Delete the current name on the body response using Rewrite policies.

  D. Replace the current name on the body response using Rewrite policies.

  Correct Answer: D

• Question 42:

  Scenario: When the NetScaler was set up, compression was enabled. The network engineer would like to disable compression ONLY for a particular virtual server.

  How could the engineer accomplish this?

  A. Uncheck Compression in the system basic features.

  B. Create a policy with a NOCOMPRESS action, bound to the global request point.

  C. Disable compression on the services or service groups bound to the virtual server.

  D. Create a policy with a NOCOMPRESS action, bound the virtual server Compression (request) point.

  Correct Answer: C

  

• Question 43:

  Scenario: A NetScaler engineer configured a service and server for RADIUS authentication. To ensure that the RADIUS service is available and responding to authentication requests, the engineer has added the NetScaler built-in monitor to the service. On inspecting the RADIUS service the engineer notices it is marked as DOWN.

  What could be causing this issue?

  A. The built-in monitor has been changed.

  B. RADIUS accounting must be enabled under the server.

  C. There is no built-in monitor available to monitor RADIUS.

  D. The NetScaler-owned IP address has not been added to the RADIUS database.

  Correct Answer: D

• Question 44:

  Scenario: An application that uses HTTP for connections and other protocols for different types of content has been deployed. Load balancing virtual servers have been created for each protocol and the engineer now needs to ensure that once a load balancing decision has occurred, further requests for different content are served from the same server.

  How could the engineer achieve this?

  A. Create a persistency group.

  B. Set the Spillover method to DYNAMICCONNECTION.

  C. Add a new virtual server for each protocol that is not directly addressable.

  D. Set each virtual server to use Source IP Hash as the load balancing method.

  Correct Answer: A

  Summary

  A Web application may use HTTP and HTTPS in the same session. This article describes the configuration necessary to ensure persistence is maintained across both HTTP and HTTPS connections.

  Background

  The NetScaler allows us to configure persistency groups to accommodate exactly such a need. A practical example of this might be a shopping cart where items are browsed over HTTP, but purchased over HTTPS. If persistency were not maintained, it's possible the shopping cart might be lost, the user logged out, or other adverse actions. By using persistency groups, the HTTP and HTTPS vServers are grouped together into one persistent entity.

  Procedure

  From the GUI:

  1.

  Click and expand the Load Balancing node.

  2.

  Click Persistency Groups.

  3.

  Click Add.

  4.

  Populate the Group Name field.

  5.

  Choose between COOKIEINSERT, SOURCEIP or RULE from the Persistence dropdown and configure a timeout.

  6.

  Choose a backup persistence method if desired.

  7.

  Select the vServers to be grouped from the Available Virtual Servers list.

  8.

  Click Add to move the vServers from the available list to the configured list.

  From the command line interface (CLI):

  Issue the following commands:

  1.

  bind lb group

  2.

  bind lb group

  3.

  ....

  4.

  set lb group -persistenceType - persistenceBackup

• Question 45:

  Scenario: A company has three HTTP servers that are load balanced using NetScaler. When users connect to the HTTP application they often receive inconsistent data or are advised that they need to log on again. Which step should the engineer take to correct this?

  A. Remove Down State Flush.

  B. Change the idle timeout value for the service.

  C. Configure persistence with appropriate timeouts.

  D. Change the global TCP Client Idle Time-Out value.

  Correct Answer: C

• Question 46:

  Company policy states that all passwords should travel the network in encrypted packets except SNMP.

  Which command should the network engineer execute to comply with this policy?

  A. set ns ip 10.20.30.40 -ssh disabled -telnet disabled -gui enabled

  B. set ns ip 10.20.30.40 -telnet disabled -gui secureonly -ftp disabled

  C. set ns ip 10.20.30.40 -mgmtaccess disabled -restrictaccess enabled

  D. set ns ip 10.20.30.40 -gui secureonly -ssh enabled -restrictaccess enabled

  Correct Answer: B

• Question 47:

  A network engineer wants to configure a NetScaler for load balancing Voice over IP traffic (VoIP).

  Which hash method is the best fit for VoIP traffic?

  A. Call ID

  B. Source IP

  C. Destination IP

  D. Domain name

  Correct Answer: A

• Question 48:

  Which type of authentication server could an engineer configure in order to provide the use of RSA token authentication as a permitted authentication method to access a AAA Virtual Server?

  A. LDAP

  B. SAML

  C. RADIUS

  D. Negotiate

  Correct Answer: C

  http://support.citrix.com/article/CTX127543

  This document describes how to configure Access Gateway 5.0 for authentication against an RSA SecureID Authentication server. It describes the configuration required in both the Access Gateway and the RSA server for various deployment topologies.

  

  Within the RSA Authentication Manager console, choose Agent Host > Generate Configuration Files and select for One Agent Host, and choose the Agent Host created in step 1 and save the generated sdconf.rec file.

  

  If using RSA 7.1

  Open the RSA Security Console and navigate to Access > Authentication Agents > Add New. Enter the name and IP Address of the Access Gateway, and set Agent type to Standard Agent.

  Save this new agent.

  

  Select Access > Authentication Agents > Generate Configuration File and generate the configuration file. There is no option to generate a configuration file for a single host in RSA 7.1. Save and extract the sdconf.rec from the generated zip file.

  

  Log on to the Access Gateway AdminLogonPoint and go to Authentication Profiles to create an RSA authentication profile. Browse to the generated sdconf.rec file on your computer to upload it on the Appliance, and save the profile.

  

  Additional Notes for Creating the Agent Record in RSA. The details entered into the Agent Host configuration are specific, and depend on the deployment configuration of your Access Gateway. The following are the different deployment methods and the associated configuration within the RSA Agent:

  Access Gateway is a non-HA deployment in one-arm mode. Network Address: IP address of Access Gateway Access Gateway is a non-HA deployment in two-arm mode, traffic to the RSA server is through the

  interface with the Internal role

  Network Address: IP address of the interface with the Internal role Access Gateway is a non-HA deployment in two-arm mode, traffic to the RSA server is through the interface with the External role. Network Address: IP address of the interface with the Internal role Secondary Nodes: IP address of the

  interface with the External role Access Gateway is in an HA deployment in one-arm mode Network

  Address: The HA Virtual IP address Secondary Nodes: The physical IP addresses of both Access Gateways Access Gateway is in an HA deployment in two-arm mode, traffic to the RSA server is through the interface marked as INTERNAL

  Network Address: The HA Internal virtual IP address

  Secondary Nodes: The physical IP addresses of the interfaces with the Internal role on both Access Gateways Access Gateway is in an HA deployment in two-arm mode, traffic to the RSA server is through the

  interface marked as EXTERNAL Network Address: The HA Internal virtual IP address

  Secondary Nodes: The physical IP addresses of the interfaces with the External role on both Access Gateways

  *In RSA 7.1 Secondary Nodes have been renamed to Alternate IP Addresses in the Authentication Agent configuration.

• Question 49:

  Scenario: A call center has deployed Access Gateway Enterprise to provide its employees with access to work resources from home. Due to the number of available licenses, only selected employees should access the environment remotely based on their user account information.

  How could the engineer configure access to meet the needs of this scenario?

  A. Configure a Pre-authentication Policy.

  B. Configure an Authentication Server using a search filter.

  C. Configure an Authentication Policy using Client based expressions.

  D. Add the selected employee accounts to the Local Authentication policy.

  Correct Answer: B

  http://support.citrix.com/article/CTX111079

  When you type log in credentials on the log in page of the NetScaler VPN and press Enter, the credentials are sent to the Active Directory for validation. If the user name and password are valid, then the Active Directory sends the user attributes to the NetScaler appliance. The memberOf attribute is one of the attributes that the Active Directory sends to the NetScaler appliance. This attribute contains the group name of which you are defined as a member in the Active Directory. If you are a member of more than one Active Directory group, then multiple memberOf attributes are sent to the NetScaler appliance. The NetScaler appliance then parses this information to determine if the memberOf attribute matches the Search filter parameter set on the appliance. If attribute matches, then you are allowed to log in to the network.

  The following are the sample attributes that the Active Directory can send to NetScaler appliance:

  dn: CN=johnd,CN=Users,DC=citrix,DC=com

  changetype: add

  memberOf: CN=VPNAllowed,OU=support,DC=citrix,DC=com

  cn: johnd

  givenName: john

  objectClass: user

  sAMAccountName: johnd

  Configuring a NetScaler Appliance to Extract the Active Directory Group To configure a NetScaler appliance to extract the Active Directory group and enable clients to access the NetScaler VPN based on the Active Directory groups by using the Lightweight

  Directory Access Protocol (LDAP) authentication, compete the following procedure:

  Determine the Active Directory Group that has access permission. To configure the NetScaler appliance for Group Extraction, you must define the group a user needs to be a member of to allow access to the network resources. Note: To determine that exact syntax, you might need to refer to the Troubleshooting Group Extraction on the NetScaler appliance section.

  Determine the Search Filter syntax.

  Enter the appropriate syntax in the Search Filter field of the Create Authentication Server dialog box, as shown in the following sample screenshot:

  

  Note: Ensure that you start the value to the Search Filter filed with memberOf= and do not have any

  embedded spaces in the value.

  To configure the LDAP authentication with Group Extractions from the command line interface of the

  NetScaler appliance with the values similar to the ones in the preceding screenshot, run the following

  command:

  add authentication ldapaction LDAP-Authentication -serverip 10.3.4.15 -ldapBase "CN=Users,DC=citrix,DC=com" -ldapBindDn "CN=administrator,CN=Users,DC=citrix,DC=com" -ldapBindDnPassword ..dd2604527edf70 -ldapLoginName sAMAccountName -searchFilter "memberOf=CN=VPNAllowed,OU=support,DC=citrix,DC=com" -groupAttrName memberOf -subAttributeName CN Note: Ensure that you set the subAttributeName parameter to CN. Troubleshooting Group Extraction on

  the NetScaler appliance To troubleshoot group extraction on the NetScaler appliance, consider the following points: If the LDAP policy fails after configuring it for Group Extraction, it is best to create a policy that does not

  have the group extraction configured to ensure that LDAP is configured appropriately. You might need to

  use the LDAP Data Interchange Format Data Exchange (LDIFDE) utility from Microsoft that extracts the

  attributes from the Active Directory server to determine the exact content of the memberOf group.

  You need to run this utility on the Active Directory server. The following is the syntax for the command to

  run the LDIFDE utility:

  ldifde -f -s -d "dc=,dc=com" -p subtree -r "(and

  (objectCategory=person)(objectClass=User)(givenname=*))" -l

  "cn,givenName,objectclass,samAccountName,memberOf"

  When you run the preceding command, a text file, with the name you specified for File_Name parameter,

  is created. This file contains all objects from the Active Directory. The following is an example from a text

  file so created:

  dn: CN=johnd,CN=Users,DC=citrix,DC=com changetype: add memberOf: CN=VPNAllowed,OU=support,DC=citrix,DC=com cn: johnd givenName: john objectClass: user sAMAccountName: johnd

• Question 50:

  Scenario: A network engineer needs to re-configure the NetScaler to utilize two new VLANs VLAN2 and VLAN3. VLAN2 is an untagged VLAN and VLAN3 will require a .1q compliant tag. Interface 1/1 is the only interface that will be used on the NetScaler.

  How could the engineer configure the NetScaler so that it can communicate with both networks?

  A. Change the NSVLAN to 3 Add VLAN 2 and bind interface 1/1 as untagged

  B. Enable the Tag all VLANs option on interface 1/1.

  C. Add VLAN2 and bind interface 1/1 as untagged Add VLAN3 and bind interface 1/1 as tagged

  D. Add a SNIP for each VLAN Enable management access on the SNIP for VLAN3

  Correct Answer: C