Citrix CCP-N 1Y0-351 Questions & Answers

• Question 51:

  Scenario: A NetScaler appliance currently has a manually configured channel containing four interfaces; however, the engineer has been told that the NetScaler must now only use a single interface for this network. The engineer removes the channel and immediately notices a decrease in network performance.

  How could the engineer resolve this issue?

  A. Reset the unused interfaces

  B. Disable the unused interfaces

  C. Enable flow control on all interfaces

  D. Disable HA monitoring on the three interfaces that are no longer required

  Correct Answer: B

• Question 52:

  The network engineer would like all HTTP and HTTPS requests that travel through the NetScaler to have an HTTP header added with the source IP address for logging on the web servers.

  How should the network engineer accomplish this?

  A. Enable Web Logging

  B. Enable the client IP option

  C. Configure the TCP Parameters

  D. Enable the 'Use Source IP mode'

  Correct Answer: B

  

  Enabling Use Source IP Mode

  When the NetScaler appliance communicates with the physical servers or peer devices, by default, it uses one of its own IP addresses as the source IP. The appliance maintains a pool of mapped IP addresses (MIPs) and subnet IP addresses (SNIPs), and selects an IP address from this pool to use as the source IP address for a connection to the physical server. The decision of whether to select a MIP or a SNIP depends on the subnet in which the physical server resides. If necessary, you can configure the NetScaler appliance to use the client's IP address as source IP. Some applications need the actual IP address of the client. The following use cases are a few examples:

  Client's IP address in the web access log is used for billing purposes or usage analysis. Client's IP address is used to determine the country of origin of the client or the originating ISP of the client. For example, many search engines such as Goggle provide content relevant to the location to which the user belongs.

  The application must know the client's IP address to verify that the request is from a trustworthy source.

  Sometimes, even though an application server does not need the client's IP address, a firewall placed between the application server and the NetScaler may need the client's IP address for filtering the traffic.

  Enable Use Source IP mode (USIP) mode if you want NetScaler to use the client's IP address for communication with the servers. By default, USIP mode is disabled. USIP mode can be enabled globally on the NetScaler or on a specific service. If you enable it globally, USIP is enabled by default for all subsequently created services. If you enable USIP for a specific service, the client's IP address is used only for the traffic directed to that service. As an alternative to USIP mode, you have the option of inserting the client's IP address (CIP) in the request header of the server-side connection for an application server that needs the client's IP address.

  In earlier NetScaler releases, USIP mode had the following source-port options for server-side connections:

  Use the client's port. With this option, connections cannot be reused. For every request from the client, a new connection is made with the physical server. Use proxy port. With this option, connection reuse is possible for all requests from the same client. Before NetScaler release 8.1 this option imposed a limit of 64000 concurrent connections for all server-side connections.

  In the later NetScaler releases , if USIP is enabled, the default is to use a proxy port for server- side connections and not reuse connections. Not reusing connections may not affect the speed of establishing connections.

  By default, the Use Proxy Port option is enabled if the USIP mode is enabled. For more information about the Use Proxy Port option, see Using the Client Port When Connecting to the Server.

  Note: If you enable the USIP mode, it is recommended to enable the Use Proxy Port option. The following figure shows how the NetScaler uses IP addresses in USIP mode.

  IP Addressing in USIP Mode

  

  Recommended Usage

  Enable USIP in the following situations:

  Load balancing of Intrusion Detection System (IDS) servers Stateless connection failover

  Sessionless load balancing If you use the Direct Server Return (DSR) mode

  Note: When USIP is required in the one-arm mode installation of the NetScaler appliance, make sure that the server's gateway is one of the IP addresses owned by the NetScaler. For more information about NetScaler owned IP addresses, see Configuring NetScaler owned IP addresses. If you enable USIP, set the idle timeout for server connections to a value lower than the default value, so that idle connections are cleared quickly on the server side. For more information about setting an idle time-out value, see "Load Balancing" chapter of the Citrix NetScaler

  Traffic Management Guide at http://support.citrix.com/article/CTX132359. For transparent cache redirection, if you enable USIP, enable L2CONN also. Because HTTP connections are not reused when USIP is enabled, a large number of server-side connections may accumulate. Idle server connections can block connections for other clients. Therefore, set limits on maximum number of connections to a service. Citrix also recommends setting the HTTP server time-out value, for a service on which USIP is enabled, to a value lower than the default, so that idle connections are cleared quickly on the server side. To globally

  enable or disable USIP mode by using the NetScaler command line At the NetScaler command prompt,

  type one of the following commands:

  Enable ns mode usip

  Disable ns mode usip

  To enable USIP mode for a service by using the NetScaler command line At the NetScaler command

  prompt, type:

  Setservice -usip (YES | NO) Example Setservice Service-HTTP-1 -usip YES To globally enable or disable USIP mode by using the configuration utility In the navigation pane, expand

  System and click Settings. On the Settings page, under Modes and Features, click Configure modes. In

  the Configure Modes dialog box, do one of the following:

  To enable Use Source IP mode, select the Use Source IP check box. To disable Use Source IP mode,

  clear the Use Source IP check box.

  Click OK.

  In the Enable/Disable Feature(s)? dialog box, click Yes. To enable USIP mode for a service by using the

  configuration utility In the navigation pane, expand Load Balancing, and then click Services. In the details

  pane, select the service for which you want to enable the USIP mode, and then click Open.

  In the Configure Service dialog box, click the Advanced tab.

  Under Settings, select the Use Source IP check box.

  Click OK

• Question 53:

  What should a network engineer do to prevent unauthorized users from using the root user account?

  A. Reset the nsroot account.

  B. Change the nsroot password.

  C. Create an authorization policy.

  D. Bind a policy to the root user account.

  Correct Answer: B

  Changing the Password of the Default User Account

  The default user account provides complete access to all features of the Citrix SDX appliance. Therefore,

  to preserve security, the nsroot account should be used only when necessary, and only individuals whose

  duties require full access should know the password for the nsroot account. Citrix recommends changing

  the nsroot password frequently. If you lose the password, you can reset the password to the default by

  reverting the appliance settings to factory defaults. You can change the password of the default user

  account in the Users pane. In the Users pane, you can view the following details:

  Name Lists the user accounts configured on the SDX appliance. Permission Displays the permission level

  assigned to the user account.

  To change the password of the default user account

  On the Configuration tab, in the navigation pane, expand System, and then click Users. In the Users pane,

  click the default user account, and then click Modify. In the Modify System User dialog box, in Password

  and Confirm Password, enter the password of your choice.

  Click OK.

• Question 54:

  A network engineer needs to configure Citrix NetScaler to provide Access Gateway services to VLAN 2 using interface 1/1 only, while also using interface 1/2 to provide load balancing services to VLAN 3.

  How could this result be achieved?

  A. Disable static route advertisement.

  B. Disable layer 2 mode Create 2 untagged VLANs - VLAN 2 and VLAN 3 Bind VLAN 2 to Interface 1/1 Bind VLAN 3 to Interface 1/2

  C. Enable Layer 3 mode Create a Channel Interface using Interface 1/1 and 1/2 Create 2 VMACs Bind a VMAC to interface 1/1 and 1/2

  D. Configure policy-based routing using the Interface option as a filter.

  Correct Answer: B

• Question 55:

  A NetScaler engineer generates a techsupport archive to be sent to Technical Support.

  Which three of the following pieces of information will be included in the archive file? (Choose three.)

  A. Model Number

  B. SSL Private Keys

  C. Old Configuration Files

  D. Hardware Boot sequence

  E. Webpage Customizations F. Certificate Revocation List

  Correct Answer: ACD

• Question 56:

  When binding a certificate to a virtual server, which two certificate formats are supported by NetScaler? (Choose two.)

  A. P7B

  B. PFX

  C. PEM

  D. DER

  Correct Answer: CD

• Question 57:

  When configuring NetScaler authentication to access a web site, which two things should a network engineer verify in the environment? (Choose two.)

  A. AAA is enabled.

  B. One DNS server exists.

  C. A Keytab file is available.

  D. An authentication virtual server exists.

  E. A traffic management virtual server exists.

  Correct Answer: AD

• Question 58:

  A security test has been completed on an SSL offload implementation and it has been determined that the certificate key length is too short and must be increased.

  Which two steps must the network engineer complete to resolve this? (Choose two.)

  A. Bind the certificate to an SSL service group.

  B. Bind the certificate to an SSL Offload virtual server.

  C. Add a new SSL policy to the SSL offload virtual server.

  D. Use the "Client certificate wizard" to generate a CSR, request a certificate and import.

  E. Use the "Server certificate wizard" to generate a CSR, request a certificate and import.

  Correct Answer: BE

• Question 59:

  Scenario: A network engineer configured a new NetScaler MPX appliance without any VLANs and with a single interface connected to the network. The engineer has not completed any other configurations. The interface is then accidentally disabled and contact is lost with the appliance.

  Which two actions can the network engineer take to restore communications to the appliance? (Choose two.)

  A. Connect to the SNIP instead of the NSIP.

  B. Connect another of the unused interfaces.

  C. Use the serial port to connect and then bring the disabled interface online.

  D. Connect a crossover cable to the port that has been disabled and connect to the NSIP.

  Correct Answer: BC

• Question 60:

  Scenario: The NetScaler has been connected to two external networks provided by different Internet Service Providers (ISPs). Dynamic routing is not enabled. Traffic is expected to use the first ISP (through the 10.50.1.1 router) if possible and the second, slower ISP (through the 10.51.1.1 router) only if the Primary ISP fails.

  Which two commands could the network engineer execute to configure the routes? (Choose two.)

  A. add route 0.0.0.0 0.0.0.0 10.51.1.1 -cost 10 -monitor arp

  B. add route 0.0.0.0 0.0.0.0 10.50.1.1 -cost 5 -monitor PING

  C. add route 0.0.0.0 0.0.0.0 10.50.1.1 -cost 15 -msr ENABLED

  D. add route 0.0.0.0 0.0.0.0 10.51.1.1 -cost 3 -monitor PING-DEFAULT

  Correct Answer: AB