You are asked to deploy dynamic VPNs between the corporate office and remote employees that work from
home. The gateway device at the corporate office consists of a pair of SRX650s in a chassis cluster. Which two
statements about the deployment are true? (Choose two.)

A.
The SRX650s must be separated as standalone devices to support the dynamic VPNs.

B.
The remote clients must install client software to establish a tunnel with the corporate network.

C.
The remote clients must reside behind an SRX device configured as the local tunnel endpoint.

D.
The SRX650 must have HTTP or HTTPS enabled to aid in the client software distribution process

Explanation:
http://www.juniper.net/us/en/local/pdf/app-notes/3500201-en.pdf