# PRA Jump Technology Deep-Dive: — Jump Clients, Jumpoints & Every Jump Item Type Source: https://ai.techclick.in/blog_beyondtrust_pra_jump_technology Markdown: https://ai.techclick.in/blog_beyondtrust_pra_jump_technology.md Publisher: Techclick Infosec Pvt Ltd BeyondTrust PRA Jump technology explained: Jump Clients vs Jumpoints, Jump Groups, roles and policies, plus RDP, Shell, VNC, Web and Protocol Tunnel Jump items. PRA Jump Technology Deep-Dive: — Jump Clients, Jumpoints & Every Jump Item Type student learning map A visual study map for PRA Jump Technology Deep-Dive: — Jump Clients, Jumpoints & Every Jump Item Type showing learning path, evidence, traps, and practice sequence. TECHCLICK STUDY MAP PRA Jump Technology Deep-Dive: — Jump Clients,... BeyondTrust · learn the flow, prove with evidence, avoid unsafe shortcuts 1. Start 🎯 By the end you will be able to 2. Understand Pick where you want to start 3. Prove ① The Jump model — a saved... 4. Practice ② Jump Clients — the installed... How to use this page First build the mental model, then connect the concept to a realistic production decision. Finish by testing yourself. Techclick Infosec Pvt Ltd | ai.techclick.in | Training Contact: WhatsApp +91 92772 29456 Content-specific feature visual for this lesson: use it as the 60-second map before reading the full detail. Most engineers think… Most engineers think PRA reaches servers the way a VPN does — open inbound RDP/SSH ports to each box, or at minimum install an agent on every single machine you ever want to touch. Wrong on both counts. Nothing dials IN: Jump Clients, Jumpoints and the consoles all make outbound connections to the appliance, and the only required ports are 80 and 443. And the agent-on-every-box model is only ONE of two families — for a known, fixed network, one Jumpoint host proxies RDP, SSH, VNC, web GUIs and database tunnels to every neighbour with zero software on the targets. Choosing the wrong family is the #1 rookie design mistake in PRA deployments. ## ① The Jump model — a saved doorway, a wing, a gate pass and visiting rules Start with the vocabulary, because BeyondTrust’s docs are precise about it. A Jump Item is, in the docs’ own words, “an umbrella term for any pre-defined endpoint, regardless of how it is reached.” One Jump Item = one saved doorway to one machine — a Windows server, a switch CLI, a vCenter page. A Jump Shortcut is “any Jump Item that is not a Jump Client” — that distinction matters in every exam and interview. Think of an apartment society: each flat’s door is a Jump Item; the society register at the gate is the appliance. Where do you touch all this? Two consoles. Engineers live in the access console (desktop app or the Privileged Web Access Console): its Jump interface lists Jump Items organised by Jump Group — select an item, press the Jump button, the session starts. Admins live in /login : classic versions put everything under the Jump menu, while the 2025+ Pathfinder -era console renames the menu to Asset Management and the objects with it: Jumpoint → Gateway , Jump Item → Asset , Jump Group → Asset Group , Jump Policy → Asset Policy . Functionality is unchanged — names only. PATHFINDER RENAME — SPEAK BOTH DIALECTS It is exactly Gurgaon → Gurugram: same city, new official name. Interviewers and most deployed installs still say Jumpoint / Jump Item / Jump Group ; the newest docs and UI say Gateway / Asset / Asset Group . Answer in classic terms, then add “renamed Gateway/Asset in the Pathfinder console” — that one sentence signals you read current docs. 👉 So far: a Jump Item is ONE saved doorway, a Jump Shortcut is any item that is not a Jump Client, and the admin menu is Jump (classic) / Asset Management (Pathfinder). Next: who may see, start or edit a doorway. Figure 1 — The Jump model — group, role and policy gates on one outbound path Left, an engineer's access console connects outbound on TCP 443 to the B Series appliance in the DMZ. Right, two Jump Group containers: prod-db with three Jump Items the engineer can see, and net-core which is hidden because she is not a member. Amber gate chips on the path show the Jump Item Role deciding view, start or edit, and the Jump Policy deciding schedule, approval and ticket. A lime callout notes the credential is injected from the Vault and never shown to the engineer. - The Jump model — doorway, wing, gate pass, visiting rules Priya access console Infosys NOC outbound 443 B Series appliance DMZ · pra.icici.example pairs the outbound legs GATE 1 · Role view · start · edit? GATE 2 · Policy hours · approval · ticket Jump Group: prod-db db-win-prod-04 · RDP db-lin-prod-11 · Shell vcenter-mgmt · Web member → visible → role decides actions Jump Group: net-core not a member ← not even visible to Priya At Jump time the Vault injects the credential — Priya never sees, types or copies the password. untrusted/attacker trusted/vaulted policy/decision key insight allowed/audited Follow Priya’s session left to right: her console dials OUT on 443; the Jump Group decides which doorways she even sees; the Role gate decides what she may do with them; the Policy gate decides when. The hidden net-core group shows what non-membership looks like — invisible, not just blocked. Three objects control people. A Jump Group organises items and is the visibility boundary — if Priya is not a member of net-core , those items don’t appear in her console at all. A Jump Item Role is “a predefined set of permissions regarding Jump Item management and usage” — the defaults are Administrator , Start Sessions Only , and (since v25.2) Auditor , whose single permission is View Reports. The role’s checkboxes are literal: “Start Sessions”, “Move and Copy”, “Remove existing”, “Edit Tag”, “Edit Comments” and so on. One resolution rule to memorise: the user↔Jump Group relationship beats a group-policy↔Jump Group relationship, which beats the user’s default role. The fourth object controls time and ceremony. A Jump Policy is the society’s visiting rules: a Jump Schedule (visiting hours, optionally force-ending sessions outside them), Jump Approval (the flat owner’s phone call before the visitor enters — requester gives a reason and duration, named approvers say yes/no), a required ticket ID , a per-policy 2FA challenge , start/end notification emails , and a Disable Recordings override. One documented constraint trips everyone: a schedule and an approval cannot both be enabled on the same policy — pick the control that matters, or split into two policies. ### Four words you will use every single day Tap each card — these four objects ARE the Jump model. Everything else in this lesson hangs off them. 🚪 Jump Item tap to flip One saved doorway to ONE target — RDP, Shell, VNC, Web, Tunnel or Jump Client. So: no doorway, no session. 🏢 Jump Group tap to flip The wing of the society. Membership = visibility. Not a member? The doorway does not even appear. So: groups first, then permissions. 🪪 Jump Item Role tap to flip Your gate pass on that wing: Auditor reads the register, Start Sessions Only visits, Administrator rearranges doors. So: see ≠ start ≠ edit. ⏰ Jump Policy tap to flip Visiting rules: hours, approval, ticket, 2FA, recording. Schedule and approval never share one policy. So: when + how, not who. Pause & Predict Predict: Sneha’s direct user↔Jump-Group membership carries the role Start Sessions Only, but a group policy she belongs to grants Administrator on the SAME Jump Group. Which role wins when she opens that group? Type your guess. Reveal answer Answer: The more specific relationship wins: her direct user↔Jump Group role (Start Sessions Only) beats the group-policy↔Jump Group role (Administrator), which would itself beat her account’s default role. Specificity, not generosity, decides — so a deliberately narrow direct role is a clean way to cap a power user on one sensitive group. Quick check · Q1 of 10 Sneha at Infosys can SEE the Jump Item db-win-prod-02 in her access console, but her Jump button is greyed out. Her teammate starts the same item fine. Most likely reason? a) The Jump Client on the target is offline b) Her Jump Item Role on that Jump Group lacks the Start Sessions permission — group membership grants visibility, the role grants actions c) The Jump Policy on the item was deleted, which blocks only her d) Her access console install is corrupted and needs a reinstall Correct: b. Visibility comes from Jump Group membership; what you may DO comes from the Jump Item Role on that membership (its Start Sessions checkbox here). The teammate starting the same item rules out an offline target (a), and policies apply to every permitted user, not one person (c). A corrupt console (d) would not selectively grey one button. ## ② Jump Clients — the installed agent that dials out and stays reachable A Jump Client is an installable agent that establishes “a one-to-one encrypted connection between a B Series Appliance and a remote Windows, Mac, or Linux system.” Two properties make it special. First, the connection is persistent and outbound — the agent dials OUT to the appliance on TCP 443, so the laptop is reachable from home Wi-Fi, a hotel, or a 4G dongle with no VPN and no inbound firewall hole . It is a SIM card inside the phone: wherever the phone roams, the tower can ring it. Second, it is state-aware — it knows whether a user is sitting at the box, which matters before you take over a production console. Nobody installs 1,200 agents by hand. The Jump Client mass deployment wizard in /login builds an installer (MSI/EXE/script) that is valid for a duration you choose , with the Jump Group and Jump Policy pre-pinned — push it through SCCM/Intune and every laptop lands in the right wing with the right visiting rules on first dial-in. Scale is a sizing question, not a licence question: appliance tiers run from Small (up to 1,000 endpoints) through Enterprise (35k–50k) to Atlas clusters at 50,000–250,000 endpoints . /login → Jump → Jump Clients → Jump Client Mass Deployment Wizard (Pathfinder menus file it under Asset Management). (Recreated for clarity — your console matches this.)"> 🖥️ This is the screen you’ll bulk-deploy from — /login → Jump → Jump Clients → Jump Client Mass Deployment Wizard (Pathfinder menus file it under Asset Management). (Recreated for clarity — your console matches this.) pra.icici.example/login · Jump → Jump Clients 1 Jump Group branch-roaming-laptops 2 This Installer Is Valid For 7 days 3 Jump Policy office-hours-approval Allow Override During Installation Jump Group, Comments Attempt an Elevated Install if the Client Supports It Enabled 4 Platform Windows (x64) MSI Create 👉 So far: a Jump Client is a persistent, outbound-443, state-aware agent — and the wizard mass-deploys it pre-pinned to a group and policy. Next: the lifecycle states, and the two timers that quietly delete your fleet. Figure 2 — Jump Client lifecycle — online, offline, lost, deleted, plus the upgrade lane A state timeline for a Jump Client: Online with a persistent outbound 443 connection, then Offline when the box disconnects, then marked Lost when maintenance timer one expires, then auto-deleted when timer two expires. A branch below shows a locally uninstalled client surviving as a tombstone only if the Uninstalled Jump Client Behavior setting keeps it visible. A bottom lane explains that appliance upgrades push clients through throttled upgrade waves where a version-mismatch message is normal. Jump Client lifecycle — two timers decide everything ONLINE persistent outbound 443 state-aware (user present?) stats: CPU · user · thumbnail OFFLINE laptop off / asleep / EDR killed the service still listed, greyed out timer #1 LOST not connected for N days a diagnostic label — investigate NOW timer #2 AUTO-DELETED M days → gone from the console; redeploy is the only way back UNINSTALLED (tombstone) user removed it locally · stays visible only if “Uninstalled Jump Client Behavior” keeps it UPGRADE WAVES appliance upgrade → clients auto-upgrade under a bandwidth throttle; “running a different version” mid-wave is NORMAL — wait, never mass-redeploy Key setting: lost-days < delete-days. You want the LOST warning before the silent vanish — both timers live in the Jump Client settings of /login. healthy/connected timer/decision gone/destructive key insight Read the top lane left to right: the two maintenance timers turn an offline client into a LOST warning, then into a silent auto-delete. The bottom lane holds the two states people misread — local uninstall tombstones and mid-upgrade version mismatches. The lifecycle is where production pain lives. Online means the outbound tunnel is up. Offline means it is not — laptop asleep, off network, or (very common) host security software killed the service. Then come the two maintenance timers in /login: after N days unconnected a client is marked lost — a diagnostic label, nothing is removed — and after M days it is automatically deleted from the console. Set lost-days 🖥️ Creating the workhorse doorway — access console → Jump interface → Create → Remote RDP . These are the real fields from the Jump Shortcuts guide. (Recreated for clarity — your console matches this.) access console · Create New Remote RDP Jump Shortcut Name db-win-prod-04 1 Hostname / IP 10.20.8.41 2 Jumpoint mum-dc-jp01 Quality perf_and_qual 3 Console Session · Ignore Untrusted Certificate unchecked · unchecked 4 Session Forensics checked Jump Group · Jump Policy prod-db · office-hours-approval Create Web Jump is the one with the surprising architecture: it opens browser-based consoles — vCenter, firewall and switch GUIs, iLO/iDRAC — but the browser does not run on your laptop. A CEF embedded browser runs on the Jumpoint (Windows Jumpoints only), and you watch a rendered, recorded view of it. Credential injection fills the web login form — and when a non-standard form defeats auto-detection, you supply the Username Field Hint / Password Field Hint / Submit Button Hint as exact CSS selectors. The Verify Certificate flag checks the target site’s TLS cert from the Jumpoint . COMMON MISTAKE — WEB JUMP THAT NEVER STARTS Symptom: the Web Jump session dies silently before the page loads. Cause: Verify Certificate is enabled and the internal web app presents a self-signed, expired or wrong-SAN certificate — the docs say plainly that if certificate issues are found, the session does not start. Fix: fix the site’s certificate (right answer); unticking Verify Certificate is documented only as an exception for a trusted internal site. Related symptom: the page loads but injection never fills the form — set the Username/Password/Submit CSS-selector hints on the item. Pause & Predict Predict: during a Web Jump to vCenter, where is the browser actually running — and why does that change whose certificate store and network position matter? Type your guess. Reveal answer Answer: On the Jumpoint, inside an embedded Chromium (CEF) — your laptop only receives a rendered, recorded view. So the certificate check happens on the Jumpoint, the traffic to vCenter originates from the Jumpoint’s LAN position, and your laptop needs no route to vCenter at all. That is also why Web Jump needs a Windows Jumpoint and why a wrong cert blocks the session even though YOUR browser would have shown a clickable warning. Last family: Protocol Tunnel Jump — for when engineers insist on their own thick tools. It opens a listener on your machine (Local Address default 127.0.0.1 ) and forwards it through the audited path to the remote service. Six variants: plain TCP Tunnel (local port → remote port); MySQL (server must use the caching_sha2_password auth plugin); PostgreSQL (username + database required); SQL Server (Windows auth and SQL login both supported — and PRA 25.3 injects Vault credentials into SQL tunnels); Kubernetes Cluster Tunnel (https:// URL, and it requires a Linux Jumpoint — the mirror image of Web Jump’s Windows rule); and Network Tunnel , which carries any TCP and non-TCP protocol (e.g. UDP) but needs at least one IPv4 filter rule and DHCP (or defined IP scopes) on the endpoint network. It is the Mumbai dabbawala: the tiffin is picked up at your doorstep (127.0.0.1), relayed through a trusted network, delivered to exactly one desk (host:port) — never opened, every handoff logged. PRA API · from your admin workstation — list Shell Jump items (the GUI-equivalent of the Jump interface) # 1. OAuth2 token (API account: /login > Management > API Configuration) curl -s -u "$CLIENT_ID:$CLIENT_SECRET" \ -d "grant_type=client_credentials" \ https://pra.icici.example/oauth2/token # 2. Configuration API — Shell Jump items curl -s -H "Authorization: Bearer $TOKEN" \ https://pra.icici.example/api/config/v1/jump-item/shell-jump Expected output {"access_token":"eyJhbGciOiJSUzI1NiIs...","token_type":"Bearer","expires_in":3600} [{"id":12,"name":"pop-sw-01","hostname":"192.168.40.11","protocol":"ssh","port":22, "jumpoint_id":3,"jump_group_id":7,"terminal":"xterm"}] 👉 So far: RDP/VNC for screens, Shell for CLIs, Web for browser consoles (rendered on the Jumpoint), Tunnel for your own thick tools. One card to keep — the picker. Figure 4 — The jump-type picker — ports, fits and gotchas on one card A six-tile cheat sheet. Remote RDP for Windows desktops on port 3389. Shell Jump for SSH port 22 or Telnet port 23 to network gear and Linux. Remote VNC on port 5900 for legacy GUIs speaking RFB 3.8 or later. Web Jump for browser consoles like vCenter, rendered on the Jumpoint itself. Protocol Tunnel Jump forwarding a local port at 127.0.0.1 to a remote service for thick clients like SSMS or kubectl. Jump Client for roaming or unknown networks with no Jumpoint needed. A bottom strip carries the one-line picker question and the semantic colour legend. Jump Item type picker — what does the target speak? All shortcut types (except Jump Client & Local Jump) ride a Jumpoint inside the target network. Remote RDP Windows desktops/servers default port 3389 (host:port) Console Session · forensics flag credential injection ✓ Shell Jump switches, routers, Linux CLI SSH 22 / Telnet 23 terminal xterm / VT100 keep-alive 0–300 s Remote VNC legacy / non-Windows GUIs default port 5900 target needs RFB 3.8+ view-level control only Web Jump vCenter, firewall/switch GUIs browser (CEF) runs ON the Jumpoint · Windows JP only Verify Certificate gotcha! Protocol Tunnel SSMS, mysql, kubectl — your tools via 127.0.0.1:port 6 variants · K8s = Linux JP MySQL: caching_sha2_password Jump Client roaming / unknown networks installed agent · NO Jumpoint always-on outbound 443 state-aware · mass-deployable Picker: screen → RDP/VNC · CLI → Shell · browser console → Web · your own thick tool → Tunnel · box roams → Jump Client untrusted/attacker trusted/vaulted policy/decision key insight allowed/audited Keep this open during your first month on a PRA queue: each tile carries the type’s default port, its natural targets, and the per-type gotcha (Web Jump’s certificate check, MySQL’s auth plugin, Kubernetes’ Linux-Jumpoint rule). Creating doorways at scale: the Jump Shortcuts Mass Import Wizard in /login takes a per-type CSV template — max 5 MB , one Jump Item type per file — so an 800-server segment becomes a spreadsheet exercise, not a clicking marathon. And one operational note that saves audit pain: name items by what they ARE ( db-win-prod-04 ), pin them to the right Jump Group at import time, and your Jump interface stays searchable at 3 AM. PROVE YOU OWN THE JUMP MODEL Take any real ask — “give the DB vendor audited access to one SQL Server, weekdays only, with approval” — and name: the family (known network → Jumpoint), the type (SQL Server Protocol Tunnel so their DBA keeps SSMS), the group (vendor-db), the role (Start Sessions Only), the policy (schedule OR approval — never both on one policy, so here: approval), and where the recording lands (Reports, 90-day on-box). If you can chain those six choices cold, you are ready for the PRA Administration cert exam — 40 questions, 75% to pass, two attempts. 🎮 Hands-on: BeyondTrust PAM Essentials room Recap: PRA Fundamentals (lesson 10) Quick check · Q4 of 10 Priya at ICICI builds a MySQL Protocol Tunnel Jump. Her laptop’s mysql client connects directly to the DB just fine, but through the tunnel, authentication always fails. Why? a) Protocol Tunnel Jump only supports SQL Server databases b) The tunnel requires port 5900 to be open on the DB host c) Her Jumpoint is Linux, and MySQL tunnels need Windows d) The DB account uses the mysql_native_password plugin — PRA’s MySQL tunnel requires caching_sha2_password; alter the user’s auth plugin Correct: d. The MySQL Protocol Tunnel variant documents a hard requirement on the caching_sha2_password server auth plugin — a direct mysql client tolerates mysql_native_password, the tunnel does not, which is exactly why “direct works, tunnel fails.” There are six tunnel variants, not just SQL Server (a); 5900 is VNC’s port (b); the Linux-Jumpoint rule applies to the Kubernetes variant, not MySQL (c). ### 🤖 Ask the AI Tutor Tap any question — instant, scoped to this lesson. No login, no waiting. Jump Client or Jumpoint for our datacenter? Why did 40 of our Jump Clients vanish overnight? The interviewer said Gateway, the docs say Jumpoint — which is right? How many sessions can one Jumpoint really handle? Local Jump vs Remote Jump — what is the actual difference? Why Protocol Tunnel instead of just Shell Jump for database work? Pre-curated from BeyondTrust docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in. ## 📝 Wrap-up assessment — six more You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end. Q5 · Remember Per the BeyondTrust PRA documentation, which statement is correct? a) A Jump Shortcut is any Jump Item, including Jump Clients b) A Jump Shortcut is any Jump Item that is NOT a Jump Client c) A Jumpoint is the agent installed on every target endpoint d) A Jump Group controls WHEN sessions may start Correct: b. Verbatim from the docs: a Jump Shortcut is “any Jump Item that is not a Jump Client.” (a) inverts it; (c) describes the Jump Client — a Jumpoint is ONE gateway per network; (d) confuses the Jump Group (organisation + visibility) with the Jump Policy (when/how). Q6 · Apply Meera at Flipkart must keep 1,200 delivery-hub laptops reachable for support. They roam across home Wi-Fi, dongles and hub networks the company does not control. Best design? a) One Jumpoint at Bengaluru HQ with Remote RDP shortcuts to each laptop b) Web Jump items pointing at each laptop c) A VPN profile on every laptop plus Local Jump d) Jump Clients pushed via the mass deployment wizard, pre-pinned to a Jump Group and Jump Policy Correct: d. Roaming/unknown networks are exactly the Jump Client case — each agent dials OUT on 443 from wherever it sits. A Jumpoint (a) only reaches its OWN known network; it has no path to a laptop on home Wi-Fi. Web Jump (b) targets web consoles, not laptops. A VPN (c) reintroduces the network-wide access PRA exists to remove. Q7 · Apply Aditya at Airtel needs audited access into one POP: the SSH CLIs of 40 switches plus the HTTPS GUIs of 6 firewall managers. No agents can be installed on network gear. Pick the layout. a) One Jumpoint host in the POP; Shell Jump items (SSH, port 22) for the switches and Web Jump items for the firewall GUIs b) Jump Clients on all 46 devices c) Remote RDP items for everything on port 3389 d) A single Network Tunnel Jump with no filter rules Correct: a. Network gear cannot run agents (b is impossible) — the Jumpoint proxies agentless protocols from inside the POP. Shell Jump speaks SSH/Telnet for the switch CLIs; Web Jump renders each firewall GUI in a browser on the (Windows) Jumpoint, fully recorded. RDP (c) is a Windows-desktop protocol. A Network Tunnel (d) requires at least one filter rule and gives raw reach, not 46 named, individually-audited doorways. Q8 · Analyze At ICICI the team replaced the appliance SSL certificate on Friday night. By Monday, hundreds of Jump Clients across branches show offline; nothing else changed. Best next move? a) Mass-redeploy all Jump Clients immediately b) Roll the appliance back to the previous software version c) Wait — the docs allow 24–48 hours after a certificate change for Jump Clients to pick up the new cert; never combine a cert change with a hostname change, and do not redeploy mid-window d) Shorten the lost-client timer so the clients reconnect faster Correct: c. This is documented behaviour: after an SSL certificate change, give Jump Clients 24–48 hours to receive and trust the new cert. Mass-redeploying (a) creates duplicate entries and orphans history; rollback (b) treats a known propagation window as a defect; the lost timer (d) only LABELS unconnected clients — it has no power to reconnect anything. Q9 · Analyze Remote Jump from a healthy, online Windows Jumpoint to domain servers fails with access errors during the agentless push — yet Shell Jump through the same Jumpoint works. Root cause? a) The default VNC port is wrong on the Jump Items b) The Jumpoint service runs as Local System (the install default), which has no rights on the targets — and the push also needs ADMIN$/IPC$, Remote Registry and TCP 135/445; switch the service to a domain account with local admin c) The targets’ MySQL accounts use the mysql_native_password plugin d) The appliance needs inbound TCP 3389 opened from the internet Correct: b. Shell Jump working proves the Jumpoint and its 443 path are fine, isolating the fault to the Windows push path: Local System has zero authority on other machines, and the push depends on admin shares, Remote Registry and 135/445. VNC ports (a) and MySQL plugins (c) belong to other Jump types; (d) violates the whole model — nothing ever dials inbound, and RDP legs stay inside the LAN. Q10 · Evaluate TCS runs a managed datacenter: 800 fixed Windows/Linux servers in one segment, plus 30 DBAs who insist on using SSMS from their laptops. Design A: Jump Clients on all 800 servers, direct RDP for the DBAs. Design B: a clustered Jumpoint pair in the segment, Remote RDP + Shell Jump shortcuts for the servers, and SQL Server Protocol Tunnel Jump items for the DBAs. Evaluate. a) A — agents are state-aware, so 800 agents is always more reliable b) A — protocol tunnels cannot be audited c) B — a known fixed network is the Jumpoint case: zero agents to lifecycle on 800 boxes, the clustered pair (up to 10 nodes) removes the single point of failure, and SQL tunnels let DBAs keep SSMS while every byte rides the audited 443 path d) Neither — issue VPN profiles and shared local-admin passwords Correct: c. B matches the documented decision rule and minimises operational surface: one clustered gateway versus 800 agent lifecycles (upgrade waves, EDR exclusions, lost/delete timers). Tunnels ARE policy-controlled and recorded — (b) is false — and PRA 25.3 even injects Vault credentials into SQL tunnels. State-awareness (a) does not outweigh 800 redundant lifecycles on boxes that never move, and (d) abandons least privilege entirely. Submit all answers Try again Lesson complete — saved to your profile. Almost! You need 70% (7 of 10) — re-read the path that tripped you up and tap "Try again". ### 🧠 In your own words Type one line: In one line: when is an agent on every box (Jump Client) the WRONG answer? Then compare to the expert version. Compare with expert answer Expert version: When the targets sit on a known, fixed network you control — one Jumpoint there reaches them all agentless (RDP, SSH, VNC, Web, tunnels), so per-box agents only add deployment and lifecycle overhead; save Jump Clients for boxes that roam or networks you do not own. ### 🗣 Teach a friend Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary. Generate my one-liner 📩 Quiz me on this in 7 days. Opt in and we'll email 3 micro-questions on Jump Technology at Day 1, Day 7 and Day 30 — spaced repetition is how this sticks. Un-tick any time. ### 📖 Glossary Jump Item Umbrella term for any pre-defined endpoint in PRA, however it is reached. One item = one saved doorway to one target. Jump Shortcut Any Jump Item that is NOT a Jump Client — Remote RDP, Shell, VNC, Web, Protocol Tunnel, Local/Remote Jump. Jump Client Installed agent keeping a one-to-one, persistent OUTBOUND 443 connection from a target to the appliance; state-aware. Jumpoint (Gateway) One host — or a cluster of up to 10 nodes — inside a known network that proxies sessions to agentless neighbours. Pathfinder docs say Gateway. Jump Group A collection of Jump Items; membership decides who can even SEE those items in the access console. Jump Item Role Permission set on a Jump-Group relationship — defaults: Administrator, Start Sessions Only, Auditor (v25.2, View Reports only). Direct user role beats group-policy role. Jump Policy Controls WHEN/HOW items are used: schedule, approval, ticket ID, 2FA, notifications, recording override. Schedule and approval never share one policy. Shell Jump SSH (22) or Telnet (23) session to network gear or Linux via a Jumpoint; terminal xterm/VT100, keep-alive 0–300 s. Web Jump Audited browser session to a web console (vCenter, firewall GUI); the embedded browser (CEF) runs ON the Jumpoint — Windows Jumpoints only. Protocol Tunnel Jump Forwards a local port (127.0.0.1) through the Jumpoint to a remote host:port — six variants incl. MySQL (caching_sha2_password) and Kubernetes (Linux Jumpoint). State-aware A Jump Client reports whether a user is present at the endpoint — check before grabbing a production console. B Series Appliance The PRA core (physical, virtual or cloud). Every console, Jump Client and Jumpoint dials OUT to it; only ports 80/443 are required. #### 📚 Sources BeyondTrust Docs — Privileged Remote Access: Jump Technology overview (Jump Client, Jumpoint/Gateway, Jump Group, Jump Item Role, Jump Policy definitions; Pathfinder renames). docs.beyondtrust.com/pra/docs/jump-overview - BeyondTrust Docs — PRA v24.3 Jump Shortcuts guide (every type’s fields and defaults: RDP 3389, VNC 5900, SSH 22/Telnet 23, all six Protocol Tunnel variants, Web Jump CSS-selector hints, mass-import CSV limits). docs.beyondtrust.com/pra/v24.3/docs/jump-shortcuts - BeyondTrust Docs — PRA Jump Clients guide (mass deployment wizard, lost/delete maintenance timers, Uninstalled Jump Client Behavior, upgrade throttling, statistics, Wake-on-LAN, capacity tiers) + Jump Client error strings. docs.beyondtrust.com/pra/docs/jump-clients · docs.beyondtrust.com/pra/v24.3/docs/jump-client-errors - BeyondTrust Docs — PRA Jumpoint guide (Local System default, ADMIN$/IPC$/Remote Registry/135-445 requirements, clustered Jumpoint up to 10 nodes, loopback unsupported, sizing guidance) and network considerations (outbound-only; ports 80/443). docs.beyondtrust.com/pra/docs/jumpoint · docs.beyondtrust.com/pra/docs/on-prem-network-considerations - BeyondTrust Beekeepers community — “Jump Clients offline” after appliance upgrade (EDR blocked the reinstall; duplicate cleanup) and “Default browser for Web Jump” (CEF on the Jumpoint). beekeepers.beyondtrust.com/general-51/jump-clients-offline-5503 · beekeepers.beyondtrust.com/general-51/default-browser-for-web-jump-method-5610 - BeyondTrust Docs — PRA on-prem admin guide (/login menu tree: Asset Management — Asset Groups, Asset Policies, Asset Roles, Gateway, Assets) and Jump Item Roles incl. Auditor (v25.2). docs.beyondtrust.com/pra/docs/on-prem-admin-guide · docs.beyondtrust.com/pra/docs/pf-jump-item-roles - BeyondTrust University — Privileged Remote Access Administration course + certification (40-question exam, 75% pass mark, two attempts; up to 16 CPE hours). beyondtrust.com/services/beyondtrust-university/privileged-remote-access-administration ### What's next? You can now open any doorway — but the best part of PRA is that nobody carries keys. Next: the built-in Vault — discovery, rotation, and injecting credentials into sessions so engineers never see a password at all. Next · PRA Vault & credential injection → Practice on exam.techclick.in → --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt