When would the Junos Pulse Access Control Service push auth table entries to an SRX Series device acting as a Layer 3 enforcer?

When would the Junos Pulse Access Control Service push auth table entries to an SRX Series
device acting as a Layer 3 enforcer?

A.
after the session user role is assigned

B.
during the role-mapping process

C.
during a successful user authentication

D.
before the role restrictions are validated

Explanation: