1Y0-204 Security Practice Test 2 — 15 Questions

Question 1

A Citrix Administrator is troubleshooting a security audit finding: ICA sessions are being established over TCP port 1494 without encryption, despite a policy requiring encryption. The administrator verifies that the 'Secure ICA' policy is enabled with 128-bit encryption. Which factor could prevent the policy from taking effect for these sessions?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'Secure ICA' policy is applied to the Delivery Group, but the user is connecting through a deprecated Receiver version that does not support 128-bit encryption.. The most likely cause is that the client Receiver version does not support the required 128-bit encryption level. When the VDA enforces Secure ICA with 128-bit, it requires the client to support that level. If the client is outdated or misconfigured, the VDA may allow a fallback to an unencrypted session or refuse the connection, leading to the audit finding. The other options do not directly prevent ICA encryption from being applied.

Answer

The VDA is configured to use the 'HDX Adaptive Transport' with UDP, which bypasses ICA encryption.

Answer

The VDA is registered with a StoreFront server that is not configured for HTTPS.

Answer

The 'Secure ICA' policy is being overridden by a higher-priority policy that disables encryption.

Question 2

An administrator is configuring a Citrix Virtual Apps and Desktops 7 site. The security policy mandates that all user sessions must be encrypted using FIPS 140-2 validated cryptography. Which action should the administrator take to meet this requirement?

Accepted Answer

Enable the Windows FIPS local security policy on all VDAs and Delivery Controllers.. FIPS 140-2 validated cryptography is enforced by enabling the Windows FIPS local security policy on all relevant servers, including VDAs and Delivery Controllers. Citrix components then use FIPS-validated algorithms. There is no direct Citrix policy to toggle FIPS mode; it relies on the OS setting. Therefore, enabling the Windows FIPS policy is the correct action.

Answer

Configure the 'Encryption' policy in Citrix Studio to 'FIPS'.

Answer

Enable the 'FIPS 140-2' compliance mode on each VDA via the Citrix Policy.

Answer

Install a third-party FIPS module on the Citrix Gateway.

Question 3

A Citrix Administrator is configuring StoreFront to present a single unified store to users who authenticate against two different Active Directory domains in separate forests, with no trust between them. Users must be able to launch their assigned resources without being prompted twice. Which StoreFront authentication method should the administrator configure?

Accepted Answer

Configure two authentication services in StoreFront, one per domain, and chain them with the StoreFront multi-domain authentication feature. StoreFront can host multiple authentication services within one store, each bound to a different domain or forest. This lets users from untrusted domains authenticate once against the service that matches their account, after which their resources are enumerated and launched normally. Configuring a single authentication method assumes a shared identity source, which does not exist between the two forests.

Answer

SAML authentication using Citrix Federated Authentication Service as the identity provider

Answer

Integrated Windows Authentication with Kerberos constrained delegation enabled on the StoreFront servers

Answer

Deploy a Citrix Gateway with smart card authentication in front of StoreFront

Question 4

A Citrix Administrator is configuring a Delivery Group that contains shared hosted desktops used by contractors. Corporate policy states that contractors must only see and launch the published applications assigned to their own department, and that users must be unable to enumerate other departments' applications or desktops. Which setting should the administrator configure on the Delivery Group to meet this requirement?

Accepted Answer

Enable the Delivery Group's "Restrict visibility to users and groups" option on the User Settings tab.. Restricting resource visibility at the Delivery Group level ensures that enumeration returns only the resources a user is entitled to. When the restriction is enabled, contractors see only their assigned applications and desktops, and cannot discover other departments' resources, satisfying the corporate isolation policy without altering store-wide behaviour.

Answer

Enable "Show applications and desktops in the same session" on the StoreFront store.

Answer

Set the Delivery Group's "View" to "Manage" for the contractor Active Directory group on the Basic tab.

Answer

Clear the "Allow users to see all resources" option on the Delivery Group's StoreFront configuration.

Question 5

A Citrix Administrator is deploying a new Windows Server 2019 VDA that will host published applications for a high-security department. The security team requires that all inbound ICA/HDX sessions to this VDA be encrypted with TLS and that the VDA verify the identity of connecting clients. Which two components must the administrator configure to meet these requirements?

Accepted Answer

Enable TLS on the VDA listener and configure the VDA to require a client certificate signed by a trusted CA.. TLS on the VDA listener provides encryption for the ICA/HDX session, while requiring a trusted client certificate causes the VDA to authenticate the connecting endpoint. Combining these two settings delivers both confidentiality and mutual identity verification for the high-security department's published applications.

Answer

Configure the VDA to require TLS and enable "Require TLS" on the Delivery Controller.

Answer

Configure StoreFront to use HTTPS and enable TLS 1.2 on the StoreFront server.

Answer

Install a server certificate on the VDA and enable TLS on the VDA's listener.

Question 6

A Citrix Administrator has configured a Citrix Gateway in front of StoreFront and wants to ensure that ICA traffic between the Gateway and internal VDAs is encrypted end to end. The administrator enables Secure ICA on the VDAs. Which additional configuration is required on the Gateway to preserve end-to-end encryption of the ICA stream?

Accepted Answer

Set the Gateway session policy to use ICA proxy mode and ensure the Secure ICA setting on the VDA is enabled. End-to-end ICA encryption requires that the Gateway not terminate the ICA stream. ICA proxy mode on the Gateway passes the ICA traffic through to the VDA, and Secure ICA on the VDA encrypts that traffic. Together they keep the stream encrypted from VDA to endpoint. Other Gateway modes either decrypt the traffic or do not support ICA properly.

Answer

Enable the Citrix Gateway ICA proxy and set the Secure ICA setting to match the VDA encryption level

Answer

Configure the Gateway to use the Secure ICA setting and ensure the VDA and Gateway share the same encryption level and key

Answer

Configure a SSL bridge on the Gateway so that ICA traffic is passed through without decryption

Question 7

Refer to the exhibit. An administrator runs the provided command on a Delivery Controller. What is the security implication of this setting?

Accepted Answer

The Delivery Controller will trust XML requests from StoreFront servers without requiring additional authentication.. This command allows the XML service to trust requests without explicit authentication checks from the StoreFront server. While it simplifies connectivity between StoreFront and the Delivery Controller, it reduces the security posture by potentially allowing unauthorized requests to reach the site. It is critical to ensure that communication between these components is isolated in a secure network segment to prevent internal attackers from spoofing requests to the XML service.

Answer

The XML service will reject all connections from non-trusted IP addresses.

Answer

The connection between the client and the XML service is now automatically encrypted using TLS.

Answer

The XML service port will now only accept traffic over HTTPS.

Question 8

A security audit reveals that VDA machines are susceptible to local privilege escalation. Which Citrix policy should the administrator configure to prevent users from running unauthorized applications on the VDA?

Accepted Answer

Implement 'AppLocker' or 'WEM Security' policies.. AppLocker or Citrix Workspace Environment Management (WEM) Security policies are the industry-standard methods to enforce application whitelisting on VDAs. By defining strict execution policies, administrators ensure that only signed or authorized binaries can execute within the user session. This prevents malicious scripts or unauthorized executables from running, thereby mitigating the risk of users gaining administrative privileges or compromising the integrity of the virtual desktop environment during the session.

Answer

Enable 'File Type Association' for all users.

Answer

Restrict 'Clipboard Redirection' in Citrix policies.

Answer

Disable 'Local Drive Mapping' in the session.

Question 9

An administrator wants to ensure that end-user sessions are automatically terminated after 30 minutes of inactivity. Which policy should be configured?

Accepted Answer

Idle timer.. Idle timer policies are essential for maintaining security in environments where workstations might be left unattended. By configuring the 'Idle timer' setting to 30 minutes, the system forces the session to log off or disconnect, ensuring that sensitive data is not exposed to passersby. This is a critical security control to prevent unauthorized use of active user sessions in shared or high-traffic office areas.

Answer

Session connection timer.

Answer

Disconnected session timer.

Answer

Auto-client reconnect timer.

Question 10

Refer to the exhibit. A user receives this error when attempting to launch a resource via Citrix Gateway using Kerberos constrained delegation. What is the most likely cause?

Accepted Answer

The Service Principal Name (SPN) is missing or incorrectly configured.. This error typically indicates a failure in the Kerberos ticket exchange process between the Gateway and the backend resource. When Kerberos constrained delegation is used, the Gateway must have the appropriate service principal names (SPNs) correctly registered and the delegation settings configured in Active Directory. If the ticket cannot be validated or the delegation path is broken, the authentication service will refuse the request, resulting in this specific credential error.

Answer

The user password has expired in Active Directory.

Answer

The Citrix Gateway certificate has expired.

Answer

The user does not have permission to access the VDA.

Question 11

An administrator is tasked with securing the internal communication between Delivery Controllers and VDAs. Which protocol should be used for this connection to satisfy security requirements?

Accepted Answer

TLS.. For secure communication between Delivery Controllers and VDAs, it is critical to implement TLS. By enabling TLS on both the VDA and the Controller, all management traffic and registration information are encrypted. This prevents unauthorized inspection or tampering of the control plane traffic, which is vital for maintaining the overall integrity and security of the Citrix Virtual Apps and Desktops infrastructure within the internal data center network.

Answer

HTTP.

Answer

FTP.

Answer

Telnet.

Question 12

An administrator needs to restrict access to a sensitive desktop application based on the user's location. Which feature should be used?

Accepted Answer

Citrix Gateway SmartAccess.. SmartAccess allows administrators to apply dynamic access controls based on the connection context, such as whether a user is connecting from an internal network or an untrusted external location. By defining SmartAccess filters, the administrator can conditionally provide or restrict access to specific sensitive applications, ensuring that highly confidential data is only accessed from secure, verified endpoints and locations, as defined by company security policies.

Answer

Delivery Group filtering.

Answer

Active Directory OU permissions.

Answer

AppLocker execution policy.

Question 13

An administrator needs to ensure that all user data saved on the VDA is encrypted at rest. Which solution is most appropriate?

Accepted Answer

Configure BitLocker on the VDA disk.. To ensure that data is encrypted at rest, the administrator should implement BitLocker or a similar disk-level encryption technology on the underlying storage or the VDA hard drive. This provides a robust layer of protection, ensuring that even if physical storage media is stolen or if a virtual disk file is copied, the data remains unreadable without the appropriate decryption keys, satisfying stringent compliance and security requirements.

Answer

Enable ICA encryption.

Answer

Implement TLS 1.3 for connections.

Answer

Enable SmartAccess.

Question 14

A security team has requested that all administrative access to the Citrix environment be logged to a central, tamper-proof repository. Which Citrix feature provides this capability?

Accepted Answer

Configuration Logging.. Configuration Logging is the built-in mechanism that captures every change made to the Citrix environment, including the identity of the administrator, the time, and the specific change details. By sending these logs to a secure, remote location or using the integrated logging database, organizations create a tamper-proof audit trail that is critical for incident response, security forensics, and compliance auditing in any enterprise Citrix deployment.

Answer

Citrix Analytics.

Answer

Director monitoring.

Answer

Event Viewer logs.

Question 15

An administrator needs to ensure that users connecting from public networks are restricted from accessing local drives on their endpoints during a Citrix Virtual Apps and Desktops session. Which policy setting should the administrator configure to achieve this requirement?

Accepted Answer

Client drive redirection. The 'Client drive redirection' policy setting, when set to 'Prohibited', effectively blocks the mapping of client-side drives within the ICA session. This is a critical security control for preventing data exfiltration from the corporate environment to unsecured local devices. By applying this via Citrix Studio and filtering based on client IP or network location, administrators maintain granular control over endpoint data security without impacting internal LAN users.

Answer

Universal Printer Redirection

Answer

Clipboard redirection

Answer

Removable disk redirection