1Y0-312 Advanced Security and Access Control — 10 Questions

Question 1

An enterprise environment requires SmartAccess for ICA sessions to restrict client drive mapping based on endpoint posture evaluation via Citrix Gateway. Which specific component must be correctly configured to evaluate EPA check results and translate them into Session Policies for Virtual Apps and Desktops?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Citrix Gateway must use EPA expressions within Session Policies to assign Session Profiles containing SmartAccess filters.. Citrix Gateway requires properly configured EPA scans associated with Session Policies and Session Profiles. These expressions evaluate client posture results and apply specific ICA policy filters, allowing administrators to dynamically control feature availability like client drive mapping based on security posture.

Answer

Universal Connector for Active Directory must synchronize endpoint security states to the StoreFront server before launching sessions.

Answer

Citrix Studio must be configured with explicit client-side executable hash filters to match the EPA scan output strings.

Answer

StoreFront must execute the EPA plugin locally within the web browser before issuing an XML trust ticket.

Question 2

A security auditor requires that all external users connecting through Citrix Gateway have their local clipboard disabled, but internal users must retain clipboard functionality. The administrator wants to achieve this using NetScaler SmartControl to minimize the number of Citrix policies. Which TWO steps are required to implement this? (Select TWO)

Accepted Answer

Configure a Citrix Gateway session action to set the 'Client Clipboard' to 'Disabled'.. SmartControl allows administrators to enforce granular security constraints at the NetScaler level, which are then communicated to the VDA via the ICA protocol. This method is highly efficient because it blocks the feature at the entry point of the network. By using SmartControl tags, the administrator can apply specific restrictions to external traffic without creating complex filtered policies within Citrix Studio.

Answer

Create a Citrix Policy in Studio filtered by 'Access Control' using the Gateway farm name and 'ICAC_NoClipboard' tag.

Answer

Enable the 'Adaptive Transport' setting in the Citrix Studio policy to 'On'.

Answer

Install the SmartControl plug-in on all VDAs in the delivery group.

Question 3

An administrator needs to ensure that the Delivery Controllers only accept traffic from trusted StoreFront servers. Which PowerShell command should be executed on the Delivery Controller to enable this security feature?

Accepted Answer

Set-BrokerSite -TrustRequestsSentToTheXmlServicePort $true. Enabling XML Trust is a fundamental security step in Citrix Virtual Apps and Desktops. By default, the Delivery Controller does not trust credential sets passed from StoreFront unless this flag is explicitly set to true. This prevents unauthorized entities from spoofing the XML service to gain access to the environment's resources or user data.

Answer

Set-ConfigSite -XmlServiceSecurity Enabled

Answer

Update-BrokerSite -EnableXmlTrust $true

Answer

Set-BrokerSite -AcceptOnlySecureStoreFrontConnections $true

Question 4

An administrator is configuring App Protection policies to protect against keylogging and screen capturing. Which TWO components must be specifically updated or configured to support this feature? (Select TWO)

Accepted Answer

Citrix Workspace app for Windows or Mac with App Protection component installed.. App Protection policies add a layer of security by intercepting operating system calls to the keyboard and screen. This feature is particularly useful for protecting sensitive data from malware. It requires specific support from both the client-side software and the server-side policy configuration to function correctly and provide the intended anti-malware protections.

Answer

NetScaler Gateway with a valid Premium license.

Answer

A specialized 'App Protection' VDA agent installed on all target machines.

Answer

StoreFront 3.12 or higher with the 'Classic' UI enabled.

Question 5

An administrator wants to implement session watermarking to deter users from taking photos of sensitive data. Which condition must be met for the watermark to appear in the session?

Accepted Answer

The 'Session Watermark' policy must be enabled and configured in Citrix Studio.. Session watermarking is a deterrent against data theft via external devices like cameras. It overlays user-specific information on the screen, making it traceable. However, this feature relies on specific graphics and policy settings to be active. Understanding these prerequisites ensures that the security feature is successfully deployed and visible to the end users.

Answer

The session must be using the Framehawk display protocol.

Answer

The 'Thinwire with H.264' graphics mode must be disabled.

Answer

The 'Universal Print Driver' must be configured for the session.

Question 6

A company is using StoreFront in a multi-site configuration with two separate Citrix Virtual Apps and Desktops sites. Which THREE security considerations are critical when configuring 'User Mapping' for multi-site aggregation? (Select THREE)

Accepted Answer

Ensure that the XML Trust setting is enabled on Delivery Controllers in ALL aggregated sites.. Multi-site aggregation in StoreFront allows for a unified view of resources from different locations. However, this introduces security complexities regarding how user credentials and permissions are handled across site boundaries. Ensuring consistent security across all aggregated sites is paramount to preventing unauthorized access or accidental data exposure in a complex, multi-site environment.

Answer

The 'Controller SIDs' must be identical across both Citrix sites.

Answer

All sites must be running the exact same version and Cumulative Update (CU) of Citrix Virtual Apps and Desktops.

Question 7

To enhance security, an administrator wants to ensure that all ICA traffic is encrypted using the highest possible level. Which Citrix policy setting should be configured to enforce TLS encryption for the ICA stream between the client and the VDA?

Accepted Answer

SSL/TLS for VDA via the SSL Configuration Tool. While NetScaler Gateway encrypts traffic from the client to the Gateway, the traffic from the Gateway to the VDA (or client to VDA internally) may not be encrypted by default. Enforcing end-to-end encryption is a key requirement for many compliance frameworks. This ensures that sensitive data is protected even if the internal network is compromised.

Answer

Basic ICA Encryption

Answer

SecureICA Minimum Encryption Level

Answer

ICA Round Trip Time calculation

Question 8

Which TWO requirements must be met to use the Federated Authentication Service (FAS) to provide single sign-on for NetScaler Gateway users? (Select TWO)

Accepted Answer

An enterprise Certificate Authority (CA) must be available in the Active Directory forest.. FAS is a sophisticated component that bridges the gap between modern authentication and legacy Windows logon requirements. It depends on a properly configured Public Key Infrastructure (PKI) and specific trust relationships within the Citrix environment. Correctly identifying these dependencies is vital for a successful deployment and for maintaining the security of the identity chain.

Answer

All VDAs must be running at least version 7.15 LTSR or higher.

Answer

The FAS server must be installed on the same machine as the Delivery Controller.

Answer

Users must have a physical smart card reader attached to their endpoint device.

Question 9

During a Delivery Controller database outage, the Local Host Cache (LHC) becomes active. How does the LHC handle user permissions and security during this period?

Accepted Answer

LHC uses the information synchronized from the site database to enforce existing permissions.. Local Host Cache ensures high availability by allowing users to continue working during a database failure. However, it operates using a subset of the site's data. Understanding how security and permissions are enforced during an outage is essential for maintaining a secure environment and managing expectations regarding administrative changes during recovery periods.

Answer

LHC ignores all permissions and allows any authenticated user to launch any resource.

Answer

All new user logins are blocked, and only existing sessions are maintained by the LHC.

Answer

LHC requires a manual 'Security Override' flag to be set via PowerShell to function.

Question 10

An administrator is setting up Session Recording and needs to ensure that only authorized security officers can view the recorded sessions. Where is the access control for viewing recordings configured?

Accepted Answer

The Session Recording Authorization Console.. Session Recording is a powerful tool for auditing and compliance, but the recordings themselves contain sensitive data. Controlling who can view these recordings is a critical security task. Citrix provides a dedicated administrative console for managing these permissions, ensuring that session data is only accessible to those with a legitimate need-to-know.

Answer

Citrix Studio under the 'Delegated Administration' node.

Answer

Active Directory 'Session Viewers' Group Policy Object.

Answer

The NetScaler Gateway 'Audit Policy' configuration.