1Y0-312 Advanced Security and Access Control — All Questions With Answers

Question 1mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An enterprise environment requires SmartAccess for ICA sessions to restrict client drive mapping based on endpoint posture evaluation via Citrix Gateway. Which specific component must be correctly configured to evaluate EPA check results and translate them into Session Policies for Virtual Apps and Desktops?

Question 2hardmulti select

Read the full Advanced Security and Access Control explanation →

A security auditor requires that all external users connecting through Citrix Gateway have their local clipboard disabled, but internal users must retain clipboard functionality. The administrator wants to achieve this using NetScaler SmartControl to minimize the number of Citrix policies. Which TWO steps are required to implement this? (Select TWO)

Question 3easymultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator needs to ensure that the Delivery Controllers only accept traffic from trusted StoreFront servers. Which PowerShell command should be executed on the Delivery Controller to enable this security feature?

Question 4mediummulti select

Read the full Advanced Security and Access Control explanation →

An administrator is configuring App Protection policies to protect against keylogging and screen capturing. Which TWO components must be specifically updated or configured to support this feature? (Select TWO)

Question 5mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator wants to implement session watermarking to deter users from taking photos of sensitive data. Which condition must be met for the watermark to appear in the session?

Question 6hardmulti select

Read the full Advanced Security and Access Control explanation →

A company is using StoreFront in a multi-site configuration with two separate Citrix Virtual Apps and Desktops sites. Which THREE security considerations are critical when configuring 'User Mapping' for multi-site aggregation? (Select THREE)

Question 7mediummultiple choice

Read the full Advanced Security and Access Control explanation →

To enhance security, an administrator wants to ensure that all ICA traffic is encrypted using the highest possible level. Which Citrix policy setting should be configured to enforce TLS encryption for the ICA stream between the client and the VDA?

Question 8mediummulti select

Read the full Advanced Security and Access Control explanation →

Which TWO requirements must be met to use the Federated Authentication Service (FAS) to provide single sign-on for NetScaler Gateway users? (Select TWO)

Question 9mediummultiple choice

Read the full Advanced Security and Access Control explanation →

During a Delivery Controller database outage, the Local Host Cache (LHC) becomes active. How does the LHC handle user permissions and security during this period?

Question 10easymultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is setting up Session Recording and needs to ensure that only authorized security officers can view the recorded sessions. Where is the access control for viewing recordings configured?

Question 11hardmultiple choice

Read the full Advanced Security and Access Control explanation →

Refer to the exhibit. An administrator has applied this policy to restrict clipboard redirection. However, users connecting via Chrome are still experiencing clipboard functionality. What is the most likely cause for this behavior?

Exhibit

ns_policy_map: { "policy_name": "restrict_clipboard", "action": "deny", "expression": "HTTP.REQ.HEADER(\"User-Agent\").CONTAINS(\"Chrome\")" }

Question 12mediummulti select

Read the full Advanced Security and Access Control explanation →

An administrator wants to secure the internal Citrix infrastructure. Which THREE actions should the administrator take to implement a 'Zero Trust' approach for Virtual Apps and Desktops? (Choose three.)

Question 13hardmultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is configuring a Citrix Gateway to support SmartAccess. The administrator needs to ensure that users connecting from a non-company managed device have the 'Print' function disabled in their session. Where should this policy be configured?

Question 14mediummulti select

Read the full Advanced Security and Access Control explanation →

Which TWO of the following methods are effective for securing the communication between the VDA and the Delivery Controller? (Choose two.)

Question 15mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator must prevent users from using the 'Save As' function within a virtual application to copy data to a local USB drive. Which Citrix policy should be modified to achieve this requirement?

Question 16mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An organization wants to log all user access activities for auditing purposes. Which Citrix feature provides detailed visibility into the specific resources accessed and the time of access?

Question 17hardmultiple choice

Read the full Advanced Security and Access Control explanation →

Which mechanism ensures that only authorized users can access specific published applications based on their current Active Directory group membership?

Question 18mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is tasked with ensuring that all internal traffic to the Delivery Controller is encrypted. Which protocol should be enabled on the Delivery Controller to enforce this?

Question 19hardmulti select

Read the full Advanced Security and Access Control explanation →

A security audit requires that all virtual desktop sessions are encrypted using TLS, and that internal traffic between VDAs and StoreFront servers remains secure. Which TWO steps must the administrator perform to harden the environment?

Question 20mediummultiple choice

Read the full Advanced Security and Access Control explanation →

Refer to the exhibit. An administrator is configuring a Citrix Gateway for remote access. After applying the configuration shown, remote users report they cannot launch applications, though authentication succeeds. What is the most likely cause of this issue?

Exhibit

add vpn vserver VIP_GATEWAY -httpProfile ns_http_profile_secure
set vpn vserver VIP_GATEWAY -icaProxy ON -authType CERT
set vpn vserver VIP_GATEWAY -dtls ON

Question 21hardmultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is configuring SmartAccess on Citrix Gateway to control clipboard redirection for ICA sessions. The requirement is that users connecting from managed endpoints evaluated as compliant by Citrix Endpoint Management may copy and paste between local and remote sessions, while all other users must not. The administrator has already configured the Gateway session policy to include the EPA scan result as a session variable and set up the Delivery Controller to trust the Gateway. Which action must the administrator take to enforce the clipboard restriction based on the EPA result?

Question 22mediummultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix administrator is deploying a new Citrix Gateway in a Citrix Virtual Apps and Desktops 7 environment. The security team requires that all user sessions to published applications be encrypted end-to-end using TLS 1.2, and that the gateway not perform any SSL decryption. Which Citrix Gateway configuration should the administrator implement to meet these requirements?

Question 23hardmultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator needs to ensure that all HDX traffic between a VDA and a user device is encrypted with FIPS 140-2 validated cryptography. The administrator has already configured the VDA to use FIPS mode. Which additional step must be taken on the Delivery Controller to enforce FIPS compliance for HDX sessions?

Question 24hardmulti select

Read the full Advanced Security and Access Control explanation →

A Citrix administrator is implementing SmartAccess policies on Citrix Gateway to control access to published applications based on endpoint posture. The security team wants to ensure that users connecting from domain-joined corporate laptops can access all applications, while users connecting from personal devices can only access a limited set. The administrator plans to use Citrix ADC policies and session policies. Which two actions must the administrator take to achieve this? (Choose two.)

Question 25mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is configuring App Protection policies in a Citrix Virtual Apps and Desktops 7 environment. The security team requires that users cannot copy data from published applications to their local clipboard, but they must be able to copy within the published application. Which setting should the administrator configure?

Question 26hardmultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator has configured Smart Access in Citrix Gateway to evaluate endpoint posture. Users connecting from domain-joined corporate laptops should have full access to all published resources, while users connecting from personal devices should only access a limited set of applications. The administrator has created two Delivery Groups: 'FullAccess' and 'LimitedAccess'. Which Citrix policy filter should be used to assign the appropriate Delivery Group based on the endpoint posture?

Question 27hardmultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix administrator is configuring a Citrix Gateway to use SmartAccess with Citrix ADC policies. The requirement is that only users who authenticate with a certificate AND whose device posture check returns a compliant result may access a published application. The administrator has already configured certificate authentication and a posture check policy. Which Citrix Gateway policy expression should be used to combine these conditions so that both must be satisfied?

Question 28mediummulti select

Study the full AAA explanation →

An administrator is configuring a Citrix Gateway to provide secure remote access. The security team requires that all user sessions are encrypted with TLS 1.2 or higher and that users authenticate using multi-factor authentication (MFA). The administrator plans to use RADIUS for MFA. Which TWO actions must the administrator take to meet these requirements? (Choose two.)

Question 29mediummultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator is configuring SmartAccess for a Citrix Gateway. The environment uses a single StoreFront store accessed by both internal and external users. The administrator needs to ensure that only external users receive the 'High' session reliability setting, while internal users receive 'Medium'. The administrator has already created two Citrix policies: 'External_SessionReliability' and 'Internal_SessionReliability'. Both policies are assigned to the same Delivery Controller. What should the administrator do to ensure the correct policy is applied based on the user's connection type?

Question 30hardmulti select

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator is implementing SmartAccess to control access to published applications based on the endpoint analysis results from Citrix Gateway. The administrator wants to ensure that only domain-joined machines with an up-to-date antivirus signature can launch the applications. Which two actions must the administrator take to achieve this? (Choose two.)

Question 31hardmultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is configuring Citrix Gateway to use SmartAccess with Endpoint Analysis (EPA) scans. Users connecting from corporate-owned domain-joined laptops must be allowed full access, while users from personal devices must be restricted to published applications only. The administrator has created two session policies: one with full access and one with restricted access, and two EPA scans: one that checks for domain membership and one that checks for antivirus. Which configuration should the administrator implement to meet these requirements?

Question 32mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is configuring Citrix Application Delivery Management (ADM) to monitor and manage Citrix Gateway instances. The security team requires that all communication between Citrix ADM and the managed Citrix Gateway instances is encrypted and authenticated. Which action should the administrator take to meet this requirement?

Question 33hardmultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is deploying Citrix Gateway with SmartAccess to enforce endpoint policies. The requirement is that users connecting from corporate-owned laptops with domain-joined machines receive full access, while users connecting from personal devices receive restricted access to only a specific published application. The administrator has configured Citrix ADC session policies and endpoint analysis scan policies. Which Citrix ADC policy expression type should be used in the SmartAccess policy to evaluate the results of the endpoint analysis scan?

Question 34mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is configuring a Citrix Gateway to use SmartAccess to restrict access to a specific published application based on whether the user's device is managed by Microsoft Intune. The administrator has already configured the EPA scan on the Gateway to check for Intune enrollment and has verified that the scan returns the correct result. However, all users are still able to access the application regardless of their device's enrollment status. What is the most likely cause?

Question 35hardmulti select

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator is implementing Adaptive Authentication for Citrix Gateway. The administrator wants to trigger an additional authentication prompt (OTP) only when the user's device posture indicates a missing antivirus or an unpatched OS. The environment uses Citrix Gateway 13.0 and Citrix ADC. Which two actions must the administrator take to achieve this? (Choose two.)

Question 36mediummultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator is configuring a Citrix Gateway in a Citrix Virtual Apps and Desktops 7 environment. The security team requires that when users log on to the Gateway, the system must perform a posture check to ensure the endpoint has an up-to-date antivirus signature. If the endpoint fails the check, the user must be placed in a quarantine group that only allows access to a remediation webpage. Which Citrix Gateway policy expression should the administrator use to evaluate the endpoint's antivirus status?

Question 37hardmulti select

Read the full Advanced Security and Access Control explanation →

An administrator is implementing App Protection policies in Citrix Virtual Apps and Desktops 7 to prevent keylogging and screen capturing on user devices. The environment includes Windows and Mac clients. Which TWO components must be present to enable App Protection? (Choose two.)

Question 38hardmultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is implementing Citrix App Protection policies to prevent keylogging and screen capturing of sensitive applications. The administrator has enabled the 'Anti-Keylogging' and 'Anti-ScreenCapture' settings in a Citrix policy and applied it to a Delivery Group. However, users report that they can still capture screenshots using the Snipping Tool on their Windows endpoints. What is the most likely cause of this issue?

Question 39easymultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator needs to ensure that all connections to a published application are encrypted using TLS 1.2 or higher. The environment uses Citrix Virtual Apps and Desktops 7 1912 LTSR with VDAs running on Windows Server 2019. The administrator has already configured the Delivery Controllers to require TLS 1.2. Which additional step must the administrator take to enforce TLS for ICA traffic?

Question 40easymultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator needs to ensure that all connections to a published desktop are encrypted with TLS 1.2 or higher. The environment uses Citrix Virtual Apps and Desktops 7 with StoreFront and Delivery Controllers. Which Citrix policy setting should the administrator configure?

Question 41mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is implementing Azure AD as the Identity Provider (IdP) for a Citrix environment. Users successfully authenticate via the NetScaler Gateway but are prompted for credentials again when launching their published desktops. Which component must be configured to ensure seamless single sign-on to the VDA in this scenario?

Question 42mediummultiple choice

Read the full Advanced Security and Access Control explanation →

A company requires that help desk staff be able to view session information and reset sessions but must not be able to modify machine catalogs or delivery groups. Which built-in administrative role should be assigned to the help desk group?

Question 43hardmultiple choice

Read the full Advanced Security and Access Control explanation →

When using Citrix Gateway with 'Clientless Access' for certain web applications, an administrator notices that some advanced security features of the web apps are breaking. What is the most likely cause of this issue?

Question 44mediummultiple choice

Read the full Advanced Security and Access Control explanation →

A company wants to implement Adaptive Authentication to change the authentication requirements based on the user's location and device posture. Which Citrix component is primarily responsible for evaluating these factors and choosing the appropriate authentication flow?

Question 45mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator needs to ensure that internal users accessing Virtual Apps and Desktops via Citrix Gateway are authenticated using multi-factor authentication, while external users must use a client certificate. Which NetScaler feature should the administrator implement to satisfy these diverse authentication requirements?

Question 46mediummultiple choice

Read the full Advanced Security and Access Control explanation →

A security auditor requires that all users connecting to the internal Citrix environment via NetScaler must have their device disk encrypted. Which feature should the administrator configure to enforce this requirement before the user's session is established?

Question 47easymultiple choice

Read the full Advanced Security and Access Control explanation →

Which component is primarily responsible for performing the initial authentication of a remote user before allowing access to internal Citrix resources?

Question 48hardmultiple choice

Read the full Advanced Security and Access Control explanation →

Refer to the exhibit. An administrator is seeing this error in the NetScaler logs. What is the most appropriate action to resolve this connectivity issue?

Exhibit

log_entry: [ERROR] SSL Handshake failure from 192.168.10.5. Cipher Suite TLS_RSA_WITH_AES_128_CBC_SHA is not supported by the client.

Question 49easymultiple choice

Read the full Advanced Security and Access Control explanation →

Which security best practice should be implemented to protect the Citrix Gateway against brute-force password guessing attacks?

Question 50hardmulti select

Read the full Advanced Security and Access Control explanation →

Which THREE configurations contribute to a 'Hardened' VDA environment? (Choose three.)

Question 51mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator needs to implement granular control over clipboard redirection based on the user's connection point. Users accessing resources from the internal office network should have full clipboard access, while those connecting via Citrix Gateway from public locations must have clipboard redirection disabled. Which tool should the administrator configure to achieve this?

Question 52hardmultiple choice

Read the full Advanced Security and Access Control explanation →

A company requires that users accessing virtual desktops via Citrix Gateway must pass a multi-factor authentication (MFA) check. The administrator uses Citrix ADC as the SAML Service Provider. Which configuration step is mandatory to ensure the SAML assertion is correctly validated?

Question 53mediummultiple choice

Read the full Advanced Security and Access Control explanation →

Which feature should an administrator enable to protect against unauthorized users capturing the screen or recording keystrokes from a compromised endpoint while a user is working in a virtual session?

Question 54mediummultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator is configuring smart card authentication for internal users accessing published applications through Citrix Workspace app. The administrator wants to enforce the use of a specific cryptographic service provider (CSP) on the VDA for all smart card operations. Which Citrix policy setting should the administrator configure?

Question 55mediummulti select

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator is configuring a Citrix Gateway to provide secure remote access to published applications. The administrator wants to implement SmartAccess to control access based on endpoint analysis results. Which two components are required to enable SmartAccess with EPA? (Choose two.)

Question 56easymultiple choice

Study the full AAA explanation →

A Citrix Administrator is configuring a Citrix Gateway to authenticate users with RADIUS two-factor authentication. The administrator wants to ensure that users are prompted for their RADIUS credentials only after successful Active Directory authentication. Which authentication policy configuration should the administrator use?

Question 57mediummultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator is configuring a Citrix Gateway to provide access to published applications. The administrator wants to ensure that users can only access resources if their device has a specific registry key set. Which Citrix Gateway feature should the administrator use?

Question 58easymultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is configuring Citrix Gateway to use Adaptive Authentication. The security team wants to require multi-factor authentication (MFA) only when users connect from outside the corporate network. Which Citrix ADC policy expression should the administrator use to trigger MFA based on the user's location?

Question 59mediummultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix administrator needs to enforce a policy that prevents users from accessing local drives and printers on their endpoint devices when they connect to published applications through Citrix Gateway. The policy must apply only to remote users and not to internal users. Which Citrix policy setting and filter should the administrator configure?

Question 60mediummultiple choice

Study the full AAA explanation →

A Citrix Administrator must configure a Citrix Gateway so that when users authenticate, they are required to provide their domain credentials plus a one-time passcode generated by a RADIUS server. The administrator has already configured the RADIUS server as an authentication policy and bound it to the Gateway. However, after testing, users are prompted for credentials twice but are never asked for a passcode. What should the administrator do to resolve this?

Question 61easymultiple choice

Study the full AAA explanation →

A Citrix administrator is setting up a new StoreFront store for external users. The security team requires that users authenticate using their Active Directory credentials, and that the authentication process is protected with multi-factor authentication (MFA). The company uses Citrix Gateway with RADIUS for MFA. Which authentication method should the administrator configure on Citrix Gateway to meet these requirements?

Question 62hardmultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator is configuring a Citrix Gateway to use Smart Card authentication for external users. The environment uses a two-factor authentication requirement: smart card and Active Directory password. The administrator has configured the Gateway virtual server with a Smart Card authentication policy and an LDAP authentication policy. Users report that they are only prompted for the smart card and not for the LDAP password. What should the administrator do to enforce the two-factor authentication?

Question 63mediummultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator is configuring a Citrix Gateway to provide access to published applications. The security team requires that all user connections use smart card authentication with certificate validation. The administrator has configured the gateway with a server certificate and enabled smart card authentication. Users report that they are prompted for a PIN but then receive an error stating 'Cannot complete your request.' Which Citrix ADC setting should the administrator verify to ensure that the client certificate is being validated correctly?

Question 64hardmultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is implementing SmartAccess policies in a Citrix Virtual Apps and Desktops 7 environment with Citrix Gateway. The requirement is to allow users to access a published application only if they connect through Citrix Gateway and their endpoint has a specific registry key set. The administrator has configured the Gateway and StoreFront. Which Delivery Controller policy filter should be used to enforce this condition?

Question 65easymultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is configuring Citrix StoreFront to use HTTPS for all communications. The security team requires that the StoreFront server uses a certificate that is trusted by all user devices. The administrator has obtained a certificate from a public CA and installed it on the StoreFront server. Which StoreFront configuration must be updated to bind the certificate to the IIS website?

Question 66hardmultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is configuring Citrix Gateway to use SAML authentication with Microsoft Azure AD as the identity provider. The requirement is that users must authenticate using Azure AD and then be authorized to access specific published applications based on their group membership in Azure AD. The administrator has configured the SAML action and policy on Citrix ADC and imported the Azure AD certificate. Which Citrix ADC feature should be configured to extract the group membership from the SAML assertion and use it for authorization?

Question 67hardmulti select

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator is configuring App Protection policies in a Citrix Virtual Apps and Desktops 7 environment to prevent keylogging and screen capturing on user devices. The administrator wants to ensure that the protection is applied to both the VDA and the user device. Which two components must be installed or configured to enable App Protection? (Choose two.)

Question 68mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator needs to configure a Citrix Gateway to use Smart Card authentication for users connecting from outside the network. The environment uses Citrix Virtual Apps and Desktops 7 with StoreFront. The administrator has installed the Smart Card certificate on the Gateway and configured the LDAP authentication policy. What additional step must be taken on the Gateway to enable Smart Card authentication?

Question 1mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An enterprise environment requires SmartAccess for ICA sessions to restrict client drive mapping based on endpoint posture evaluation via Citrix Gateway. Which specific component must be correctly configured to evaluate EPA check results and translate them into Session Policies for Virtual Apps and Desktops?

Question 2hardmulti select

Read the full Advanced Security and Access Control explanation →

A security auditor requires that all external users connecting through Citrix Gateway have their local clipboard disabled, but internal users must retain clipboard functionality. The administrator wants to achieve this using NetScaler SmartControl to minimize the number of Citrix policies. Which TWO steps are required to implement this? (Select TWO)

Question 3easymultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator needs to ensure that the Delivery Controllers only accept traffic from trusted StoreFront servers. Which PowerShell command should be executed on the Delivery Controller to enable this security feature?

Question 4mediummulti select

Read the full Advanced Security and Access Control explanation →

An administrator is configuring App Protection policies to protect against keylogging and screen capturing. Which TWO components must be specifically updated or configured to support this feature? (Select TWO)

Question 5mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator wants to implement session watermarking to deter users from taking photos of sensitive data. Which condition must be met for the watermark to appear in the session?

Question 6hardmulti select

Read the full Advanced Security and Access Control explanation →

A company is using StoreFront in a multi-site configuration with two separate Citrix Virtual Apps and Desktops sites. Which THREE security considerations are critical when configuring 'User Mapping' for multi-site aggregation? (Select THREE)

Question 7mediummultiple choice

Read the full Advanced Security and Access Control explanation →

To enhance security, an administrator wants to ensure that all ICA traffic is encrypted using the highest possible level. Which Citrix policy setting should be configured to enforce TLS encryption for the ICA stream between the client and the VDA?

Question 8mediummulti select

Read the full Advanced Security and Access Control explanation →

Which TWO requirements must be met to use the Federated Authentication Service (FAS) to provide single sign-on for NetScaler Gateway users? (Select TWO)

Question 9mediummultiple choice

Read the full Advanced Security and Access Control explanation →

During a Delivery Controller database outage, the Local Host Cache (LHC) becomes active. How does the LHC handle user permissions and security during this period?

Question 10easymultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is setting up Session Recording and needs to ensure that only authorized security officers can view the recorded sessions. Where is the access control for viewing recordings configured?

Question 11hardmultiple choice

Read the full Advanced Security and Access Control explanation →

Refer to the exhibit. An administrator has applied this policy to restrict clipboard redirection. However, users connecting via Chrome are still experiencing clipboard functionality. What is the most likely cause for this behavior?

Exhibit

ns_policy_map: { "policy_name": "restrict_clipboard", "action": "deny", "expression": "HTTP.REQ.HEADER(\"User-Agent\").CONTAINS(\"Chrome\")" }

Question 12mediummulti select

Read the full Advanced Security and Access Control explanation →

An administrator wants to secure the internal Citrix infrastructure. Which THREE actions should the administrator take to implement a 'Zero Trust' approach for Virtual Apps and Desktops? (Choose three.)

Question 13hardmultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is configuring a Citrix Gateway to support SmartAccess. The administrator needs to ensure that users connecting from a non-company managed device have the 'Print' function disabled in their session. Where should this policy be configured?

Question 14mediummulti select

Read the full Advanced Security and Access Control explanation →

Which TWO of the following methods are effective for securing the communication between the VDA and the Delivery Controller? (Choose two.)

Question 15mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator must prevent users from using the 'Save As' function within a virtual application to copy data to a local USB drive. Which Citrix policy should be modified to achieve this requirement?

Question 16mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An organization wants to log all user access activities for auditing purposes. Which Citrix feature provides detailed visibility into the specific resources accessed and the time of access?

Question 17hardmultiple choice

Read the full Advanced Security and Access Control explanation →

Which mechanism ensures that only authorized users can access specific published applications based on their current Active Directory group membership?

Question 18mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is tasked with ensuring that all internal traffic to the Delivery Controller is encrypted. Which protocol should be enabled on the Delivery Controller to enforce this?

Question 19hardmulti select

Read the full Advanced Security and Access Control explanation →

A security audit requires that all virtual desktop sessions are encrypted using TLS, and that internal traffic between VDAs and StoreFront servers remains secure. Which TWO steps must the administrator perform to harden the environment?

Question 20mediummultiple choice

Read the full Advanced Security and Access Control explanation →

Refer to the exhibit. An administrator is configuring a Citrix Gateway for remote access. After applying the configuration shown, remote users report they cannot launch applications, though authentication succeeds. What is the most likely cause of this issue?

Exhibit

add vpn vserver VIP_GATEWAY -httpProfile ns_http_profile_secure
set vpn vserver VIP_GATEWAY -icaProxy ON -authType CERT
set vpn vserver VIP_GATEWAY -dtls ON

Question 21hardmultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is configuring SmartAccess on Citrix Gateway to control clipboard redirection for ICA sessions. The requirement is that users connecting from managed endpoints evaluated as compliant by Citrix Endpoint Management may copy and paste between local and remote sessions, while all other users must not. The administrator has already configured the Gateway session policy to include the EPA scan result as a session variable and set up the Delivery Controller to trust the Gateway. Which action must the administrator take to enforce the clipboard restriction based on the EPA result?

Question 22mediummultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix administrator is deploying a new Citrix Gateway in a Citrix Virtual Apps and Desktops 7 environment. The security team requires that all user sessions to published applications be encrypted end-to-end using TLS 1.2, and that the gateway not perform any SSL decryption. Which Citrix Gateway configuration should the administrator implement to meet these requirements?

Question 23hardmultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator needs to ensure that all HDX traffic between a VDA and a user device is encrypted with FIPS 140-2 validated cryptography. The administrator has already configured the VDA to use FIPS mode. Which additional step must be taken on the Delivery Controller to enforce FIPS compliance for HDX sessions?

Question 24hardmulti select

Read the full Advanced Security and Access Control explanation →

A Citrix administrator is implementing SmartAccess policies on Citrix Gateway to control access to published applications based on endpoint posture. The security team wants to ensure that users connecting from domain-joined corporate laptops can access all applications, while users connecting from personal devices can only access a limited set. The administrator plans to use Citrix ADC policies and session policies. Which two actions must the administrator take to achieve this? (Choose two.)

Question 25mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is configuring App Protection policies in a Citrix Virtual Apps and Desktops 7 environment. The security team requires that users cannot copy data from published applications to their local clipboard, but they must be able to copy within the published application. Which setting should the administrator configure?

Question 26hardmultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator has configured Smart Access in Citrix Gateway to evaluate endpoint posture. Users connecting from domain-joined corporate laptops should have full access to all published resources, while users connecting from personal devices should only access a limited set of applications. The administrator has created two Delivery Groups: 'FullAccess' and 'LimitedAccess'. Which Citrix policy filter should be used to assign the appropriate Delivery Group based on the endpoint posture?

Question 27hardmultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix administrator is configuring a Citrix Gateway to use SmartAccess with Citrix ADC policies. The requirement is that only users who authenticate with a certificate AND whose device posture check returns a compliant result may access a published application. The administrator has already configured certificate authentication and a posture check policy. Which Citrix Gateway policy expression should be used to combine these conditions so that both must be satisfied?

Question 28mediummulti select

Study the full AAA explanation →

An administrator is configuring a Citrix Gateway to provide secure remote access. The security team requires that all user sessions are encrypted with TLS 1.2 or higher and that users authenticate using multi-factor authentication (MFA). The administrator plans to use RADIUS for MFA. Which TWO actions must the administrator take to meet these requirements? (Choose two.)

Question 29mediummultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator is configuring SmartAccess for a Citrix Gateway. The environment uses a single StoreFront store accessed by both internal and external users. The administrator needs to ensure that only external users receive the 'High' session reliability setting, while internal users receive 'Medium'. The administrator has already created two Citrix policies: 'External_SessionReliability' and 'Internal_SessionReliability'. Both policies are assigned to the same Delivery Controller. What should the administrator do to ensure the correct policy is applied based on the user's connection type?

Question 30hardmulti select

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator is implementing SmartAccess to control access to published applications based on the endpoint analysis results from Citrix Gateway. The administrator wants to ensure that only domain-joined machines with an up-to-date antivirus signature can launch the applications. Which two actions must the administrator take to achieve this? (Choose two.)

Question 31hardmultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is configuring Citrix Gateway to use SmartAccess with Endpoint Analysis (EPA) scans. Users connecting from corporate-owned domain-joined laptops must be allowed full access, while users from personal devices must be restricted to published applications only. The administrator has created two session policies: one with full access and one with restricted access, and two EPA scans: one that checks for domain membership and one that checks for antivirus. Which configuration should the administrator implement to meet these requirements?

Question 32mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is configuring Citrix Application Delivery Management (ADM) to monitor and manage Citrix Gateway instances. The security team requires that all communication between Citrix ADM and the managed Citrix Gateway instances is encrypted and authenticated. Which action should the administrator take to meet this requirement?

Question 33hardmultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is deploying Citrix Gateway with SmartAccess to enforce endpoint policies. The requirement is that users connecting from corporate-owned laptops with domain-joined machines receive full access, while users connecting from personal devices receive restricted access to only a specific published application. The administrator has configured Citrix ADC session policies and endpoint analysis scan policies. Which Citrix ADC policy expression type should be used in the SmartAccess policy to evaluate the results of the endpoint analysis scan?

Question 34mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is configuring a Citrix Gateway to use SmartAccess to restrict access to a specific published application based on whether the user's device is managed by Microsoft Intune. The administrator has already configured the EPA scan on the Gateway to check for Intune enrollment and has verified that the scan returns the correct result. However, all users are still able to access the application regardless of their device's enrollment status. What is the most likely cause?

Question 35hardmulti select

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator is implementing Adaptive Authentication for Citrix Gateway. The administrator wants to trigger an additional authentication prompt (OTP) only when the user's device posture indicates a missing antivirus or an unpatched OS. The environment uses Citrix Gateway 13.0 and Citrix ADC. Which two actions must the administrator take to achieve this? (Choose two.)

Question 36mediummultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator is configuring a Citrix Gateway in a Citrix Virtual Apps and Desktops 7 environment. The security team requires that when users log on to the Gateway, the system must perform a posture check to ensure the endpoint has an up-to-date antivirus signature. If the endpoint fails the check, the user must be placed in a quarantine group that only allows access to a remediation webpage. Which Citrix Gateway policy expression should the administrator use to evaluate the endpoint's antivirus status?

Question 37hardmulti select

Read the full Advanced Security and Access Control explanation →

An administrator is implementing App Protection policies in Citrix Virtual Apps and Desktops 7 to prevent keylogging and screen capturing on user devices. The environment includes Windows and Mac clients. Which TWO components must be present to enable App Protection? (Choose two.)

Question 38hardmultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is implementing Citrix App Protection policies to prevent keylogging and screen capturing of sensitive applications. The administrator has enabled the 'Anti-Keylogging' and 'Anti-ScreenCapture' settings in a Citrix policy and applied it to a Delivery Group. However, users report that they can still capture screenshots using the Snipping Tool on their Windows endpoints. What is the most likely cause of this issue?

Question 39easymultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator needs to ensure that all connections to a published application are encrypted using TLS 1.2 or higher. The environment uses Citrix Virtual Apps and Desktops 7 1912 LTSR with VDAs running on Windows Server 2019. The administrator has already configured the Delivery Controllers to require TLS 1.2. Which additional step must the administrator take to enforce TLS for ICA traffic?

Question 40easymultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator needs to ensure that all connections to a published desktop are encrypted with TLS 1.2 or higher. The environment uses Citrix Virtual Apps and Desktops 7 with StoreFront and Delivery Controllers. Which Citrix policy setting should the administrator configure?

Question 41mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is implementing Azure AD as the Identity Provider (IdP) for a Citrix environment. Users successfully authenticate via the NetScaler Gateway but are prompted for credentials again when launching their published desktops. Which component must be configured to ensure seamless single sign-on to the VDA in this scenario?

Question 42mediummultiple choice

Read the full Advanced Security and Access Control explanation →

A company requires that help desk staff be able to view session information and reset sessions but must not be able to modify machine catalogs or delivery groups. Which built-in administrative role should be assigned to the help desk group?

Question 43hardmultiple choice

Read the full Advanced Security and Access Control explanation →

When using Citrix Gateway with 'Clientless Access' for certain web applications, an administrator notices that some advanced security features of the web apps are breaking. What is the most likely cause of this issue?

Question 44mediummultiple choice

Read the full Advanced Security and Access Control explanation →

A company wants to implement Adaptive Authentication to change the authentication requirements based on the user's location and device posture. Which Citrix component is primarily responsible for evaluating these factors and choosing the appropriate authentication flow?

Question 45mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator needs to ensure that internal users accessing Virtual Apps and Desktops via Citrix Gateway are authenticated using multi-factor authentication, while external users must use a client certificate. Which NetScaler feature should the administrator implement to satisfy these diverse authentication requirements?

Question 46mediummultiple choice

Read the full Advanced Security and Access Control explanation →

A security auditor requires that all users connecting to the internal Citrix environment via NetScaler must have their device disk encrypted. Which feature should the administrator configure to enforce this requirement before the user's session is established?

Question 47easymultiple choice

Read the full Advanced Security and Access Control explanation →

Which component is primarily responsible for performing the initial authentication of a remote user before allowing access to internal Citrix resources?

Question 48hardmultiple choice

Read the full Advanced Security and Access Control explanation →

Refer to the exhibit. An administrator is seeing this error in the NetScaler logs. What is the most appropriate action to resolve this connectivity issue?

Exhibit

log_entry: [ERROR] SSL Handshake failure from 192.168.10.5. Cipher Suite TLS_RSA_WITH_AES_128_CBC_SHA is not supported by the client.

Question 49easymultiple choice

Read the full Advanced Security and Access Control explanation →

Which security best practice should be implemented to protect the Citrix Gateway against brute-force password guessing attacks?

Question 50hardmulti select

Read the full Advanced Security and Access Control explanation →

Which THREE configurations contribute to a 'Hardened' VDA environment? (Choose three.)

Question 51mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator needs to implement granular control over clipboard redirection based on the user's connection point. Users accessing resources from the internal office network should have full clipboard access, while those connecting via Citrix Gateway from public locations must have clipboard redirection disabled. Which tool should the administrator configure to achieve this?

Question 52hardmultiple choice

Read the full Advanced Security and Access Control explanation →

A company requires that users accessing virtual desktops via Citrix Gateway must pass a multi-factor authentication (MFA) check. The administrator uses Citrix ADC as the SAML Service Provider. Which configuration step is mandatory to ensure the SAML assertion is correctly validated?

Question 53mediummultiple choice

Read the full Advanced Security and Access Control explanation →

Which feature should an administrator enable to protect against unauthorized users capturing the screen or recording keystrokes from a compromised endpoint while a user is working in a virtual session?

Question 54mediummultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator is configuring smart card authentication for internal users accessing published applications through Citrix Workspace app. The administrator wants to enforce the use of a specific cryptographic service provider (CSP) on the VDA for all smart card operations. Which Citrix policy setting should the administrator configure?

Question 55mediummulti select

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator is configuring a Citrix Gateway to provide secure remote access to published applications. The administrator wants to implement SmartAccess to control access based on endpoint analysis results. Which two components are required to enable SmartAccess with EPA? (Choose two.)

Question 56easymultiple choice

Study the full AAA explanation →

A Citrix Administrator is configuring a Citrix Gateway to authenticate users with RADIUS two-factor authentication. The administrator wants to ensure that users are prompted for their RADIUS credentials only after successful Active Directory authentication. Which authentication policy configuration should the administrator use?

Question 57mediummultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator is configuring a Citrix Gateway to provide access to published applications. The administrator wants to ensure that users can only access resources if their device has a specific registry key set. Which Citrix Gateway feature should the administrator use?

Question 58easymultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is configuring Citrix Gateway to use Adaptive Authentication. The security team wants to require multi-factor authentication (MFA) only when users connect from outside the corporate network. Which Citrix ADC policy expression should the administrator use to trigger MFA based on the user's location?

Question 59mediummultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix administrator needs to enforce a policy that prevents users from accessing local drives and printers on their endpoint devices when they connect to published applications through Citrix Gateway. The policy must apply only to remote users and not to internal users. Which Citrix policy setting and filter should the administrator configure?

Question 60mediummultiple choice

Study the full AAA explanation →

A Citrix Administrator must configure a Citrix Gateway so that when users authenticate, they are required to provide their domain credentials plus a one-time passcode generated by a RADIUS server. The administrator has already configured the RADIUS server as an authentication policy and bound it to the Gateway. However, after testing, users are prompted for credentials twice but are never asked for a passcode. What should the administrator do to resolve this?

Question 61easymultiple choice

Study the full AAA explanation →

A Citrix administrator is setting up a new StoreFront store for external users. The security team requires that users authenticate using their Active Directory credentials, and that the authentication process is protected with multi-factor authentication (MFA). The company uses Citrix Gateway with RADIUS for MFA. Which authentication method should the administrator configure on Citrix Gateway to meet these requirements?

Question 62hardmultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator is configuring a Citrix Gateway to use Smart Card authentication for external users. The environment uses a two-factor authentication requirement: smart card and Active Directory password. The administrator has configured the Gateway virtual server with a Smart Card authentication policy and an LDAP authentication policy. Users report that they are only prompted for the smart card and not for the LDAP password. What should the administrator do to enforce the two-factor authentication?

Question 63mediummultiple choice

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator is configuring a Citrix Gateway to provide access to published applications. The security team requires that all user connections use smart card authentication with certificate validation. The administrator has configured the gateway with a server certificate and enabled smart card authentication. Users report that they are prompted for a PIN but then receive an error stating 'Cannot complete your request.' Which Citrix ADC setting should the administrator verify to ensure that the client certificate is being validated correctly?

Question 64hardmultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is implementing SmartAccess policies in a Citrix Virtual Apps and Desktops 7 environment with Citrix Gateway. The requirement is to allow users to access a published application only if they connect through Citrix Gateway and their endpoint has a specific registry key set. The administrator has configured the Gateway and StoreFront. Which Delivery Controller policy filter should be used to enforce this condition?

Question 65easymultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is configuring Citrix StoreFront to use HTTPS for all communications. The security team requires that the StoreFront server uses a certificate that is trusted by all user devices. The administrator has obtained a certificate from a public CA and installed it on the StoreFront server. Which StoreFront configuration must be updated to bind the certificate to the IIS website?

Question 66hardmultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator is configuring Citrix Gateway to use SAML authentication with Microsoft Azure AD as the identity provider. The requirement is that users must authenticate using Azure AD and then be authorized to access specific published applications based on their group membership in Azure AD. The administrator has configured the SAML action and policy on Citrix ADC and imported the Azure AD certificate. Which Citrix ADC feature should be configured to extract the group membership from the SAML assertion and use it for authorization?

Question 67hardmulti select

Read the full Advanced Security and Access Control explanation →

A Citrix Administrator is configuring App Protection policies in a Citrix Virtual Apps and Desktops 7 environment to prevent keylogging and screen capturing on user devices. The administrator wants to ensure that the protection is applied to both the VDA and the user device. Which two components must be installed or configured to enable App Protection? (Choose two.)

Question 68mediummultiple choice

Read the full Advanced Security and Access Control explanation →

An administrator needs to configure a Citrix Gateway to use Smart Card authentication for users connecting from outside the network. The environment uses Citrix Virtual Apps and Desktops 7 with StoreFront. The administrator has installed the Smart Card certificate on the Gateway and configured the LDAP authentication policy. What additional step must be taken on the Gateway to enable Smart Card authentication?