1Y0-312 Advanced Security and Access Control Practice Test 2 — 15 Questions

Question 1

An organization wants to log all user access activities for auditing purposes. Which Citrix feature provides detailed visibility into the specific resources accessed and the time of access?

Accepted Answer

Citrix Analytics for Security. Citrix Director provides comprehensive monitoring and auditing capabilities. It tracks session launches, application usage, and user connection history. By leveraging this data, administrators can generate reports for compliance audits, identifying exactly who accessed which resources and when. This is critical for forensic analysis and ensuring that organizational access policies are being followed accurately by all users within the virtual environment.

Answer

NetScaler Management and Analytics System (MAS)

Answer

Windows Event Viewer

Answer

Citrix Workspace app logs

Question 2

Which mechanism ensures that only authorized users can access specific published applications based on their current Active Directory group membership?

Accepted Answer

Citrix Studio Resource Assignment. Delivery Group and Application Group policies in Citrix Studio allow for granular control over resource assignment. By mapping specific Active Directory groups to these groups, administrators ensure that users only see and launch the applications they are authorized to access. This identity-based access control is the primary method for enforcing entitlement and security policies within the Citrix environment, ensuring compliance with the principle of least privilege.

Answer

NetScaler Authorization Policies

Answer

StoreFront Receiver for Web branding

Answer

Active Directory Group Policy Objects (GPOs)

Question 3

An administrator is tasked with ensuring that all internal traffic to the Delivery Controller is encrypted. Which protocol should be enabled on the Delivery Controller to enforce this?

Accepted Answer

HTTPS/443. Enabling HTTPS (TLS) on the Delivery Controller ensures that all management and registration traffic between VDAs and the Controller is encrypted. This prevents unauthorized sniffing of sensitive control plane data, such as registration tokens or configuration details. By mandating TLS, the administrator creates a secure management channel, adhering to modern security standards and protecting the infrastructure's integrity from internal network-based sniffing or tampering attempts.

Answer

HTTP/80

Answer

FTP/21

Answer

Telnet/23

Question 4

A security audit requires that all virtual desktop sessions are encrypted using TLS, and that internal traffic between VDAs and StoreFront servers remains secure. Which TWO steps must the administrator perform to harden the environment?

Accepted Answer

Install a valid server certificate on all VDA machines. Implementing TLS for Citrix communications requires a valid certificate deployment and proper binding on the servers. By configuring the VDA and StoreFront to enforce TLS, the administrator protects against man-in-the-middle attacks within the local data center. This ensures that sensitive metadata, session credentials, and user data remain encrypted in transit, aligning with industry security best practices and compliance requirements for protecting intellectual property.

Answer

Enable 'ICA Encryption' in Citrix Policies to 'Allow' and 'Basic'

Answer

Disable the Windows Firewall on all Delivery Controllers

Answer

Configure the Delivery Controller to use Kerberos Constrained Delegation

Question 5

Refer to the exhibit. An administrator is configuring a Citrix Gateway for remote access. After applying the configuration shown, remote users report they cannot launch applications, though authentication succeeds. What is the most likely cause of this issue?

Accepted Answer

DTLS is enabled, but the underlying authentication method is insufficient. The configuration shows that the authentication type is set to 'CERT' (Client Certificate authentication) only. If the users are not presenting a valid client-side certificate, the authentication will fail or be incomplete for the ICA proxy tunnel. The tunnel fails because the Gateway requires the certificate to validate the user identity before establishing the secure ICA session proxy, which is a common misconfiguration when hardening remote access endpoints.

Answer

The ICA proxy is disabled by default for certificate authentication

Answer

The HTTP profile is incorrectly assigned to the virtual server

Answer

The virtual server name is invalid

Question 6

An administrator is configuring SmartAccess on Citrix Gateway to control clipboard redirection for ICA sessions. The requirement is that users connecting from managed endpoints evaluated as compliant by Citrix Endpoint Management may copy and paste between local and remote sessions, while all other users must not. The administrator has already configured the Gateway session policy to include the EPA scan result as a session variable and set up the Delivery Controller to trust the Gateway. Which action must the administrator take to enforce the clipboard restriction based on the EPA result?

Accepted Answer

In Citrix Gateway, configure a SmartAccess profile that includes the EPA scan result as a session policy attribute, and then in Citrix Studio create a Citrix policy with the 'Client Clipboard Redirection' setting set to 'Allowed' and a SmartAccess filter that matches the compliant EPA result. Apply this policy to the Delivery Group.. SmartAccess leverages Citrix Gateway's EPA to evaluate endpoint posture and pass the result as a session variable to the Delivery Controller. In Citrix Studio, Citrix policies can be filtered using SmartAccess conditions that match these session variables. By creating a policy that allows clipboard redirection but only when the EPA result indicates compliance, the administrator ensures that only managed, compliant endpoints receive the capability, while all others are denied by default.

Answer

Configure a Delivery Controller policy to allow clipboard redirection, and then use a Citrix Gateway authorization policy to remove the clipboard redirection capability from non-compliant sessions by setting the session variable 'CLIPBOARD' to 'DISABLED'.

Answer

On the VDA, modify the registry key 'ClipboardRedirection' under HKLM\Software\Citrix\HDX\Modules to set the value to 0 for non-compliant sessions, and use a logon script triggered by the Gateway to apply the change based on the EPA scan result.

Answer

Create a Citrix policy in Studio with the 'Client Clipboard Redirection' setting set to 'Allowed' and apply it to the Delivery Group, then use a filter on the policy to restrict it to users whose session variable indicates compliance.

Question 7

A Citrix administrator is deploying a new Citrix Gateway in a Citrix Virtual Apps and Desktops 7 environment. The security team requires that all user sessions to published applications be encrypted end-to-end using TLS 1.2, and that the gateway not perform any SSL decryption. Which Citrix Gateway configuration should the administrator implement to meet these requirements?

Accepted Answer

Configure the gateway in ICA proxy mode with SSL pass-through enabled.. To achieve end-to-end TLS 1.2 encryption without gateway decryption, the Citrix Gateway must be configured for SSL pass-through in ICA proxy mode. This forwards the encrypted traffic to the VDA, which handles the TLS termination. Other options either terminate SSL at the gateway or use non-TLS encryption, failing the security requirement.

Answer

Configure the gateway in ICA proxy mode with SSL offloading disabled.

Answer

Configure the gateway in ICA proxy mode with SSL bridging enabled.

Answer

Configure the gateway in ICA proxy mode with Secure ICA enabled on the VDAs.

Question 8

A Citrix Administrator needs to ensure that all HDX traffic between a VDA and a user device is encrypted with FIPS 140-2 validated cryptography. The administrator has already configured the VDA to use FIPS mode. Which additional step must be taken on the Delivery Controller to enforce FIPS compliance for HDX sessions?

Accepted Answer

Set the 'Enable FIPS' policy on the Delivery Controller to 'Enabled'.. To enforce FIPS 140-2 validated cryptography for HDX sessions, the administrator must enable the 'Enable FIPS' policy on the Delivery Controller. This policy ensures that HDX traffic uses FIPS-compliant algorithms. Other options like adaptive transport or Secure ICA encryption strength do not guarantee FIPS validation. Installing a FIPS module is not a valid step. Thus, enabling the FIPS policy is the correct action.

Answer

Install the FIPS module on the Delivery Controller and restart the Citrix Broker Service.

Answer

Enable the 'HDX adaptive transport' policy and set it to 'Preferred'.

Answer

Configure the 'Secure ICA' policy to use 128-bit encryption.

Question 9

A Citrix administrator is implementing SmartAccess policies on Citrix Gateway to control access to published applications based on endpoint posture. The security team wants to ensure that users connecting from domain-joined corporate laptops can access all applications, while users connecting from personal devices can only access a limited set. The administrator plans to use Citrix ADC policies and session policies. Which two actions must the administrator take to achieve this? (Choose two.)

Accepted Answer

Create a session policy that applies a filter to restrict access to specific applications based on the EPA scan result.. SmartAccess uses EPA scans on Citrix Gateway to assess endpoint posture, and session policies to apply filters that control application access. The gateway performs the EPA scan and assigns session policies, which then pass filters to the Delivery Controller via StoreFront. Therefore, configuring the EPA scan and creating session policies with filters are the correct actions.

Answer

Configure StoreFront to perform the EPA scan and pass the results to the Delivery Controller.

Answer

Enable SmartAccess on the Delivery Controller by running the Set-BrokerAccessPolicyRule cmdlet.

Answer

Install the Citrix Workspace app with the EPA plugin on all user devices to enable endpoint scanning.

Question 10

An administrator is configuring App Protection policies in a Citrix Virtual Apps and Desktops 7 environment. The security team requires that users cannot copy data from published applications to their local clipboard, but they must be able to copy within the published application. Which setting should the administrator configure?

Accepted Answer

Configure the 'Restrict Client Clipboard Redirection' policy to 'Prohibited'.. To block copying from published applications to the local endpoint while allowing internal clipboard use, the administrator should set the 'Restrict Client Clipboard Redirection' policy to Prohibited. This policy specifically controls outbound clipboard redirection, leaving internal clipboard functionality intact.

Answer

Configure the 'Read-Only' clipboard redirection policy.

Answer

Enable the 'Clipboard Redirection' policy and set it to 'Prohibited'.

Answer

Enable the 'Client Clipboard Redirection' policy and set it to 'Allowed'.

Question 11

An administrator has configured Smart Access in Citrix Gateway to evaluate endpoint posture. Users connecting from domain-joined corporate laptops should have full access to all published resources, while users connecting from personal devices should only access a limited set of applications. The administrator has created two Delivery Groups: 'FullAccess' and 'LimitedAccess'. Which Citrix policy filter should be used to assign the appropriate Delivery Group based on the endpoint posture?

Accepted Answer

Use a filter based on the 'Smart Access' tag applied by Citrix Gateway after endpoint analysis.. The correct approach is to use Smart Access tags, which are generated by Citrix Gateway after performing endpoint analysis. These tags can be referenced in Citrix policy filters to assign Delivery Groups based on device posture. This ensures that corporate laptops receive full access while personal devices are restricted to limited applications. Other filters like IP address, connection type, or user group do not evaluate endpoint characteristics and therefore cannot meet the requirement.

Answer

Use a filter based on the 'Access Gateway' connection type to differentiate between internal and external users.

Answer

Use a filter based on the 'Client IP Address' to differentiate between corporate and personal devices.

Answer

Use a filter based on the 'User or Group' membership to assign Delivery Groups based on Active Directory groups.

Question 12

A Citrix administrator is configuring a Citrix Gateway to use SmartAccess with Citrix ADC policies. The requirement is that only users who authenticate with a certificate AND whose device posture check returns a compliant result may access a published application. The administrator has already configured certificate authentication and a posture check policy. Which Citrix Gateway policy expression should be used to combine these conditions so that both must be satisfied?

Accepted Answer

http.REQ.USER.CERTIFICATE.SUBJECT.NE("") && http.REQ.USER.ATTRIBUTE(1).EQ("true"). SmartAccess policies on Citrix Gateway can combine multiple conditions using Citrix ADC policy expressions. Certificate authentication populates user attributes, and EPA posture results can be mapped to user attributes via session policies. The expression that checks for a certificate subject and a specific user attribute value of 'true' correctly enforces both authentication and posture compliance, assuming the attribute is set by the EPA scan configuration.

Answer

http.REQ.USER.CERTIFICATE.SUBJECT.NE("") && SYS.CLIENT.POSTURE.RESULT.EQ("compliant")

Answer

http.REQ.USER.CERTIFICATE.SUBJECT.NE("") && HTTP.REQ.USER.ATTRIBUTE(1).CONTAINS("compliant")

Answer

http.REQ.USER.CERTIFICATE.SUBJECT.NE("") && http.REQ.USER.ATTRIBUTE(1).EQ("compliant")

Question 13

An administrator is configuring a Citrix Gateway to provide secure remote access. The security team requires that all user sessions are encrypted with TLS 1.2 or higher and that users authenticate using multi-factor authentication (MFA). The administrator plans to use RADIUS for MFA. Which TWO actions must the administrator take to meet these requirements? (Choose two.)

Accepted Answer

Configure the Citrix Gateway vServer to use TLS 1.2 as the minimum protocol version and disable older protocols.. To meet the encryption requirement, the administrator must configure the Citrix Gateway vServer to use TLS 1.2 as the minimum and disable older protocols. For MFA, configuring LDAP as primary and RADIUS as secondary authentication enforces two-factor authentication. These two actions together satisfy the security team's requirements. The other options either do not enforce MFA properly or introduce unnecessary changes that could affect compatibility.

Answer

Configure a RADIUS authentication policy and bind it to the Citrix Gateway vServer as the primary authentication method.

Answer

Configure the Citrix Gateway vServer to use TLS 1.3 and disable TLS 1.2 to ensure the latest encryption standards.

Answer

Enable 'Client Certificate' authentication and bind it to the Citrix Gateway vServer to enforce certificate-based authentication.

Question 14

A Citrix Administrator is configuring SmartAccess for a Citrix Gateway. The environment uses a single StoreFront store accessed by both internal and external users. The administrator needs to ensure that only external users receive the 'High' session reliability setting, while internal users receive 'Medium'. The administrator has already created two Citrix policies: 'External_SessionReliability' and 'Internal_SessionReliability'. Both policies are assigned to the same Delivery Controller. What should the administrator do to ensure the correct policy is applied based on the user's connection type?

Accepted Answer

Use the 'Citrix Gateway' policy filter condition and set it to 'Gateway' for the external policy, and use the same condition set to 'Non-Gateway' for the internal policy.. The 'Citrix Gateway' policy filter condition is specifically designed to identify whether a session is established through a Citrix Gateway. By applying this filter to the external policy with the value 'Gateway' and to the internal policy with 'Non-Gateway', the administrator ensures that each policy is applied only to the appropriate sessions. This approach uses built-in filtering capabilities and does not require complex scripting.

Answer

Configure a policy filter for each policy using the 'Access Control' condition and set the filter to 'Gateway' for external and 'Direct' for internal.

Answer

Configure the 'User Location' policy filter and set it to 'Remote' for external users and 'Local' for internal users.

Answer

Assign the 'External_SessionReliability' policy to the Gateway virtual server and the 'Internal_SessionReliability' policy to the StoreFront server.

Question 15

A Citrix Administrator is implementing SmartAccess to control access to published applications based on the endpoint analysis results from Citrix Gateway. The administrator wants to ensure that only domain-joined machines with an up-to-date antivirus signature can launch the applications. Which two actions must the administrator take to achieve this? (Choose two.)

Accepted Answer

Configure a Citrix Gateway session policy that applies the EPA scan and assigns the appropriate session profile.. SmartAccess requires two main components: the Citrix Gateway session policy that performs the EPA scan and assigns a session profile, and the Delivery Controller policy that uses the resulting SmartAccess tags to filter resources. The session policy collects endpoint information and passes it as tags, while the Delivery Controller enforces access based on those tags.

Answer

Enable 'SmartAccess' on the StoreFront server by adding the EPA scan results to the StoreFront web.config file.

Answer

Configure the Citrix Gateway EPA scan to check for domain membership and antivirus signature, and bind it to the authentication policy.

Answer

Install the Citrix Workspace app with the SmartAccess plug-in on all user devices.