1Y0-204 Secure Access Practice Question
A Citrix Administrator needs to ensure that users connecting to virtual desktops from outside the corporate network are required to perform multi-factor authentication. Which component should the administrator configure to achieve this requirement?
⚠ Common exam trap
Candidates often select Delivery Controllers or StoreFront for multi-factor authentication, forgetting that external access security and perimeter authentication are handled at the Citrix Gateway.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Citrix Gateway
To enforce multi-factor authentication for external users, the Citrix Gateway must be configured as the primary authentication point. By integrating the Gateway with an external RADIUS or SAML identity provider, administrators can require an additional authentication factor before the user session is established. This ensures that even if primary credentials are compromised, unauthorized access is prevented, fulfilling essential security compliance requirements for remote enterprise environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Citrix StoreFront
Why it's wrong here
StoreFront primarily manages resource enumeration and delivery. While it can participate in authentication, it does not natively handle the multi-factor protocols required for external traffic isolation as effectively as a dedicated Gateway appliance. Configuring MFA here is less secure than performing it at the network edge.
- ✓
Citrix Gateway
Why this is correct
Citrix Gateway serves as the secure SSL VPN and authentication proxy. By setting the Gateway as the primary authentication point, administrators can offload multi-factor validation to third-party providers like Azure MFA or RADIUS, ensuring that all external access attempts are scrutinized before reaching internal StoreFront or Delivery Controller resources.
- ✗
Delivery Controller
Why it's wrong here
The Delivery Controller is responsible for managing broker tasks and session state. It is not designed to perform user authentication directly or interact with multi-factor providers. Offloading authentication to the controller increases latency and exposes critical core management components unnecessarily to potential external traffic threats.
- ✗
Citrix Licensing Server
Why it's wrong here
The Licensing Server handles software entitlement and license management. It lacks any functionality related to user authentication or security policy enforcement for remote sessions. Attempting to route authentication traffic through this component is technically impossible and would break the license reporting mechanisms required for production operation.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
About these practice questions
Courseiva writes every 1Y0-204 question from scratch — 216 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Citrix exam blueprint
This 1Y0-204 practice question is part of Courseiva's free Citrix certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 1Y0-204 exam.