1Y0-312 Advanced Security and Access Control Practice Question
An administrator is configuring Citrix Gateway to use Adaptive Authentication. The security team wants to require multi-factor authentication (MFA) only when users connect from outside the corporate network. Which Citrix ADC policy expression should the administrator use to trigger MFA based on the user's location?
⚠ Common exam trap
The trap here is forgetting to negate the subnet check; using the subnet expression without .NOT would apply MFA to internal users instead of external ones.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CLIENT.IP.SRC.IN_SUBNET(10.0.0.0/8).NOT
To trigger MFA only for external users, the policy must evaluate to true when the client IP is outside the corporate subnet. The expression CLIENT.IP.SRC.IN_SUBNET(10.0.0.0/8).NOT does exactly that by negating the subnet check. This allows the administrator to bind an MFA policy that applies only to external connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CLIENT.IP.SRC.IN_SUBNET(10.0.0.0/8)
Why it's wrong here
This expression checks if the client IP is within the 10.0.0.0/8 subnet, which represents the corporate network. If used to trigger MFA, it would require MFA for internal users, the opposite of the requirement. The administrator needs to trigger MFA for external users, so this expression would be used in a policy that bypasses MFA, not triggers it.
- ✓
CLIENT.IP.SRC.IN_SUBNET(10.0.0.0/8).NOT
Why this is correct
This expression evaluates to true when the client IP is not in the 10.0.0.0/8 subnet, meaning the user is external. This can be used in a policy to trigger MFA for external connections only. It directly meets the requirement of applying MFA based on location. Therefore, this is the correct expression.
- ✗
HTTP.REQ.HEADER("User-Agent").CONTAINS("Citrix")
Why it's wrong here
This expression checks if the User-Agent header contains 'Citrix', which might indicate a Citrix client but does not provide any information about the user's network location. It cannot be used to differentiate internal from external users. Thus, it does not satisfy the requirement to trigger MFA based on location.
- ✗
http.REQ.IS_VALID
Why it's wrong here
This expression checks if the HTTP request is valid, which is always true for legitimate requests. It does not evaluate the user's location or any condition related to network origin. Using this would not trigger MFA based on location. Therefore, it is incorrect for the scenario.
Visual reference
About these practice questions
One of 186 original 1Y0-312 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Citrix exam blueprint
This 1Y0-312 practice question is part of Courseiva's free Citrix certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 1Y0-312 exam.