I85PREP
⌘ K
Citrix CCA-AppDS study materials
Citrix CCA-AppDS study resources

Citrix CCA-AppDS practice questions

One question at a time. Build your Citrix CCA-AppDS understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1NetScaler Gateway, authentication factors and resource access

Which NetScaler authentication protocol is BEST suited for federating user identity from an external Identity Provider (such as Okta or Azure AD) to NetScaler-fronted applications?

  1. LDAP
  2. RADIUS
  3. SAML 2.0 Correct answer.
  4. TACACS+

Explanation

SAML 2.0 is the industry-standard federation protocol. NetScaler can act as a SAML Service Provider (SP) so that an external IdP (Okta, Azure AD, ADFS) authenticates the user and posts a signed assertion back to NetScaler.

Question 2NetScaler Gateway, authentication factors and resource access

When NetScaler is configured as a SAML Service Provider, which value MUST match between the NetScaler SAML action and the Identity Provider configuration for the assertion to be accepted?

  1. The IdP signing certificate (and matching IdP entity ID/Issuer) Correct answer.
  2. The local user database password hash
  3. The NSIP of the NetScaler
  4. The SNIP of the LB vServer

Explanation

NetScaler validates the SAML assertion using the IdP signing certificate stored in the SAML action, and the Issuer (Entity ID) in the assertion must match what NetScaler expects. Mismatched cert or Issuer causes the assertion to be rejected.

Question 3NetScaler Gateway, authentication factors and resource access

Which NetScaler feature allows multiple authentication factors (for example, LDAP password followed by RADIUS one-time-passcode) to be chained together with conditional logic?

  1. Cascaded classic authentication policies
  2. nFactor (Multi-Factor) authentication Correct answer.
  3. AAA-TM session policy
  4. Smart Group binding

Explanation

nFactor authentication is the modern NetScaler framework that uses Login Schemas, Authentication Policy Labels (the next factor), and policy decisions to chain factors with conditional logic - LDAP first, then RADIUS OTP, with branching by group, etc.

Question 4NetScaler Gateway, authentication factors and resource access

Which two NetScaler entities are REQUIRED to deploy nFactor authentication on an authentication virtual server? (Choose the option that lists BOTH.)

  1. Login Schema and Authentication Policy Label Correct answer.
  2. Responder action and Rewrite policy
  3. Session profile and Traffic profile
  4. AAA group and Application profile

Explanation

nFactor relies on (1) Login Schemas (which describe the form fields presented to the user at each factor) and (2) Authentication Policy Labels (which represent the next factor and chain conditional policies together).

Question 5NetScaler Gateway, authentication factors and resource access

A Citrix Administrator wants to extract Active Directory group membership for use in NetScaler authorization policies. Which LDAP authentication action setting controls this?

  1. Server Logon Name Attribute
  2. Group Attribute (typically memberOf) and Sub Attribute Name (cn) Correct answer.
  3. Search Filter only
  4. Authentication Type ANONYMOUS

Explanation

After bind, NetScaler reads the user's LDAP attribute named in 'Group Attribute' (default memberOf in AD) and parses out the group name from the 'Sub Attribute Name' (default cn). These groups feed AAA group-based authorization and SmartAccess.

Question 6NetScaler Gateway, authentication factors and resource access

What is the primary purpose of an authorization policy on the NetScaler authentication virtual server (AAA-TM)?

  1. Decide which users can authenticate against the LDAP server
  2. Permit or deny a specific user/group access to a back-end URL/destination AFTER authentication Correct answer.
  3. Control which TLS ciphers the SSL vServer offers
  4. Determine which SNIP is used to talk to the back-end

Explanation

After successful authentication, AAA-TM authorization policies (allow/deny) decide whether the authenticated user (or their AD group) is permitted to reach a specific URL pattern, host, or destination on the back-end.

Question 7NetScaler Gateway, authentication factors and resource access

Which NetScaler feature lets the appliance perform Single Sign-On to a back-end web application by replaying the user's credentials in a form POST after AAA-TM authentication?

  1. Form-based SSO in a Traffic profile Correct answer.
  2. Responder DROP action
  3. Rewrite header insert only
  4. Net Profile binding

Explanation

A Traffic profile with SSO Method FORMSSO (and a defined SSO Action describing the action URL, user/password field names, etc.) bound through a Traffic policy lets NetScaler post the user's credentials to a form-based back-end app on first request.

Question 8NetScaler Gateway, authentication factors and resource access

An organization wants to enforce 2-factor authentication for Citrix Gateway logon: AD password as the first factor and a RADIUS one-time passcode as the second factor, BOTH on the same logon page (dual fields). Which NetScaler feature is required?

  1. Two cascaded classic policies
  2. nFactor with a Dual Authentication Login Schema (LoginSchema/DualAuth.xml or similar) Correct answer.
  3. Smart Card authentication only
  4. OAuth Idp action

Explanation

A dual-prompt login page is implemented with nFactor and a dual-auth Login Schema (Citrix ships built-in LoginSchema XML files such as DualAuth, DualAuthOrSAML, etc.) that displays both fields and evaluates them against LDAP and RADIUS in one factor.

Question 9NetScaler Gateway, authentication factors and resource access

Which authentication virtual server type is created on NetScaler to centralize authentication for AAA-TM and Citrix Gateway use cases via nFactor?

  1. LB virtual server with type AAA
  2. Authentication virtual server (add authentication vserver) Correct answer.
  3. GSLB virtual server
  4. Cache redirection virtual server

Explanation

An Authentication virtual server ('add authentication vserver <name> SSL <IP> 443') hosts the nFactor flow. Other vServers (LB, Gateway) reference it through 'authnVsName' to delegate authentication.

Question 10NetScaler Gateway, authentication factors and resource access

Which authentication protocol is defined for use of an OTP delivered through email or SMS without requiring a separate RADIUS server, leveraging native NetScaler capabilities?

  1. Native OTP (TOTP) push using Google Authenticator on NetScaler Correct answer.
  2. Kerberos pass-through
  3. TACACS+ accounting only
  4. Web Authentication only

Explanation

Native OTP (sometimes called Native OTP or push OTP) lets NetScaler register and validate TOTP secrets natively (compatible with Google Authenticator-style apps), without an external RADIUS OTP server.

Question 11NetScaler Gateway, authentication factors and resource access

An administrator must allow only members of the AD group 'NS-Admins' to access NetScaler-fronted applications matching /admin/*. After authentication succeeds, which NetScaler construct evaluates this rule?

  1. An authorization policy bound to the AAA user/group with rule HTTP.REQ.URL.STARTSWITH("/admin") Correct answer.
  2. A rewrite policy that strips the /admin path
  3. A Net Profile that sets the SNIP
  4. An SSL policy that drops handshake

Explanation

Authorization policies (rule HTTP.REQ.URL.STARTSWITH("/admin"), action ALLOW) bound to the AAA group 'NS-Admins' (and corresponding DENY policies bound at higher precedence to other groups) enforce the URL-level access requirement after authentication.

Question 12NetScaler Gateway, authentication factors and resource access

Which NetScaler authentication action is REQUIRED for OAuth/OpenID Connect (OIDC) integrations where NetScaler acts as the relying party?

  1. add authentication oauthAction Correct answer.
  2. add authentication ldapAction
  3. add authentication radiusAction
  4. add authentication tacacsAction

Explanation

When NetScaler is an OAuth/OIDC client (relying party) - for example, integrating with Azure AD or Okta as the IdP - the administrator creates an 'add authentication oauthAction' that points to the IdP's discovery endpoint, client ID, secret, and scope.

Question 13NetScaler Gateway, authentication factors and resource access

Which CLI command creates an LDAP authentication action named ldap_corp pointing at AD server 10.5.5.10 with the standard memberOf group attribute?

  1. add authentication ldapAction ldap_corp -serverIP 10.5.5.10 -ldapBase "DC=corp,DC=com" -ldapBindDn "[email protected]" -ldapLoginName sAMAccountName -groupAttrName memberOf -subAttributeName cn Correct answer.
  2. add aaa server ldap_corp -ip 10.5.5.10 -base DC=corp,DC=com
  3. add aaa policy ldap_corp -type LDAP -server 10.5.5.10
  4. set authentication ldap ldap_corp host 10.5.5.10

Explanation

The correct NetScaler CLI form for an LDAP authentication action specifies serverIP, ldapBase, bind DN, login attribute (sAMAccountName for AD), and group extraction parameters (memberOf and cn). It is then referenced by an authentication ldapPolicy.

Question 14NetScaler Gateway, authentication factors and resource access

A Citrix Administrator wants to require RADIUS-based MFA only for users coming from outside the corporate network, while internal users skip the RADIUS factor. Which approach should be used?

  1. Bind RADIUS as the only authentication policy with no priority logic
  2. Use nFactor with a first-factor policy whose rule checks CLIENT.IP.SRC.IN_SUBNET(corporate-subnet) and branches to a no-RADIUS Authentication Policy Label internally, otherwise to a RADIUS factor Correct answer.
  3. Use a Responder policy that drops RADIUS prompts internally
  4. Disable RADIUS on the authentication vServer

Explanation

Using nFactor, the first factor's policy rule (e.g., CLIENT.IP.SRC.IN_SUBNET(10.0.0.0/8)) decides via 'goto' to either a no-MFA Authentication Policy Label for internal users or a Login Schema/Authentication Policy Label that prompts for the RADIUS OTP for external users.

Question 15NetScaler traffic objects, expressions and controlled routing

Which Citrix Gateway component is installed on a Windows or Mac endpoint to provide a full layer-3 SSL VPN tunnel to corporate networks?

  1. EPA scan plug-in only
  2. Citrix Gateway plug-in (formerly NetScaler Gateway plug-in) Correct answer.
  3. Citrix Workspace app HDX engine
  4. Citrix Provisioning Services target driver

Explanation

The Citrix Gateway plug-in is the SSL VPN client that establishes a full L3 tunnel from the endpoint to the corporate network through a Citrix Gateway vServer in SSL VPN mode.

Question 16NetScaler traffic objects, expressions and controlled routing

Which NetScaler Citrix Gateway feature, when enabled, automatically re-establishes the VPN tunnel as soon as the user's device has network connectivity (for example, after sleep/wake or network change)?

  1. Always-On VPN Correct answer.
  2. ICA Proxy heartbeat
  3. Session reliability (CGP)
  4. EPA continuous scan

Explanation

Always-On (configured in the Gateway plug-in client config + AlwaysOn setting in the session profile) keeps the SSL VPN tunnel re-established automatically without user intervention, even after sleep/wake or NIC changes.

Question 17NetScaler traffic objects, expressions and controlled routing

A Citrix Administrator wants to allow only access to internal subnet 10.50.0.0/16 over the Citrix Gateway VPN tunnel; all other traffic should go directly out the user's internet connection. Which session profile setting controls this?

  1. Split Tunnel = ON, with an Intranet Application defining 10.50.0.0/16 Correct answer.
  2. Split Tunnel = OFF
  3. Transparent Interception = ON
  4. ICA Proxy = ON

Explanation

With Split Tunnel = ON, the Gateway plug-in only routes traffic that matches the configured Intranet Applications (10.50.0.0/16) through the tunnel; all other traffic uses the user's local internet path.

Question 18NetScaler traffic objects, expressions and controlled routing

Which NetScaler Citrix Gateway feature lets administrators specify EPA scan checks that BLOCK the user from logging in if the endpoint fails (for example, missing antivirus)?

  1. Pre-Authentication policy and profile (with EPA expression) Correct answer.
  2. Post-Authentication policy only
  3. Authorization policy
  4. Session policy in ICA Proxy mode

Explanation

Pre-Authentication policies on the Citrix Gateway vServer run EPA scans before logon. If the EPA expression evaluates as failed, the policy denies the logon, blocking non-compliant endpoints from authenticating.

Question 19NetScaler traffic objects, expressions and controlled routing

Which Citrix Workspace app/Receiver protocol uses port 1494 (and 2598 with Session Reliability) to deliver published apps and desktops through Citrix Gateway?

  1. RDP
  2. ICA/HDX (with CGP for session reliability) Correct answer.
  3. PCoIP
  4. Spice

Explanation

Citrix Virtual Apps and Desktops use the ICA/HDX protocol on TCP/UDP 1494, and Common Gateway Protocol (CGP) on 2598 when Session Reliability is enabled. Through Citrix Gateway in ICA Proxy mode this is encapsulated in HTTPS/443 to the client.

Question 20NetScaler traffic objects, expressions and controlled routing

Which Citrix Gateway feature lets the administrator hide or restrict ICA channel features (clipboard, drives, printers, USB) for sessions launched THROUGH the Gateway, regardless of policy at the VDA?

  1. SmartControl Correct answer.
  2. SmartAccess
  3. EPA continuous scan
  4. Traffic profile SSO

Explanation

SmartControl (configured via ICA policies on Citrix Gateway) lets the Gateway override what HDX channels are allowed (drives, USB, clipboard, printer redirection, etc.) at the gateway layer, useful when the VDA admin and the Gateway admin are different teams.

Question 21NetScaler traffic objects, expressions and controlled routing

Which Citrix Gateway feature passes user/session attributes (such as 'Workspace launched from a managed device') from the Gateway to the Delivery Controller so that CVAD policies can apply different settings?

  1. SmartAccess Correct answer.
  2. SmartControl
  3. Always-On
  4. EPA

Explanation

SmartAccess uses Citrix Gateway session policies (and Endpoint Analysis results) to set Filter strings on the Delivery Controller. CVAD admins then create policies that filter by access type, so e.g., users on a non-managed device see published apps with restricted access.

Question 22NetScaler traffic objects, expressions and controlled routing

A Citrix Administrator wants users connecting to Citrix Gateway to have access only to a specific list of intranet IP ranges via the VPN tunnel. Which session-profile entity is used?

  1. Intranet Application bound at the user/group/AAA level Correct answer.
  2. Authorization policy with rule HTTP.REQ.URL
  3. Pattern set bound to the LB vServer
  4. Net Profile

Explanation

Intranet Applications define IP/protocol/port ranges that should be reachable through the Gateway VPN tunnel. They are bound to AAA users/groups or globally and integrate with Split Tunnel ON to direct only matching traffic through the tunnel.

Question 23NetScaler traffic objects, expressions and controlled routing

A Citrix Administrator wants users to log in once at Citrix Gateway and be SSO'd to multiple back-end web applications. Which Gateway session profile setting must be enabled on the SSO Domain?

  1. Single Sign-On to Web Applications = ON, with the domain set to the AD domain Correct answer.
  2. Disable Authentication on the LB vServer
  3. Set ICA Proxy = ON globally
  4. Enable EPA continuous scan

Explanation

On the Gateway session profile, enabling 'Single Sign-on to Web Applications' (and setting the SSO domain to the AD domain) lets the Gateway present cached credentials to back-end web apps using NTLM/Kerberos/Form-based SSO when the user clicks a bookmark.

Question 24NetScaler traffic objects, expressions and controlled routing

In the supplied default source-translation, directly connected two-arm NetScaler example, the client network is 10.10.10.0/24 and the backend is 10.20.20.0/24. Which listed source-address choice fits the stated directly connected server-side model?

  1. NSIP
  2. VIP
  3. SNIP in the server subnet Correct answer.
  4. Client IP (USIP)

Explanation

The stated directly connected default source-translation model uses a suitable server-side SNIP. Actual source-address selection also depends on routing, address availability and configured modes; this does not mean every routed backend subnet universally requires its own dedicated SNIP or that USIP is the default.

Question 25NetScaler traffic objects, expressions and controlled routing

A Citrix Administrator wants to separate management traffic from data traffic using a dedicated management VLAN. Which NetScaler feature allows the NSIP to live in its own VLAN while data SNIPs/VIPs use other VLANs?

  1. Admin partitions
  2. Management interface and Management VLAN binding (set ns config -nsvlan) Correct answer.
  3. Cluster instance group
  4. Net Profile

Explanation

Binding the NSVLAN with 'set ns config -nsvlan <id> -ifnum <interface>' (or via the GUI) places the NSIP into a tagged management VLAN, isolating management traffic from data VLANs that carry SNIPs and VIPs.

Question 26NetScaler traffic objects, expressions and controlled routing

Which traffic-handling mode must be ENABLED on the NetScaler so that the appliance forwards packets that do not match any virtual server, ACL, or service?

  1. MAC-based forwarding (MBF)
  2. Layer 3 mode (L3) Correct answer.
  3. USNIP mode
  4. Edge configuration mode

Explanation

Layer 3 mode (enabled by default) allows the NetScaler to act as a router and forward packets that are not destined for any owned IP, vServer, or service. With L3 mode disabled, such packets are dropped.

Question 27NetScaler traffic objects, expressions and controlled routing

A Citrix Administrator needs to bond two physical interfaces on a NetScaler MPX into a single logical link with the upstream switch using the IEEE 802.3ad protocol. Which NetScaler feature should be used?

  1. Static link aggregation channel (LA/x)
  2. LACP-enabled channel (LACP) Correct answer.
  3. VRRP group
  4. Net bridge

Explanation

LACP (IEEE 802.3ad) is the dynamic link-aggregation protocol; on NetScaler you create a channel and set 'LACP mode ACTIVE' (or PASSIVE) so the channel negotiates with the switch.

Question 28NetScaler traffic objects, expressions and controlled routing

Which command creates an extended ACL on NetScaler ADC that DENIES all TCP traffic from source 10.1.1.0/24 to destination port 80?

  1. add ns acl deny_web DENY -srcIP 10.1.1.0-10.1.1.255 -destPort = 80 -protocol TCP Correct answer.
  2. add ns simpleacl deny_web DENY -srcIP 10.1.1.0/24 -destPort 80
  3. add ns acl6 deny_web DENY -srcIPv6 10.1.1.0/24
  4. add policy acl deny_web -rule "CLIENT.IP.SRC.IN_SUBNET(10.1.1.0/24)" -action DENY

Explanation

Extended ACLs on NetScaler use 'add ns acl <name> <action>' with options such as -srcIP (range or subnet), -destPort, and -protocol. The example correctly denies TCP traffic on port 80 from 10.1.1.0/24.

Question 29NetScaler traffic objects, expressions and controlled routing

Which network topology is described as ONE-ARM mode for a NetScaler ADC deployment?

  1. Client traffic and server traffic enter and leave on the same NetScaler interface (and same VLAN/subnet) Correct answer.
  2. Client traffic enters on one interface and server traffic leaves on a different interface in a different subnet
  3. The NetScaler bridges two physical segments transparently at Layer 2
  4. The NetScaler operates only in inline mode between two routers

Explanation

In one-arm mode, the NetScaler uses a single interface (or LACP channel) for both client and server traffic, and the VIP plus SNIP live in the same VLAN. Two-arm mode separates client and server onto different interfaces/subnets.

Question 30NetScaler traffic objects, expressions and controlled routing

Which NetScaler dynamic routing protocol can be enabled per VLAN/SNIP to advertise VIPs upstream so a router knows which NetScaler currently owns each VIP?

  1. OSPF or BGP via the integrated routing daemons (ZebOS) Correct answer.
  2. STP only
  3. RIP-only on the NSIP
  4. VRRP without dynamic routing

Explanation

NetScaler integrates ZebOS routing daemons; OSPF and BGP can be enabled on a SNIP and used to advertise VIPs (host routes) upstream. The active HA primary advertises the VIPs; on failover, the secondary takes over and re-advertises.

Question 31NetScaler traffic objects, expressions and controlled routing

A Citrix Administrator needs to allow the back-end web server to see the original client IP. Which two NetScaler features can deliver the original client IP to the back-end? (Choose the option that lists BOTH valid options.)

  1. Use Source IP (USIP) mode on the service or insert an X-Forwarded-For header via a Rewrite policy Correct answer.
  2. Enable HA INC mode and disable SNAT
  3. Enable LACP and bind a Net Profile
  4. Disable connection multiplexing only

Explanation

Two common ways to deliver the client IP back-end-side: (1) USIP causes NetScaler to use the client IP as the source IP toward the server (server return route must point at NetScaler), or (2) leave default SNAT/SNIP and rewrite/insert an X-Forwarded-For header that the back-end logs.

Question 32NetScaler traffic objects, expressions and controlled routing

Which listed sequence best describes the related NetScaler load-balancing objects from the client-facing virtual server to backend server information and its health-check association, rather than a literal packet traversal through a monitor?

  1. Service > Service Group > Virtual Server > Monitor
  2. Virtual Server > Service / Service Group > Server > Monitor binding Correct answer.
  3. Monitor > Server > Virtual Server > Service
  4. Server > Virtual Server > Service > Monitor

Explanation

The virtual server is associated with services or service groups that represent backend services and relevant server addresses. Monitors provide configured health observations for these services; a request does not literally pass through a monitor as its final packet-processing stage.

Question 33NetScaler traffic objects, expressions and controlled routing

A Citrix Administrator wants the NetScaler to verify that a back-end web server returns the literal text 'OK' inside the HTTP body of a /healthz response. Which monitor type is BEST suited?

  1. TCP
  2. HTTP
  3. HTTP-ECV Correct answer.
  4. PING

Explanation

HTTP-ECV (Extended Content Verification) lets the administrator send a custom HTTP request and assert that a configured string appears in the response body, which is exactly what is needed to validate the body of /healthz.

Question 34NetScaler traffic objects, expressions and controlled routing

A Citrix Administrator must ensure that all requests from the same browser session are sent to the same back-end web server, even when the client IP changes (mobile users). Which persistence type should be configured on the LB virtual server?

  1. SOURCEIP
  2. COOKIEINSERT Correct answer.
  3. SSLSESSION
  4. DESTIP

Explanation

COOKIEINSERT persistence makes the NetScaler insert its own cookie that identifies the chosen back-end service. It survives client IP changes because persistence is keyed off the cookie, not the source IP.

Question 35NetScaler traffic objects, expressions and controlled routing

Which CLI command creates an HTTP load-balancing virtual server named lb_web with VIP 10.10.10.100 listening on port 80?

  1. add lb vserver lb_web HTTP 10.10.10.100 80 Correct answer.
  2. add vserver lb_web -type HTTP -ip 10.10.10.100 -port 80
  3. create lb-vserver lb_web protocol HTTP 10.10.10.100 80
  4. set lb vserver lb_web HTTP 10.10.10.100 80

Explanation

The correct NetScaler CLI syntax to create an LB vServer is: add lb vserver <name> <serviceType> <IP> <port>. Example: 'add lb vserver lb_web HTTP 10.10.10.100 80'.

Question 36NetScaler traffic objects, expressions and controlled routing

Which load-balancing method on NetScaler ADC distributes new connections to the service that currently has the fewest active client connections?

  1. ROUNDROBIN
  2. LEASTCONNECTION Correct answer.
  3. LEASTRESPONSETIME
  4. SOURCEIPHASH

Explanation

LEASTCONNECTION sends each new connection to the bound service with the fewest active connections, which is the default and most commonly used dynamic method for HTTP/TCP traffic.

Question 37NetScaler traffic objects, expressions and controlled routing

An LB vServer is configured with two services. The administrator wants the NetScaler to keep one service in reserve and only direct traffic there if all other services go DOWN. Which feature should be used?

  1. Spillover persistence
  2. Backup virtual server Correct answer.
  3. Service weight = 0 with priority binding
  4. Slow-start service

Explanation

A backup virtual server (configured with -backupVServer on the primary LB vServer) is activated only when the primary's state goes DOWN, allowing the backup to host stand-by services or display a sorry-page.

Question 38NetScaler traffic objects, expressions and controlled routing

A Citrix Administrator must protect a back-end web farm from being overwhelmed when traffic spikes. The administrator wants new connections beyond a configured threshold to be redirected to a backup site. Which NetScaler LB feature provides this behavior?

  1. Surge protection
  2. Spillover with backup vServer Correct answer.
  3. Rate limiting on the SNIP
  4. Connection multiplexing

Explanation

Spillover (CONNECTION, DYNAMICCONNECTION, BANDWIDTH, or HEALTH) on an LB vServer pushes excess load to a configured backup vServer once the threshold is reached, protecting the primary servers from being overrun.

Question 39NetScaler traffic objects, expressions and controlled routing

Which NetScaler load-balancing method should be used for UDP-only DNS services when the administrator wants traffic distributed by hashing the destination IP and port?

  1. DESTINATIONIPHASH Correct answer.
  2. ROUNDROBIN
  3. LEASTPACKETS
  4. TOKEN

Explanation

DESTINATIONIPHASH (and its variants) hashes on the destination IP, which is useful for stateless UDP services like DNS where deterministic mapping is desired. Other valid hash methods include SOURCEIPHASH and CALLIDHASH (SIP).

Question 40Security operations, monitoring and response

Which NetScaler log file is the LIVE rotating syslog file written by the appliance?

  1. /var/log/ns.log Correct answer.
  2. /var/log/dr_log
  3. /var/nslog/newnslog
  4. /nsconfig/ns.conf

Explanation

/var/log/ns.log is the active syslog file (rotated as ns.log.0.gz, ns.log.1.gz, etc.) where authentication, system events, and standard syslog entries are written.

Question 41Security operations, monitoring and response

Which NetScaler tool collects detailed counter data from the binary newnslog file for performance troubleshooting?

  1. nstrace
  2. nsconmsg Correct answer.
  3. tcpdump
  4. syslogd

Explanation

nsconmsg parses the /var/nslog/newnslog binary log and prints rich counter information (CPU, memory, packet drops, SSL stats, etc.) used for performance troubleshooting.

Question 42Security operations, monitoring and response

A Citrix Administrator must capture traffic on the NetScaler to investigate a TLS handshake failure between a client and an SSL vServer. Which utility produces a packet capture in pcap-readable format?

  1. nsconmsg
  2. nstrace Correct answer.
  3. show techsupport
  4. ns-aaad

Explanation

nstrace (start nstrace / stop nstrace) generates .cap files that can be opened in Wireshark to inspect the TLS handshake and other packet-level activity.

Question 43Security operations, monitoring and response

A Citrix Administrator is debugging an LDAP authentication failure on the NetScaler. Which file should be tailed in real time to see the LDAP search/bind exchange?

  1. /tmp/aaad.debug Correct answer.
  2. /var/log/ns.log only
  3. /var/nstrace/cap0001.cap
  4. /var/log/dr_log

Explanation

Running 'cat /tmp/aaad.debug' (a FIFO) on the NetScaler shell reveals the live LDAP/RADIUS/SAML conversation that the aaad daemon performs - search base, search filter, bind result, and group extraction.

Question 44Security operations, monitoring and response

Which feature in NetScaler Console (formerly Citrix ADM) provides per-application performance, transactions, and end-user experience based on flow data sent from the ADC?

  1. Configuration Audit
  2. Web Insight (AppFlow) Correct answer.
  3. Stylebooks
  4. License pooling

Explanation

Web Insight (powered by AppFlow over IPFIX) sends per-transaction telemetry from the ADC to NetScaler Console, where administrators can see response time, request volume, latency, and end-user experience per application.

Question 45Security operations, monitoring and response

A Citrix Administrator wants to send NetScaler events to an external SIEM via syslog over TCP. Which two configuration steps are REQUIRED on the NetScaler? (Choose the option that lists both required steps in order.)

  1. Add a syslog action specifying the SIEM IP, port, and transport; then add a syslog policy and bind it globally (or to a vServer) Correct answer.
  2. Add a syslog server entry in the SNMP config; then enable SNMP traps
  3. Add an AppFlow collector; then enable AppFlow on the vServer
  4. Add a Net Profile pointing at the SIEM; then bind the Net Profile to the LB vServer

Explanation

Sending syslog to an external SIEM requires (1) creating a syslog action ('add audit syslogAction <name> <serverIP> -serverPort <port> -transport TCP -logLevel ALL'), then (2) a syslog policy bound to system global (or specific vServer) so events flow to the SIEM.

Question 46Security operations, monitoring and response

Which SNMP component on NetScaler ADC must be configured so that an external monitoring tool can poll the appliance for OIDs such as CPU and memory?

  1. SNMP Manager and SNMP Community (set snmp community / add snmp manager) Correct answer.
  2. SNMP Trap and SNMP Group
  3. SNMP Engine ID and SNMP View only
  4. SNMP Inform with VRF context

Explanation

For SNMP polling, the NetScaler must have the SNMP Manager (the IP allowed to poll) and an SNMP Community string configured. Without these, the appliance silently drops SNMP GET requests.

Question 47Security operations, monitoring and response

A Citrix Administrator wants to know which troubleshooting bundle to upload to Citrix support. Which command produces the consolidated tar archive with logs, ns.conf, system info, and crash data?

  1. show techsupport Correct answer.
  2. show ns runningconfig
  3. save ns config
  4. diag collect

Explanation

From the NetScaler shell or CLI, 'show techsupport' generates /var/tmp/support/collector_*.tar.gz containing logs, configuration, dr_log, newnslog, /var/core data, and system info to attach to a Citrix support case.

Question 48NetScaler Gateway, authentication factors and resource access

When integrating Citrix Gateway with Citrix Virtual Apps and Desktops (CVAD), which StoreFront setting MUST point at the Gateway so launched sessions are routed through it?

  1. Add a 'Citrix Gateway' (Remote Access) entry in the StoreFront Store and enable Remote Access Correct answer.
  2. Set the StoreFront base URL to the Gateway IP
  3. Configure StoreFront authentication to use Local users only
  4. Disable Pass-Through from NetScaler Gateway

Explanation

In the supplied StoreFront/Gateway remote-access model, configure the relevant Gateway entry and enable the intended store’s remote-access arrangement. Gateway, authentication and supported STA settings must align. The Secure Ticket Authority participates in launch-ticket handling; it is not the mechanism for every single-sign-on operation, and callback requirements depend on the actual design.

Question 49NetScaler Gateway, authentication factors and resource access

Which Citrix component issues the Secure Ticket Authority (STA) ticket that Citrix Gateway uses to validate that an HDX launch request from a client is legitimate?

  1. The Delivery Controller (which runs the STA service) Correct answer.
  2. The NetScaler ADC management service
  3. The StoreFront server alone (without DDC)
  4. The Citrix License Server

Explanation

The Secure Ticket Authority (STA) is hosted on the Citrix Delivery Controller (DDC). StoreFront requests an STA ticket from the DDC and embeds it in the ICA file; Citrix Gateway then validates the ticket with the same DDC before allowing the HDX session.

Question 50NetScaler Gateway, authentication factors and resource access

A Citrix Administrator must configure the Citrix Gateway vServer with the STA URLs for CVAD. Which property on the Gateway vServer accepts these URLs?

  1. Bound STA Servers (under Published Applications > Secure Ticket Authority) Correct answer.
  2. Bound LDAP authentication action
  3. Bound TCP profile
  4. Bound SSL profile

Explanation

On the Citrix Gateway vServer, under 'Published Applications', you bind one or more Secure Ticket Authority (STA) URLs (typically http(s)://ddc.fqdn/scripts/ctxsta.dll). Each STA URL is the DDC where tickets are validated.