I85PREP
⌘ K
Citrix CCA-N study materials
Citrix CCA-N study resources

Citrix CCA-N practice questions

One question at a time. Build your Citrix CCA-N understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Networking architecture and Citrix ADC platform fundamentals

In a Citrix ADC deployment, which component is responsible for performing health checks on backend servers and marking them UP or DOWN?

  1. The virtual server's load-balancing method
  2. The monitor bound to the service or service group Correct answer.
  3. The client's source IP persistence entry
  4. The NetScaler IP (NSIP) address

Explanation

Monitors are dedicated probe objects that periodically test a service and set its effective state, which the vserver then uses when choosing a target. The load-balancing algorithm only decides ordering among services already known to be UP.

Question 2Networking architecture and Citrix ADC platform fundamentals

A Citrix ADC is configured in high availability with two nodes. Which address is shared and floats to the secondary node during a failover so that clients keep reaching the same virtual server?

  1. The virtual server IP (VIP) Correct answer.
  2. The SNIP
  3. The NSIP
  4. The management IP of each node

Explanation

The VIP is owned by the active node and moves to the peer during failover, preserving client connectivity to the vserver. The NSIPs remain distinct per node so each appliance can still be managed individually.

Question 3Networking architecture and Citrix ADC platform fundamentals

Which Citrix ADC feature lets a single virtual server present a different back-end pool depending on the URL path requested by the client?

  1. SSL bridging
  2. Surge protection
  3. Global server load balancing
  4. Content switching Correct answer.

Explanation

Content switching evaluates request attributes such as URL path and selects a target vserver or service group accordingly. This allows one front-end VIP to fan out to multiple application pools.

Question 4Networking architecture and Citrix ADC platform fundamentals

An administrator wants client requests from the same source to keep hitting the same back-end server for the duration of a session. Which configuration achieves this?

  1. Change the load-balancing method to ROUNDROBIN
  2. Enable a persistence method such as SOURCEIP on the virtual server Correct answer.
  3. Enable HTTP compression on the virtual server
  4. Bind an additional monitor to the service group

Explanation

Persistence ties a client to a chosen service for a defined timeout, which is what session affinity requires. Load-balancing methods only decide initial selection and would still spread subsequent requests.

Question 5Networking architecture and Citrix ADC platform fundamentals

Which statement correctly describes the role of the Subnet IP (SNIP) address on a Citrix ADC?

  1. It is the shared address used for HA heartbeats only
  2. It is the address used by administrators for GUI and SSH access
  3. It is the source address the appliance uses when initiating connections to back-end servers Correct answer.
  4. It is the address clients connect to for published applications

Explanation

The SNIP sits in the server subnet and provides the source address for appliance-originated traffic to back ends. Management access uses the NSIP, and client traffic targets VIPs.

Question 6Networking architecture and Citrix ADC platform fundamentals

In a Citrix ADC high availability pair, what is the primary purpose of the heartbeat communication between nodes?

  1. To balance load between the two appliances
  2. To let each node detect peer failure and trigger a failover Correct answer.
  3. To replicate SSL certificates to the secondary node
  4. To synchronize client persistence entries only

Explanation

Heartbeats let each node monitor the health of its peer so that the secondary can take over if the primary stops responding. Failure detection is the trigger for the HA failover process.

Question 7Networking architecture and Citrix ADC platform fundamentals

A virtual server is configured with the LEASTCONNECTION load-balancing method. How does the appliance choose among eligible services?

  1. It selects services in the fixed order they were bound
  2. It selects the service with the fewest active connections Correct answer.
  3. It selects the service that responded fastest to the last monitor
  4. It selects the service with the lowest numeric IP address

Explanation

LEASTCONNECTION directs each new request to the eligible service currently handling the smallest number of connections. This tends to even out load when sessions have varying durations.

Question 8Networking architecture and Citrix ADC platform fundamentals

Which monitor type would an administrator most likely bind to a service representing an HTTP web server to verify application-level health?

  1. ARP
  2. HTTP Correct answer.
  3. TCP
  4. PING

Explanation

An HTTP monitor issues a request and validates the response, confirming the web service itself is answering correctly. PING and TCP only confirm host reachability or port availability.

Question 9Networking architecture and Citrix ADC platform fundamentals

What does Global Server Load Balancing (GSLB) primarily provide in a multi-site Citrix ADC architecture?

  1. Encrypting traffic between the client and the first ADC
  2. Compressing responses between data centers
  3. Providing Layer 2 loop prevention across sites
  4. Distributing DNS responses across sites based on configured policies and site health Correct answer.

Explanation

GSLB answers DNS queries with the best site according to metrics and policies, and withdraws a site when its health checks fail. This gives disaster recovery and geographic traffic steering.

Question 10Networking architecture and Citrix ADC platform fundamentals

A client connects to a Citrix ADC virtual server over HTTPS and the ADC then opens a separate HTTPS connection to the back-end server. Which term describes this configuration?

  1. SSL bridging Correct answer.
  2. SSL passthrough
  3. SSL offloading
  4. TCP proxy

Explanation

SSL bridging terminates TLS at the ADC and re-encrypts toward the server, so both legs are encrypted. Offloading would send cleartext to the back end, and passthrough would not decrypt at all.

Question 11Networking architecture and Citrix ADC platform fundamentals

Which Citrix ADC object directly represents a back-end server's IP address and port and is bound to a virtual server?

  1. Service Correct answer.
  2. Monitor
  3. Action
  4. Policy expression

Explanation

A service defines the server IP and port that the appliance forwards traffic to, and it is bound to a vserver or grouped in a service group. Monitors attach to services to determine their state.

Question 12Networking architecture and Citrix ADC platform fundamentals

An administrator needs several back-end web servers treated as one logical pool that can be scaled by adding members without rebinding each to the vserver. Which construct fits best?

  1. A responder policy
  2. A service group Correct answer.
  3. A single service with multiple ports
  4. A content switching policy

Explanation

A service group holds many members and is bound once to the virtual server, so members can be added or removed without touching the vserver binding. This simplifies scaling and management.

Question 13Networking architecture and Citrix ADC platform fundamentals

What is the effect of configuring a virtual server in 'down state flush' mode?

  1. The vserver is removed from the configuration
  2. Existing connections are reset immediately when the vserver goes DOWN
  3. Existing connections are allowed to complete while new connections are refused Correct answer.
  4. Monitors are disabled for all bound services

Explanation

Down state flush controls whether established sessions are torn down or permitted to finish when a vserver transitions to DOWN. Allowing them to complete avoids abruptly dropping user sessions.

Question 14Networking architecture and Citrix ADC platform fundamentals

Which address type must be configured so that the Citrix ADC can communicate with servers that reside on a different subnet than the appliance's own interfaces?

  1. A virtual server IP for each server
  2. A subnet IP (SNIP) on the server-facing network Correct answer.
  3. An additional NSIP
  4. A mapped IP (MIP) for each server

Explanation

A SNIP placed on the server-side network gives the appliance a local presence for reaching those back ends and returning their responses. Without an address on that network, return traffic cannot be routed correctly.

Question 15Networking architecture and Citrix ADC platform fundamentals

Which statement best explains why a Citrix ADC HA pair is described as active-passive for traffic handling?

  1. Only the primary node forwards traffic while the secondary stays ready to take over Correct answer.
  2. The secondary node handles only management traffic
  3. Both nodes actively forward client traffic at all times
  4. Traffic is split evenly by the load-balancing method across nodes

Explanation

In a standard HA pair the primary owns the VIPs and forwards traffic, while the secondary maintains synchronized state and waits to assume the role. This avoids split-brain forwarding of the same VIPs.

Question 16Networking architecture and Citrix ADC platform fundamentals

Which load-balancing method would be most appropriate when back-end servers have very different capacity and the administrator wants to weight traffic proportionally?

  1. ROUNDROBIN
  2. LEASTCONNECTION
  3. SOURCEIPHASH
  4. WEIGHTED LEASTCONNECTION Correct answer.

Explanation

WEIGHTED LEASTCONNECTION combines connection counts with per-service weights so larger servers receive proportionally more traffic. Plain least connection ignores capacity differences.

Question 17Networking architecture and Citrix ADC platform fundamentals

A monitor bound to a service reports the service as DOWN even though the application is reachable from a test workstation. Which factor is the most likely cause to investigate first?

  1. The monitor's configured probe parameters, such as port, path, or expected response code Correct answer.
  2. The client's browser version
  3. The compression policy bound to the vserver
  4. The number of persistence entries on the vserver

Explanation

A monitor judges health strictly by its probe definition, so a wrong port, path, or expected status code will mark a working service DOWN. Verifying those parameters against the real application is the first diagnostic step.

Question 18Networking architecture and Citrix ADC platform fundamentals

What is the purpose of a content switching virtual server compared with a regular load-balancing virtual server?

  1. It terminates only DNS queries for GSLB
  2. It inspects request attributes and forwards to a selected target vserver or service group Correct answer.
  3. It stores persistence entries for all vservers
  4. It provides a management interface for configuration

Explanation

A content switching vserver evaluates policies on request data such as host or path and routes to the appropriate back-end target. A regular LB vserver instead distributes directly across its bound services.

Question 19Networking architecture and Citrix ADC platform fundamentals

Which Citrix ADC capability helps protect back-end servers from being overwhelmed when a sudden burst of connections arrives?

  1. Content switching by host header
  2. SSL passthrough
  3. Surge protection with a configured threshold Correct answer.
  4. GSLB site persistence

Explanation

Surge protection queues or throttles new connections once a threshold is reached, shielding servers from connection floods. It manages the rate at which requests reach the back end.

Question 20Networking architecture and Citrix ADC platform fundamentals

An administrator wants the appliance to add an X-Forwarded-For header so back-end servers can see the original client IP. Which type of policy is most appropriate?

  1. A rewrite policy bound to the request Correct answer.
  2. A responder policy bound to the response
  3. A cache policy bound to the response
  4. An authorization policy bound to the vserver

Explanation

Rewrite policies modify requests or responses in flight, making them suitable for inserting a header before the request reaches the server. Responder policies instead generate a response at the appliance.

Question 21Networking architecture and Citrix ADC platform fundamentals

Which statement accurately describes how a Citrix ADC uses the virtual server's protocol setting?

  1. It selects the load-balancing method automatically
  2. It sets the management protocol used for SSH access
  3. It configures the monitor type for bound services
  4. It determines how the appliance parses and handles incoming client traffic on that vserver Correct answer.

Explanation

The protocol setting tells the appliance what kind of traffic the vserver receives, which governs parsing and feature applicability. It is independent of management access and monitor selection.

Question 22Networking architecture and Citrix ADC platform fundamentals

In GSLB, what does a site persistence method such as connection proxy primarily accomplish?

  1. It compresses DNS responses between sites
  2. It encrypts the communication between GSLB sites
  3. It keeps a client's requests directed to the same GSLB site across multiple DNS lookups Correct answer.
  4. It replaces the need for health monitors at each site

Explanation

Site persistence ensures a client continues to be served by the same site even if DNS resolution happens again. Connection proxy achieves this by anchoring the client's traffic to the selected site.

Question 23Networking architecture and Citrix ADC platform fundamentals

Which object is used to group multiple monitors so that a service is considered UP only when the required conditions across them are met?

  1. A single service bound to several vservers
  2. A responder action
  3. A content switching action
  4. A monitor bound with the appropriate 'and'/'or' semantics to the service Correct answer.

Explanation

Binding multiple monitors with the correct combination semantics lets health require all or any of the probes to succeed. This gives finer control than a single monitor alone.

Question 24Networking architecture and Citrix ADC platform fundamentals

Which statement best describes the function of a Mapped IP (MIP) address on a Citrix ADC?

  1. It is the primary management address of the appliance
  2. It is the address clients use to reach a virtual server
  3. It is the shared address used in an HA pair
  4. It provides an address used for source NAT of appliance-originated connections in specific deployment scenarios Correct answer.

Explanation

A MIP is used for address translation of traffic the appliance originates, such as in certain multi-subnet or NAT scenarios. It is distinct from the NSIP used for management and from VIPs used for client traffic.

Question 25Networking architecture and Citrix ADC platform fundamentals

An administrator observes that after a failover, existing client sessions are dropped even though new connections succeed. Which configuration is most relevant to investigate?

  1. Whether SSL compression is enabled on the vserver
  2. Whether the load-balancing method is ROUNDROBIN
  3. Whether content switching policies are bound
  4. Whether stateful connection failover and persistence synchronization are enabled Correct answer.

Explanation

Preserving established sessions across failover depends on state synchronization between the nodes, including connection and persistence state. Without it, the secondary cannot continue the primary's sessions.

Question 26Networking architecture and Citrix ADC platform fundamentals

Which Citrix ADC component is responsible for making the initial load-balancing decision before any advanced policy evaluation occurs?

  1. The default load-balancing virtual server Correct answer.
  2. The monitor
  3. The service group
  4. The content switching virtual server

Explanation

A default load-balancing virtual server receives traffic first and distributes it across bound services using its configured method. Content switching virtual servers are used when traffic must be steered by policy before load balancing, and they do not perform the initial balancing themselves.

Question 27Networking architecture and Citrix ADC platform fundamentals

An administrator configures a Citrix ADC virtual server with the SSL_BRIDGE protocol. What behavior should be expected for client connections?

  1. The ADC performs SSL offloading and inserts an X-Forwarded-For header.
  2. The ADC terminates SSL and forwards plain HTTP to the back-end server.
  3. The ADC forwards encrypted traffic without decrypting it, so the back-end server handles SSL termination. Correct answer.
  4. The ADC decrypts SSL traffic and re-encrypts it to the back-end server.

Explanation

SSL_BRIDGE means the ADC passes encrypted traffic through without terminating SSL, so the back-end server must decrypt and handle the SSL session. SSL termination and re-encryption occur with SSL or SSL_TCP virtual servers that are configured for offloading, not with SSL_BRIDGE.

Question 28Networking architecture and Citrix ADC platform fundamentals

A Citrix ADC is deployed in a single-arm (one-arm) network topology. What is a key characteristic of this deployment?

  1. The ADC must be placed inline between the clients and the servers.
  2. The ADC requires two physical appliances for redundancy.
  3. The ADC uses separate client-side and server-side VLANs with distinct interfaces.
  4. The ADC uses a single interface for both client and server traffic, often requiring a MIP for server communication. Correct answer.

Explanation

In a single-arm topology, the ADC uses one network interface for both client-facing and server-facing traffic. A MIP (Mapped IP) is typically configured so the ADC can communicate with back-end servers on the same subnet without a separate server-side interface.

Question 29Networking architecture and Citrix ADC platform fundamentals

Which statement accurately describes the role of a SNIP (Subnet IP) address on a Citrix ADC?

  1. It is the address assigned to the management interface for GUI access.
  2. It is the address used for high availability heartbeat communication between nodes.
  3. It is the address clients connect to when accessing a virtual server.
  4. It is used by the ADC to originate connections to back-end servers, including health checks. Correct answer.

Explanation

A SNIP is a subnet IP address that the ADC uses as the source address when initiating connections to back-end servers, such as monitor probes and server-side connections. It is not the client-facing VIP, the HA heartbeat address, or the management NSIP.

Question 30Networking architecture and Citrix ADC platform fundamentals

An administrator wants to ensure that a Citrix ADC high availability pair can fail over even if the primary node's network interfaces remain up but the appliance stops processing traffic. Which HA setting should be configured?

  1. Enable HA monitoring on all interfaces.
  2. Configure fail-safe mode to trigger failover when the primary node stops responding. Correct answer.
  3. Disable HA synchronization.
  4. Set the HA heartbeat timeout to a lower value.

Explanation

Fail-safe mode allows the secondary node to take over when the primary node is unreachable or not processing traffic, even if its interfaces are still up. HA monitoring and heartbeat timeouts affect detection of interface or communication failures, but fail-safe specifically addresses a non-responsive primary.

Question 31Networking topology, high availability, and deployment modes

In a Citrix ADC high-availability pair configured for active-active operation, which statement correctly describes how a client connection is handled after the initial packet arrives?

  1. The client must reconnect to a different VIP hosted on the secondary appliance after each request
  2. Only the primary node processes traffic while the secondary node stays passive and drops all client packets
  3. Each appliance independently owns a separate subset of the same VIP's flows based on a hashing decision made at ingress Correct answer.
  4. Both nodes forward every packet to the other node before responding to the client

Explanation

In active-active mode on Citrix ADC, both nodes can own flows for the same VIP, with the ingress node steering each new connection to an owner based on a steering/hash decision. The non-owning node forwards traffic to the owner rather than serving it locally, so both appliances carry load. This differs from active-passive, where the secondary stays idle until failover.

Question 32Networking topology, high availability, and deployment modes

Which Citrix ADC deployment mode places the appliance inline between clients and servers while preserving the client source IP address seen by the backend servers?

  1. One-arm mode with a single interface
  2. Transparent mode with use source IP enabled Correct answer.
  3. Reverse proxy mode with source NAT enabled
  4. Transparent mode with use source IP disabled

Explanation

In transparent mode the ADC is inline and can be configured with Use Source IP (USIP) so backend servers see the original client address. Reverse proxy mode terminates the client connection and typically presents the ADC's own address. One-arm mode uses a single interface and does not by itself preserve the client IP.

Question 33Networking topology, high availability, and deployment modes

What is the primary purpose of the Citrix ADC high-availability heartbeat?

  1. To synchronize SSL certificates between the nodes on a fixed schedule
  2. To exchange health and state information so a peer can detect failure and trigger failover Correct answer.
  3. To load balance client requests across the pair in active-active mode
  4. To replicate the configuration database to remote branch appliances

Explanation

The HA heartbeat exchanges state and health information between peers so each node knows whether the other is reachable and healthy. Loss of heartbeats is what triggers failover to the surviving node. Configuration synchronization and certificate handling are separate functions from the heartbeat itself.

Question 34Networking topology, high availability, and deployment modes

A Citrix ADC HA pair is configured with failover interface set enabled. What behavior does this setting provide?

  1. It disables the heartbeat on the monitored interfaces to avoid false failovers
  2. It binds the VIP only to interfaces that are members of the failover set
  3. It forces all traffic onto the secondary node whenever any interface is administratively disabled
  4. It monitors a set of interfaces and triggers failover when those interfaces go down on the primary node Correct answer.

Explanation

Failover interface set lets you designate interfaces whose failure should cause the node to be considered failed and hand over to the peer. It is a monitored set used as an additional health signal beyond the heartbeat. It does not move traffic merely because an interface was administratively disabled, nor does it change VIP binding.

Question 35Networking topology, high availability, and deployment modes

Which Citrix ADC feature allows a single appliance to present multiple, isolated routing and administrative domains to different tenants?

  1. Content switching
  2. Admin partitions Correct answer.
  3. Policy-based routing
  4. NetScaler Gateway

Explanation

Admin partitions let one Citrix ADC host multiple isolated configurations, each with its own objects, policies, and often its own network view. This is the mechanism for multi-tenant separation on a single appliance. Content switching and policy-based routing direct traffic but do not create isolated administrative domains.

Question 36Networking topology, high availability, and deployment modes

In a Citrix ADC HA configuration, what does the synchronization state indicate?

  1. Whether the heartbeat packets are encrypted between the nodes
  2. Whether the secondary node has enough licenses to take over
  3. Whether the VIPs are currently bound to the correct interfaces
  4. Whether the configuration on the secondary node matches the primary node Correct answer.

Explanation

Synchronization state reflects whether configuration changes made on the primary have been propagated to the secondary. A node can be up and healthy yet out of sync, which is a common cause of unexpected behavior after failover. Licensing and VIP binding are tracked separately.

Question 37Networking topology, high availability, and deployment modes

A Citrix ADC is deployed in one-arm mode. Which statement best describes the traffic path?

  1. Client and server traffic both enter and leave through a single interface using a shared VLAN Correct answer.
  2. The appliance uses a dedicated management interface for all client traffic
  3. Client traffic enters one interface and server traffic leaves a second interface in a straight line
  4. The appliance sits between two VLANs and forwards frames at layer 2 without IP addresses

Explanation

In one-arm mode the ADC uses a single network interface (or a single VLAN) for both client-facing and server-facing traffic, relying on the upstream router to send traffic to it. Inline or two-arm deployments use separate interfaces for client and server sides. Management traffic is never used for client data.

Question 38Networking topology, high availability, and deployment modes

Which condition typically causes an HA pair to perform a failover when the primary node is still processing traffic normally?

  1. A configuration change saved on the primary node
  2. A brief spike in CPU utilization on the secondary node
  3. Loss of all heartbeat communication between the peers Correct answer.
  4. A new SSL certificate installed on the secondary node

Explanation

When the peers can no longer exchange heartbeats, each may consider the other failed, which can cause a failover even though the primary is healthy. This is why heartbeat paths must be redundant and isolated from data-plane congestion. CPU spikes, saves, and certificate installs do not by themselves trigger failover.

Question 39Networking topology, high availability, and deployment modes

What is the role of the independent network interface (often called the HA heartbeat interface) in a Citrix ADC HA pair?

  1. It provides out-of-band console access to the primary node
  2. It synchronizes the configuration database between nodes
  3. It carries client application traffic between the two nodes
  4. It carries heartbeat and state exchange traffic separately from data traffic Correct answer.

Explanation

A dedicated heartbeat interface keeps peer health and state traffic off the data path so that congestion or failure in the data network does not cause false failovers. Configuration synchronization is a separate mechanism from the heartbeat channel. Console access is provided by the management or serial interface.

Question 40Networking topology, high availability, and deployment modes

Which Citrix ADC capability is most directly associated with reducing round trips for remote clients by terminating TLS and optimizing the connection between client and appliance?

  1. Link load balancing
  2. Global server load balancing
  3. Policy-based routing
  4. SSL offloading with front-end optimization Correct answer.

Explanation

SSL offloading terminates TLS at the ADC, and front-end optimization reduces the work the client must do across that connection. Together they shorten the client-side path and reduce latency for remote users. Link load balancing, GSLB, and PBR address different problems such as ISP selection and site selection.

Question 41Networking topology, high availability, and deployment modes

A Citrix ADC HA pair is in active-passive mode. After a failover, clients connected through the VIP experience a brief disruption. What is the most likely reason?

  1. The VIP address is reassigned to a different subnet during failover
  2. The secondary node must renegotiate all SSL sessions before accepting traffic
  3. The heartbeat protocol pauses all traffic for a fixed interval
  4. Established flows owned by the failed primary are lost and clients must reconnect Correct answer.

Explanation

In active-passive mode, established connections live on the primary node. When the primary fails, those flows cannot be resumed on the secondary, so clients must reconnect and the VIP is taken over by the surviving node. The VIP does not change subnets, and the heartbeat does not impose a fixed traffic pause.

Question 42Networking topology, high availability, and deployment modes

Which statement accurately distinguishes Citrix ADC global server load balancing from local server load balancing?

  1. GSLB requires an HA pair, while local load balancing requires an admin partition
  2. GSLB operates only at layer 2, while local load balancing operates at layer 7
  3. GSLB distributes traffic among data centers or sites, while local load balancing distributes among servers behind a single VIP Correct answer.
  4. GSLB distributes traffic among servers behind a single VIP, while local load balancing selects among data centers

Explanation

GSLB makes decisions across sites or data centers, often using DNS and health metrics, to direct clients to the best location. Local load balancing distributes requests among backend servers behind a VIP on a single appliance. Neither requires an HA pair or admin partition as a precondition.

Question 43Networking topology, high availability, and deployment modes

Which Citrix ADC deployment approach allows the appliance to be inserted without changing the IP addressing of existing servers?

  1. Reverse proxy mode with new server IP addresses
  2. Transparent mode Correct answer.
  3. One-arm mode with a new VIP subnet
  4. NetScaler Gateway with a new authentication policy

Explanation

Transparent mode lets the ADC sit inline without requiring servers to be re-addressed, since it forwards traffic while preserving addressing. Reverse proxy mode typically requires the ADC to be the destination and servers to be reachable behind it. One-arm mode still requires routing changes to steer traffic to the ADC.

Question 44Networking topology, high availability, and deployment modes

In a Citrix ADC HA pair, what does a node's status of primary indicate?

  1. The node holds the license server role for the pair
  2. The node is currently the active owner of the VIPs and is processing traffic Correct answer.
  3. The node has the most recent configuration but is not processing traffic
  4. The node is the designated management node for the pair

Explanation

The primary node in an HA pair is the one actively owning and serving the VIPs. The secondary node stands ready to take over if the primary fails. Management and licensing roles are not determined by primary/secondary HA status.

Question 45Networking topology, high availability, and deployment modes

Which consideration is most important when planning the network placement of the HA heartbeat link between two Citrix ADC appliances?

  1. It should share the same congested data path as client traffic to reduce cabling
  2. It should be routed through the upstream core switch to ensure reachability
  3. It should be a dedicated, redundant path isolated from the data network Correct answer.
  4. It should use the management interface to simplify administration

Explanation

The heartbeat should be isolated from the data path and made redundant so that data-plane congestion or a single link failure does not cause false failovers. Sharing the congested data path or the management interface undermines that isolation. Routing heartbeats through the core switch adds dependencies that can cause spurious failovers.

Question 46Networking topology, high availability, and deployment modes

A Citrix ADC is configured for reverse proxy mode. How do backend servers typically see the client connection?

  1. As originating from the original client IP address
  2. As originating from the Citrix ADC's address unless source IP preservation is configured Correct answer.
  3. As originating from the client's default gateway
  4. As originating from the secondary HA node

Explanation

In reverse proxy mode the ADC terminates the client connection and opens a new connection to the backend, so backends normally see the ADC address. Source IP preservation (USIP) can be configured to pass the client address. The client's gateway and the HA peer are not the source seen by backends.

Question 47Networking topology, high availability, and deployment modes

Which statement best describes the behavior of a Citrix ADC HA pair when the primary node is rebooted for maintenance while the secondary is healthy?

  1. The primary continues to serve traffic from its boot image
  2. The secondary takes over the VIPs and traffic continues with minimal interruption Correct answer.
  3. Both nodes go offline until the primary returns
  4. The VIPs are removed until an administrator re-creates them

Explanation

When the primary goes down for maintenance, the healthy secondary detects the loss and takes over ownership of the VIPs, so service continues with minimal interruption. The VIPs are not removed, and the rebooting node cannot serve traffic while it is down.

Question 48Networking topology, high availability, and deployment modes

Which Citrix ADC feature would you use to direct requests to different backend server groups based on the URL path in the request?

  1. Link load balancing
  2. Content switching Correct answer.
  3. Admin partitions
  4. Global server load balancing

Explanation

Content switching uses policies based on request attributes such as URL path to select a target load-balancing vserver or server group. Link load balancing and GSLB choose among network paths or sites, not among server groups by URL. Admin partitions provide tenant isolation rather than request routing.

Question 49Networking topology, high availability, and deployment modes

What is the effect of enabling HA monitoring on a specific VIP in a Citrix ADC HA pair?

  1. The VIP is monitored and a failure of the VIP causes the node to be considered failed for HA purposes Correct answer.
  2. The VIP is monitored and traffic is redirected to the secondary node's management address
  3. The VIP is monitored and its SSL certificate is synchronized automatically
  4. The VIP is monitored and removed from the configuration if it becomes unreachable

Explanation

HA monitoring on a VIP makes the node's HA state depend on that VIP's health, so a failure can cause the peer to take over. It does not redirect traffic to a management address, synchronize certificates, or delete the VIP from the configuration.

Question 50Networking topology, high availability, and deployment modes

Which Citrix ADC deployment mode is most appropriate when the appliance must inspect and modify HTTP headers before forwarding requests to backend servers?

  1. Layer-2 bridge mode
  2. Transparent mode with no IP addresses
  3. One-arm mode without a VIP
  4. Reverse proxy mode Correct answer.

Explanation

Reverse proxy mode terminates the client connection and lets the ADC inspect and rewrite HTTP headers before opening a new connection to the backend. Transparent and bridge modes forward traffic without terminating the application session, and one-arm mode without a VIP cannot serve application requests.