Citrix CCE-N flashcards

31 cards. Read the term and the definition here. The deck at the top of this page is optional.

One-arm deployment mode

A Citrix ADC topology where the NSIP and VIP share one subnet and traffic returns through the same interface, requiring upstream routing to the ADC MAC or MAC-based forwarding.

MAC-based forwarding

An ADC setting that forwards return traffic using the destination MAC instead of an L3 lookup, used in one-arm topologies where the default gateway is not the ADC.

Admin partition

A logical partition of a Citrix ADC that isolates objects, policies, and role-based access; each partition has its own NSIP alias and sees global objects read-only.

ADC capacity triad

The three independent limits of an ADC platform: throughput in Gbps, SSL transactions per second, and concurrent connections; the lowest one bounds the deployment.

Least connection method

A load-balancing algorithm that selects the bound service with the fewest active connections, adapting to uneven backend load better than round robin.

Source IP persistence

A persistence method that hashes the client IP with a configurable netmask so requests from the same client reach the same backend for the persistence timeout.

Content switching vServer

A vServer that evaluates policies in priority order and forwards each request to a target load-balancing vServer, with a default target for unmatched traffic.

Responder policy

An ADC policy that can short-circuit a request with a redirect or a fixed response without contacting a backend, unlike a rewrite policy that modifies traffic in flight.

GSLB MEP

The metric exchange protocol that GSLB sites use to share health and load over port 3009, or 3011 with secure MEP, feeding the site-selection algorithm.

SSL bridge versus offload

Bridge passes encrypted traffic through the ADC unchanged; offload terminates TLS on the ADC and can re-encrypt to the backend, changing where certificates and ciphers apply.

nFactor authentication

A Citrix ADC authentication flow that chains factors through policy labels and login schemas, ending when a policy action sets the session without a next factor.

LDAP bind and search

LDAP authentication on the ADC uses a bind DN and password to search a base DN, then extracts groups that drive authorization and session policy selection.

AppFW profile binding

A web application firewall profile applies signature and security checks only after it is bound to a vServer; a start URL or learned policy defines permitted URLs.

Client certificate authentication

A CERT authentication policy bound to an SSL vServer validates the client chain against a CA certificate and can map the certificate subject to a user name.

AAA session policy

A policy that governs post-authentication authorization, including single sign-on to backend applications through form-based, basic, NTLM, or SAML profiles.

HA failover triggers

Events that move the VIP and MAC addresses to the secondary node: peer heartbeat loss, a forced failover command, or a monitored-interface failure when HA monitoring is enabled.

Connection mirroring

A stateful failover feature that replicates established connections to the standby node so sessions survive failover; without it, connections are dropped.

AppFlow export

An ADC feature that sends traffic records to Citrix ADM using an AppFlow action and collector, which must be bound to the vServer to produce data.

nstrace capture

An ADC packet-capture utility that writes a .cap file filtered by IP or port for analysis in Wireshark, often paired with show techsupport for support cases.

Virtual path

A logical SD-WAN tunnel over a physical link such as MPLS, internet, or LTE, with a configured bandwidth and measured latency, loss, and jitter.

Master Control Node

The SD-WAN management component that stores and distributes site configuration to branch appliances and coordinates the virtual WAN topology.

Inline versus one-arm SD-WAN

Inline places the appliance in the data path for full QoS and path control; one-arm sits out of path with policy routing and is used for incremental migration.

Zero-touch provisioning

An SD-WAN branch deployment method where a bootstrap configuration or DHCP option lets a new appliance reach the MCN and download its full site configuration.

SD-WAN path selection

A per-application rule that chooses a virtual path by latency, loss, jitter, or weighted metric, and can prefer, fail over, or load-balance across paths.

QoS class guarantee

An SD-WAN class that assigns priority and bandwidth to an application group; the sum of guarantees must not exceed the link bandwidth or the class is oversubscribed.

Per-flow versus per-packet

Multi-path forwarding modes: per-flow keeps a flow on one path to preserve ordering, while per-packet spreads packets for utilization at the cost of possible reordering.

WAN deduplication

An SD-WAN optimization that removes repeated byte patterns from traffic on a virtual path; it requires the same feature enabled on both ends.

SD-WAN branch HA pair

An active/standby appliance pair sharing a virtual IP; the standby syncs state and takes over on heartbeat loss, and both share the MCN site configuration.

IPsec virtual path

An encrypted SD-WAN tunnel protecting traffic between sites; firewall zones and ACLs should deny unwanted traffic on the WAN zone by default.

MCN high availability

Deploying the Master Control Node as a redundant pair; without it, branches keep forwarding but cannot receive configuration updates during an MCN outage.

HDX Insight requirement

Citrix ADM analytics for ICA sessions that requires AppFlow on the Gateway and visibility of the ICA stream, achieved through SSL offload or a policy.