I85PREP
⌘ K
Citrix CCE-N study materials
Citrix CCE-N study resources

Citrix CCE-N: Citrix ADC Security and Authentication

Citrix CCE-N · Work through your exam, one topic at a time.

All guide sections

Citrix ADC Security and Authentication

This domain tests TLS hardening, AAA and nFactor authentication, authorization, and application protection. Expect questions that combine a business requirement, such as two-factor login or regulatory TLS, with the exact ADC objects needed to satisfy it.

TLS and certificates

  • SSL profiles control protocol versions, cipher groups, and TLS 1.3 behavior. Bind a modern profile rather than relying on defaults.
  • The server certificate must include the full intermediate chain in the correct order; a missing intermediate breaks some clients even though the browser may cache it.
  • OCSP stapling, HSTS, and secure renegotiation are profile-level settings. Front-end and back-end SSL profiles are configured separately.

AAA and nFactor

  • Authentication vservers host authentication policies and actions. Actions include LDAP, RADIUS, SAML, OAuth, and client certificate.
  • nFactor chains factors using policy labels and next-factor links; the login schema for each step must match the factor type.
  • Group extraction from LDAP feeds authorization and session policies. Bind the authentication vserver to the Gateway or traffic vserver that needs it.

Application security

  • AppFW profiles apply signatures, positive security, and learned rules. Learning must be reviewed and transitions to blocking deliberately.
  • Bot management, IP reputation, and rate limiting address abuse that signatures miss.
  • Admin RBAC and partitions limit operator scope; command policies control which commands a role can run.

Worked example

A Gateway must require LDAP password plus RADIUS OTP. Create an LDAP action and a RADIUS action, build a first-factor policy label with the LDAP action and a single-factor login schema, then a next-factor policy label with the RADIUS action. Bind the authentication vserver to the Gateway vserver and enable group extraction. Reasoning: nFactor is a chain of policy labels, not two policies on one vserver; binding the auth vserver to the Gateway is what activates the flow.

Traps that cost marks

  • Incomplete certificate chains and wrong certificate-key pairing.
  • Confusing authentication policies with authorization or traffic policies.
  • Using a login schema that does not match the factor, which produces blank or skipped prompts.
  • Leaving AppFW in learning mode and assuming it is blocking.
  • Breaking SAML by mismatching assertion consumer URL or signing certificate.