I85PREP
⌘ K
Citrix CCP-V study materials
Citrix CCP-V study resources

Citrix CCP-V practice questions

One question at a time. Build your Citrix CCP-V understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1User state, profile containers, application layers and resource tuning

Which Citrix App Layering component manages layer storage, the management console, and the layer-merge logic?

  1. Citrix Director
  2. Enterprise Layer Manager (ELM) appliance Correct answer.
  3. Workspace Environment Management Broker
  4. Federated Authentication Service

Explanation

The Enterprise Layer Manager (ELM) is the App Layering virtual appliance that hosts the management console, the layer repository, and the connectors that publish layered images to hypervisors and provisioning systems.

Question 2User state, profile containers, application layers and resource tuning

How many OS Layers should an organization typically build per Windows operating system in App Layering?

  1. One per business unit
  2. One per OS edition/architecture (e.g., Windows 10 64-bit, Server 2019) Correct answer.
  3. One per application installed
  4. One per User Layer

Explanation

Citrix's recommendation is one OS Layer per unique OS edition/build/architecture. The same OS Layer can serve many Platform and App Layer combinations - so one Windows 10 64-bit OS Layer typically supports your entire Windows 10 estate.

Question 3User state, profile containers, application layers and resource tuning

Why is a Platform Layer required when deploying App Layering images to Citrix Virtual Apps and Desktops with Provisioning Services as the delivery technology?

  1. To install Microsoft Office
  2. To install the Citrix VDA and the PVS Target Device software, plus any hypervisor tools, so the layered image runs correctly on the target platform Correct answer.
  3. To store user profile data
  4. To replace the OS Layer for that platform

Explanation

Platform Layers contain the bits that depend on the eventual delivery platform - the Citrix VDA, PVS Target Device software, hypervisor tools (VMware Tools, Citrix VM Tools), and any platform-specific drivers. Building separate Platform Layers per platform lets the same OS and App Layers be reused across MCS, PVS, and Citrix Cloud deployments.

Question 4User state, profile containers, application layers and resource tuning

Which App Layering object is created on a temporary 'packaging machine' and includes the installed application files and registry?

  1. Image Template
  2. App Layer Correct answer.
  3. User Layer
  4. Platform Layer

Explanation

An App Layer is built by spinning up a packaging machine that contains the OS Layer (and any prerequisite layers), installing the application, then capturing the changes back into ELM as a new App Layer disk that can be combined into image templates.

Question 5User state, profile containers, application layers and resource tuning

How are Elastic Layers attached to a user session?

  1. At image build time, baked into the layered image
  2. At user logon by the App Layering agent on the VDA, based on AD user/group assignment Correct answer.
  3. Manually by the user from the Workspace UI
  4. Only when the VDA reboots

Explanation

Elastic Layers are attached on demand at user logon. The App Layering agent on the VDA reads the user's AD groups, fetches the assigned Elastic Layer VHDs from the file share, and mounts them inside the session. This avoids baking every app into the master image and lets app delivery follow the user.

Question 6User state, profile containers, application layers and resource tuning

Which statement about Full User Layers is TRUE?

  1. They store only Outlook OST and OneDrive cache
  2. They persist a user's installed applications, profile, and document changes to a per-user VHDX on a file share, so a non-persistent VDA appears persistent to the user Correct answer.
  3. They are required for any FSLogix deployment
  4. They replace the need for the OS Layer

Explanation

A Full User Layer mounts a per-user VHDX at logon that captures everything written to the user's profile and locally installed apps. Combined with a non-persistent layered image, it gives the look-and-feel of a persistent desktop without persisting any single VM. Office and Outlook variants restrict scope.

Question 7User state, profile containers, application layers and resource tuning

Which App Layering Connector type would you configure to publish layered images directly to a vSphere environment?

  1. Hyper-V Connector
  2. vSphere Connector Correct answer.
  3. AHV Connector
  4. AWS EC2 Connector

Explanation

App Layering ships connectors per hypervisor and cloud platform. The vSphere Connector is configured with vCenter credentials, datastore, and network settings so ELM can publish a finished layered image as a VM template (or VMs) directly into vSphere.

Question 8User state, profile containers, application layers and resource tuning

An administrator needs to publish a single layered image with three different application sets for three departments. What is the best approach?

  1. Build three separate OS Layers
  2. Build one OS Layer and one Platform Layer, then create three Image Templates that combine the same OS+Platform with different App Layers Correct answer.
  3. Create three separate ELM appliances
  4. Use Elastic Layers for everything and skip Image Templates

Explanation

Image Templates are the recipe that combines OS, Platform, and App Layers into a publishable image. Reusing one OS Layer and one Platform Layer across three Image Templates with different App Layer selections minimizes maintenance and gives each department a tailored image.

Question 9User state, profile containers, application layers and resource tuning

How does Layer Priority influence the boot of a layered image when two App Layers contain different versions of the same DLL?

  1. The OS Layer's DLL always wins
  2. The App Layer with the higher priority overrides the lower-priority App Layer; the OS Layer is overridden by both Correct answer.
  3. The image fails to boot due to the conflict
  4. The VDA picks the DLL alphabetically by layer name

Explanation

App Layering composes layers in order of priority. When two layers carry the same file or registry value, the higher-priority layer wins. App Layers always override the OS Layer, and Elastic/User Layers can override App Layers depending on configuration.

Question 10User state, profile containers, application layers and resource tuning

What is the function of the App Layering 'packaging machine' in App Layer creation?

  1. A long-running production VDA where users install apps
  2. A short-lived VM built by ELM that includes the OS Layer and prerequisite layers, on which the administrator installs and finalizes a single app set before shutting down for capture Correct answer.
  3. The ELM appliance itself
  4. An additional Cloud Connector

Explanation

When you create an App Layer, ELM spins up a temporary packaging VM running the OS Layer (and any prerequisite layers). The administrator installs the application there, runs first-launch wizards, then shuts down. ELM captures the diff into the new App Layer and discards the packaging VM.

Question 11User state, profile containers, application layers and resource tuning

When publishing a layered image from ELM, what does an Image Template define?

  1. The list of users entitled to the image
  2. The recipe of OS, Platform, and App Layers to combine, plus the connector and target hypervisor settings Correct answer.
  3. The Citrix licensing information
  4. The VDA registration ports

Explanation

An Image Template names the OS Layer, the Platform Layer, the App Layers (with priority), Elastic-layer assignments, and the connector/target storage to publish the resulting layered image to. Editing the template lets you re-publish updated images without recreating the build.

Question 12User state, profile containers, application layers and resource tuning

What must the App Layering Platform Layer for 'CVAD with PVS' include in addition to the Citrix VDA?

  1. Microsoft Exchange management tools
  2. PVS Target Device software so the published image can boot via PVS streaming Correct answer.
  3. FSLogix Apps installer (mandatory)
  4. Citrix Gateway plug-in

Explanation

Because the published image will be streamed by PVS, the Platform Layer for that delivery technology must include both the VDA and the PVS Target Device software so the resulting image is bootable via PVS. For 'CVAD with MCS' you would only include the VDA and hypervisor tools.

Question 13User state, profile containers, application layers and resource tuning

Which option correctly describes 'How does Layer Priority affect the boot process' in App Layering?

  1. Layer priority is ignored at boot
  2. At boot, the App Layering minifilter driver composes the unified file system in priority order so higher-priority layers' files win when the same path is present in multiple layers Correct answer.
  3. Layer priority only affects user logon, not boot
  4. Higher-priority layers are unmounted at boot

Explanation

App Layering uses a minifilter driver that composites layers into a single virtual file system at boot. When the same path exists in multiple layers, the layer with the higher configured priority wins. This is how administrators ensure a critical app's DLL overrides another app's older DLL.

Question 14User state, profile containers, application layers and resource tuning

When updating an App Layer with a new application version, what is the recommended workflow?

  1. Edit the existing App Layer disk in place using DiskPart
  2. Create a new VERSION of the existing App Layer using ELM, install the update on the packaging machine, finalize, then promote the new version into the Image Templates Correct answer.
  3. Delete the App Layer and rebuild from scratch
  4. Roll back to the OS Layer and reinstall

Explanation

App Layer versioning lets you create a new version of the existing layer, install/upgrade on the packaging machine, finalize, then promote the new version. Image Templates can be re-published to roll the new version out to layered images, and old versions remain for rollback.

Question 15User state, profile containers, application layers and resource tuning

What is the purpose of an OS Layer 'Gold VM' in App Layering preparation?

  1. A VM that runs production users
  2. A clean Windows VM, fully patched and prepared per Citrix's OS Layer recipe (no domain join, no apps, optimized), used to capture the initial OS Layer in ELM Correct answer.
  3. A backup target for layered images
  4. A VM that hosts the ELM appliance

Explanation

The Gold VM is a prepared, clean Windows installation (typically: fully patched, optimized with Citrix Optimizer, with hypervisor tools, NOT joined to AD, no apps) that ELM uses to capture the OS Layer. Citrix publishes prep recipes for each Windows version and major build.

Question 16User state, profile containers, application layers and resource tuning

What does the App Layering Connector require that allows ELM to publish layered images to the chosen target platform?

  1. A Citrix Cloud entitlement key
  2. Service-account credentials and network access to the target platform (e.g., vCenter for vSphere, Prism for AHV, Azure SP/Managed Identity for Azure) plus storage and network references Correct answer.
  3. A SQL Server Express install
  4. A second ELM appliance

Explanation

Each Connector type (vSphere, Hyper-V, AHV, Azure, AWS, GCP, MCS, PVS) is configured with credentials for the target platform (vCenter, Prism, ARM service principal/Managed Identity, etc.) plus the storage and network where layered images should be created. ELM uses these to publish without manual export/import.

Question 17Virtual application delivery and component responsibility

What is the primary purpose of FMA zones in a Citrix Virtual Apps and Desktops 7 site?

  1. To replace the need for a Site Database in remote offices
  2. To group resource locations so that user sessions, VDAs, and infrastructure stay close together for performance Correct answer.
  3. To create separate Active Directory forests for each office
  4. To enforce per-zone licensing in Citrix Studio

Explanation

FMA (FlexCast Management Architecture) zones group Delivery Controllers, VDAs, hypervisor connections, and StoreFront servers by physical location. The goal is to keep brokering, hosting communication, and HDX traffic local to each site so users connect to VDAs near them and WAN latency between Controllers and the Site Database is minimized.

Question 18Virtual application delivery and component responsibility

Which statement about the Primary Zone in a multi-zone CVAD 7 site is TRUE?

  1. Each zone hosts its own copy of the Site Database
  2. The Primary Zone hosts the Site Database; satellite zones connect to it across the WAN Correct answer.
  3. The Primary Zone is optional and only created when satellite zones exist
  4. Cloud Connectors replace the Primary Zone in Citrix DaaS

Explanation

Every CVAD on-premises site has exactly one Primary Zone, which hosts the SQL Site Database. Satellite zones contain Delivery Controllers and VDAs but reach back to the database in the Primary Zone. WAN latency between satellites and the Primary Zone Site Database is a key design constraint that influences whether to create a satellite zone at all.

Question 19Virtual application delivery and component responsibility

An architect is deciding whether to deploy a satellite zone for a branch office. Which condition most strongly justifies a satellite zone?

  1. The branch has fewer than 50 users and good WAN connectivity
  2. The branch hosts dedicated VDAs and the WAN to the Primary Zone has high but stable latency Correct answer.
  3. The branch users only consume published applications, never desktops
  4. The branch has its own Active Directory site name

Explanation

Satellite zones make sense when there are local VDAs serving local users and the WAN to the Primary Zone has notable latency, because zone preference can keep brokering, registration, and user connections inside the zone. A zone is overkill if there are no local VDAs or if WAN latency is negligible.

Question 20Virtual application delivery and component responsibility

In a multi-zone CVAD site, what is the default zone preference order used by the broker when launching a session?

  1. Failover zone, then Application Home zone, then User Home zone
  2. User Home zone, then Application Home zone, then Failover zones
  3. Application Home zone, then User Home zone, then Failover zones Correct answer.
  4. Round-robin across all zones with healthy VDAs

Explanation

By default, the broker prefers the Application Home zone first (because the catalog/desktop group is anchored there), then the User Home zone (set on the AD user object), then any Failover zones. Administrators can override this order with PowerShell Set-BrokerApplication or Set-BrokerEntitlementPolicyRule using the PreferredZone parameter.

Question 21Virtual application delivery and component responsibility

A VDA in a satellite zone loses connectivity to all Delivery Controllers in its local zone but can still reach Controllers in the Primary Zone. What happens to the VDA's registration?

  1. The VDA stays unregistered until its local Controllers come back
  2. The VDA registers with a Controller in the Primary Zone (failover registration) until local Controllers are reachable again Correct answer.
  3. The VDA enters a 'pending' state and waits for manual reset
  4. The VDA boots into Local Host Cache mode and serves cached sessions

Explanation

VDAs prefer Delivery Controllers in their own zone, but if no local Controllers are reachable they will register with any Controller they can find in another zone (failover registration). When the local Controllers return, the VDA re-registers locally on its next refresh cycle.

Question 22Virtual application delivery and component responsibility

Which PowerShell cmdlet would you use to assign a Citrix policy that forces a specific Delivery Group to prefer a particular zone?

  1. Set-BrokerMachine -PreferredZone
  2. Set-BrokerEntitlementPolicyRule -PreferredZone Correct answer.
  3. New-BrokerHypervisorConnection -ZoneUid
  4. Set-ConfigZone -PreferredZone

Explanation

Zone preference for desktop entitlements is set with Set-BrokerEntitlementPolicyRule -PreferredZone. For published applications you use Set-BrokerApplication -HomeZoneName. These cmdlets override the default zone preference order for the specified resource.

Question 23Virtual application delivery and component responsibility

A user moves from headquarters (Zone A) to a branch (Zone B) for a project. To make sessions launch on VDAs in Zone B for that user, what is the most appropriate change?

  1. Change the user's UPN suffix in Active Directory
  2. Set the user's Home zone to Zone B using Set-BrokerUser -HomeZoneName Correct answer.
  3. Move the published application's Home zone to Zone B with Set-BrokerApplication
  4. Recreate the user account in the Zone B OU

Explanation

A user's Home zone is stored in the broker (not AD) and can be set with Set-BrokerUser -HomeZoneName. Once set, the broker will prefer VDAs in that zone for the user when default zone preference rules apply. This keeps published-app Home zones unchanged for everyone else.

Question 24Virtual application delivery and component responsibility

An administrator needs failover registration so satellite-zone VDAs register with Primary-zone Controllers when local Controllers go offline. What configuration step is required?

  1. Disable the satellite zone in Studio
  2. Make sure the VDA's ListOfDDCs (or AD discovery) includes Controllers from BOTH the local zone and the Primary/failover zone, in priority order Correct answer.
  3. Move the Site Database to the satellite zone
  4. Promote the satellite zone to Primary

Explanation

VDAs registration discovery uses ListOfDDCs (registry/policy) or AD-based discovery. Listing local-zone Controllers first and Primary/failover-zone Controllers second gives the VDA a fallback target list. The broker still applies zone preference to user sessions, so failover is transparent and self-healing.

Question 25Virtual application delivery and component responsibility

Which design factor most influences whether a single CVAD site can stretch across two datacenters versus deploying two sites with active/passive DR?

  1. Number of published applications
  2. WAN latency and reliability between the datacenters and the Site Database, since FMA components require sub-100ms latency to the SQL DB and chatty interactions Correct answer.
  3. Workspace App version
  4. Number of users with smart cards

Explanation

Citrix's design guidance is that all FMA components (Controllers, StoreFront, hosting connections) must have low, stable latency to the Site Database - typically well under 100 ms. If WAN latency between datacenters is high, you should deploy two separate sites and use StoreFront multi-site aggregation plus Citrix Cloud or external DNS-based failover instead of stretching one site.

Question 26Virtual application delivery and component responsibility

What is the recommended way to document and re-apply Citrix policies as code in a multi-zone CVAD environment?

  1. Manually screenshot each policy
  2. Export Citrix policies to .gpo or use the Citrix Group Policy Management add-in, store them in version control, and import into Test/Prod zones via PowerShell so zones share consistent policy baselines Correct answer.
  3. Re-create policies from memory in each zone
  4. Disable Citrix policies and rely on GPOs alone

Explanation

Citrix policies (Studio policies and the GPO-based Citrix Group Policy Management add-in) can be exported and imported. Storing exports in source control and applying them to non-prod and prod zones via the Citrix Group Policy PowerShell module gives a repeatable, auditable policy baseline across multi-zone sites - close to 'policy as code'.

Question 27Virtual application delivery and component responsibility

Which StoreFront feature aggregates resources from multiple CVAD sites into a single user-visible list and allows the same app from different sites to appear once?

  1. Subscription store synchronization
  2. Multi-site aggregation Correct answer.
  3. Optimal Gateway Routing
  4. Beacons

Explanation

Multi-site aggregation (configured via the StoreFront 'Manage Delivery Controllers > Configure' dialog and equivalent settings in the configuration file) lets a store enumerate resources from several CVAD sites and de-duplicate the same app/desktop across them, so users see a single icon and the broker chooses which site to launch on.

Question 28Virtual application delivery and component responsibility

Which command propagates a configuration change from one StoreFront server to all other servers in the same Server Group?

  1. Publish-STFConfiguration Correct answer.
  2. Sync-STFServer
  3. Push-STFConfiguration
  4. Propagate-CtxStoreFront

Explanation

After making changes on the 'change base' StoreFront server, you run Publish-STFConfiguration in the Citrix.StoreFront PowerShell module (or click 'Propagate Changes' in the console) to push the configuration to all other servers in the group. Other servers must be online and accessible during propagation.

Question 29Virtual application delivery and component responsibility

A StoreFront subscription store needs to scale to 1000 users with high availability across 3 StoreFront servers. Which database approach is appropriate?

  1. SQL Express LocalDB on each server with no replication
  2. Built-in Subscription Store Service replication between servers in the group Correct answer.
  3. Move the Subscription store to a clustered SQL Server
  4. Disable subscriptions and use mandatory shortcuts only

Explanation

StoreFront's Subscription Store Service (powered by an embedded database) replicates favorites between every server in the group automatically. For 1000 users this scale is well within its limits, so no external SQL is required. Replication runs over TCP 808 and is configured by joining the server group.

Question 30Virtual application delivery and component responsibility

What is the role of beacons in StoreFront / Citrix Workspace App?

  1. They authenticate users with TOTP one-time passwords
  2. They are URLs Workspace App probes to detect whether the device is on the internal or external network Correct answer.
  3. They synchronize subscription favorites between StoreFront servers
  4. They are encryption keys used by SecureICA

Explanation

Beacons are HTTP/HTTPS URLs configured in StoreFront. Workspace App probes the internal beacon (typically the StoreFront URL) and the external beacons (typically Citrix.com). If the internal beacon is reachable, the device is treated as on-premises and traffic goes direct; otherwise it is routed via Citrix Gateway.

Question 31Virtual application delivery and component responsibility

Which legacy URL must remain enabled on a StoreFront store to support older Citrix Receiver clients and PNAgent enumeration?

  1. Citrix Web Interface URL
  2. XenApp Services URL (PNAgent Services) Correct answer.
  3. Workspace Hub URL
  4. ICA-over-WebSocket URL

Explanation

The XenApp Services URL (also known as the PNAgent Services site) is the legacy enumeration endpoint at /Citrix/<Store>/PNAgent. Older Receiver clients, thin clients, and some integrations still use it. Modern Workspace App uses the Receiver for Web/Workspace API instead.

Question 32Virtual application delivery and component responsibility

An administrator wants to brand the StoreFront Receiver for Web site with a custom logo and color scheme. Which approach is supported?

  1. Edit the IIS web.config to inject custom CSS
  2. Use the StoreFront 'Customize Appearance' settings and the documented custom skin folders under C:\inetpub\wwwroot\Citrix\<Store>Web\custom Correct answer.
  3. Recompile the StoreFront source code
  4. Replace the default theme in HKLM\Software\Citrix\StoreFront

Explanation

StoreFront supports customization via the 'Customize Appearance' GUI for simple changes (logo, background) and via the documented custom folder (style.css, script.js, strings.en.json) under the Receiver for Web site for deeper changes. These customizations survive upgrades.

Question 33Virtual application delivery and component responsibility

Which Optimal Gateway Routing scenario does StoreFront most directly solve?

  1. Picking the closest StoreFront server for a user
  2. Selecting the appropriate Citrix Gateway to use for the HDX launch based on the user's location and resource zone Correct answer.
  3. Routing PVS streaming traffic between subnets
  4. Choosing a Cloud Connector for VDA registration

Explanation

Optimal Gateway Routing (OGR) configures StoreFront so that, when launching a published resource, the .ica file references the Citrix Gateway nearest the resource's zone rather than the gateway the user authenticated through. This prevents 'hairpin' traffic across the WAN.

Question 34Virtual application delivery and component responsibility

Which StoreFront subscription synchronization scenario REQUIRES configuring a 'Subscription Synchronization' schedule between server groups?

  1. Two StoreFront servers in the same server group
  2. Two StoreFront server groups in separate datacenters where users may authenticate to either group and need their favorites visible from both Correct answer.
  3. A single StoreFront server in a lab
  4. Workspace App installed on a Mac client

Explanation

Servers within a single group replicate subscriptions automatically. To roam favorites across two SEPARATE server groups (typical in geographically split active/active StoreFront deployments), you must configure subscription synchronization with a schedule and credentials so each group periodically pulls from the other.

Question 35Machine catalogs, delivery groups and controlled image updates

What is the Boot Device Manager (BDM) in Citrix Provisioning?

  1. A driver that injects PVS Target Device software at the OS install phase
  2. A method to boot PVS Target Devices using a small ISO or VHD partition instead of PXE/TFTP Correct answer.
  3. A backup tool for the PVS database
  4. A management console replacement for the PVS Console

Explanation

BDM provides an alternative to PXE/TFTP for PVS Target Device boot. BDM creates either a small ISO file or a hard-disk partition that contains the PVS bootstrap; the Target Device boots from BDM, contacts the PVS server, and streams the vDisk. BDM removes the need to configure DHCP options 66/67 and TFTP infrastructure.

Question 36Machine catalogs, delivery groups and controlled image updates

Which BDM deployment option avoids any reliance on a removable ISO file and survives storage migration of the VM?

  1. BDM ISO mounted via the hypervisor CD drive
  2. BDM partition written directly to the Target Device's local hard disk Correct answer.
  3. PXE boot with options 66/67
  4. Wake-on-LAN with magic packet bootstrap

Explanation

The BDM partition option writes the bootstrap to a small partition on the Target Device's local disk so the VM boots from its own disk and reaches PVS without an ISO. This removes the dependency on an ISO datastore and works through storage vMotion / live migration.

Question 37Machine catalogs, delivery groups and controlled image updates

What is the recommended PVS write cache mode for non-persistent Target Devices in production?

  1. Cache on server
  2. Cache on device hard disk
  3. Cache in device RAM with overflow on hard disk Correct answer.
  4. Cache on server persistent

Explanation

'Cache in device RAM with overflow on hard disk' is the Citrix-recommended mode. Writes go first to a fast RAM cache; once the RAM cache is exhausted, additional writes overflow to the local disk's vdiskdif.vhdx file. This delivers near-RAM performance without risking cache exhaustion crashes.

Question 38Machine catalogs, delivery groups and controlled image updates

How do you determine the correct RAM cache size to allocate to a PVS Target Device?

  1. Always allocate 256 MB regardless of workload
  2. Size based on observed daily write volume of a representative workload, with headroom; commonly 256 MB-2 GB for desktops Correct answer.
  3. Match the size of the vDisk
  4. Use 50% of the VM's total RAM

Explanation

RAM cache should be sized to hold typical daily write churn so that overflow to disk is rare. Citrix guidance is to test a representative session and allocate cache equal to or slightly larger than that figure; 256 MB-2 GB is a common starting range for shared desktops, more for power users.

Question 39Machine catalogs, delivery groups and controlled image updates

An administrator needs to update an existing vDisk with new applications while the production vDisk continues to serve users. What workflow is correct?

  1. Edit the production vDisk directly while it streams to Target Devices
  2. Create a new vDisk version in Maintenance mode, boot a maintenance Target Device, install changes, then promote the version to Test then Production Correct answer.
  3. Export the vDisk, edit on a workstation, and reimport
  4. Delete the vDisk and reimage from scratch

Explanation

PVS supports versioning. You add a new Maintenance version of the vDisk, boot a designated maintenance device that loads that version read-write, install or update applications, shut down to seal the version, then promote it to Test for piloting and finally Production for general use. Older versions remain for rollback.

Question 40Machine catalogs, delivery groups and controlled image updates

What is Reverse Imaging in Citrix Provisioning Services used for?

  1. Cloning a vDisk to a different storage location
  2. Converting a vDisk back to a physical or virtual machine's local disk so the OS can be patched offline using standard tools Correct answer.
  3. Reversing the byte order of a vDisk to support big-endian SANs
  4. Encrypting a vDisk so it can only boot on approved hardware

Explanation

Reverse Imaging takes a PVS vDisk and writes it back onto a machine's local disk (the master target). After this you can boot that machine from local disk, apply major OS upgrades, driver changes, or in-place repairs that are not safe inside vDisk Maintenance mode, then re-image back to a new vDisk.

Question 41Machine catalogs, delivery groups and controlled image updates

Which is a valid statement about Citrix Provisioning console farm management?

  1. Each PVS Console can manage only one PVS Server
  2. The PVS Console connects to the PVS database via a chosen PVS Server and can manage all servers, sites, stores, vDisks, device collections, and farms registered there Correct answer.
  3. PVS Consoles are read-only by design
  4. PVS Consoles must be installed on Delivery Controllers

Explanation

The PVS Console connects to the PVS SQL database via any PVS server in the farm and provides full read/write management of the entire farm: servers, sites, stores, vDisks, device collections, and per-server settings.

Question 42Machine catalogs, delivery groups and controlled image updates

An administrator wants to test a new vDisk version with a small group of pilot users before promoting to production. Which PVS feature supports this?

  1. Maintenance mode only
  2. Test class on the vDisk version, with select Target Devices set to access mode 'Test' Correct answer.
  3. Replicating vDisks across stores
  4. Reverse imaging

Explanation

PVS vDisk versions can be marked as Maintenance, Test, or Production. By promoting a version to Test and assigning specific Target Devices to use the Test access mode, only those pilot devices boot the new version. Production users continue on the previous Production version.

Question 43Identity, access and cryptographic protection

What is the role of Federated Authentication Service (FAS) in a SAML/ADFS-integrated Citrix deployment?

  1. FAS issues domain user passwords on demand
  2. FAS uses an enterprise CA to issue short-lived user certificates so SAML-authenticated users get true Single Sign-On into HDX sessions without re-entering AD credentials Correct answer.
  3. FAS replaces Active Directory
  4. FAS manages StoreFront subscriptions

Explanation

In the supported design described, FAS can obtain user certificates through the configured certificate-authority integration to support federated session logon. It does not replace the directory or issue ordinary user passwords. Other supported authentication designs can differ; a federated portal sign-in alone does not establish every Windows-session logon dependency.

Question 44Identity, access and cryptographic protection

FAS requires which AD/PKI component to issue user certificates?

  1. A public certificate authority such as DigiCert
  2. An on-premises Microsoft Enterprise Certificate Authority that publishes the FAS-required certificate templates Correct answer.
  3. An Azure AD-only setup with no on-premises CA
  4. An LDAP server with self-signed certificates

Explanation

FAS requires an on-premises Microsoft Enterprise CA. Citrix provides the Citrix_RegistrationAuthority and Citrix_SmartcardLogon (or equivalent) certificate templates, which the CA must publish. FAS submits CSRs to this CA and uses the resulting short-lived user certs for VDA logon.

Question 45Identity, access and cryptographic protection

Which authentication method on Citrix Gateway uses a shared secret and one-time password sent over UDP/1812?

  1. LDAP/LDAPS
  2. RADIUS Correct answer.
  3. SAML
  4. Kerberos

Explanation

RADIUS authentication on Citrix Gateway uses UDP 1812 (auth) and UDP 1813 (accounting) with a shared secret to talk to OTP/MFA back ends like Azure MFA NPS extension, Duo Authentication Proxy, or RSA Authentication Manager. It is the typical transport for OTP factors in Citrix.

Question 46Identity, access and cryptographic protection

On Citrix Gateway integrated with StoreFront, what does SmartAccess do?

  1. Encrypts the ICA stream end-to-end
  2. Inspects the user's endpoint posture (EPA scan) and passes session policy attributes to StoreFront/CVAD so policies (e.g., disable client drive mapping) can be applied based on access conditions Correct answer.
  3. Acts as a load balancer for StoreFront
  4. Replaces StoreFront's beacons

Explanation

SmartAccess uses Citrix Gateway endpoint-analysis policies plus session policies to decide a 'tag' to send to StoreFront. CVAD/StoreFront then applies Citrix policies that filter on those tags - for example, blocking client drive mapping or printing for sessions launched from non-corporate endpoints.

Question 47Identity, access and cryptographic protection

Which Citrix Gateway/StoreFront pattern is required for HDX traffic to flow through Citrix Gateway after authentication?

  1. ICA proxy mode (StoreFront callback URL configured to point at the Gateway) Correct answer.
  2. Direct HDX bypassing the Gateway
  3. VPN full tunnel only
  4. DNS round-robin

Explanation

ICA proxy is the mode where Citrix Gateway proxies the ICA/HDX traffic. StoreFront must have the Gateway configured with the right callback URL so generated .ica files contain the Gateway address and STA tickets, allowing the Workspace App to tunnel HDX through Gateway.

Question 48Identity, access and cryptographic protection

Which authentication setting on the Citrix Gateway virtual server is needed to support smart card logon end-to-end?

  1. LDAP only with no client certs
  2. A certificate authentication policy bound to the vServer, with the corporate root/intermediate CA installed and 'Client Authentication' enabled (mandatory) on the SSL parameters Correct answer.
  3. RADIUS with PAP
  4. SAML with HTTP-only cookies

Explanation

Smart card logon at the Gateway requires a certificate authentication policy bound to the vServer, with the issuing CA chain installed and Client Authentication enabled (Mandatory) in the SSL parameters so the SSL handshake requests and validates the user's client cert. Combine with FAS for SSO into HDX.

Question 49Identity, access and cryptographic protection

Which workflow correctly enables SAML SSO from an external IdP all the way through to the HDX session?

  1. StoreFront uses LDAP only; FAS is not needed
  2. Citrix Gateway authenticates the user via SAML to the IdP, passes the SAML assertion to StoreFront, StoreFront calls FAS to obtain a user certificate, and the VDA logs the user on with that certificate (true SSO) Correct answer.
  3. Citrix Gateway uses RADIUS, then StoreFront uses Kerberos directly
  4. The VDA contacts the IdP directly via SAML

Explanation

The supported pattern: Citrix Gateway is configured with a SAML auth policy pointing at the external IdP; once the user authenticates, the Gateway passes the assertion to StoreFront. StoreFront uses FAS (Federated Authentication Service) to obtain a short-lived user certificate from the on-prem CA and presents it to the VDA, which logs the user on without prompting for AD password.

Question 50Identity, access and cryptographic protection

An administrator deploys FAS in two datacenters for HA and finds users intermittently get prompted for AD credentials at HDX launch. What is the most likely cause?

  1. FAS only works on weekdays
  2. Not all FAS servers in the GPO list have the same FAS rules / certificate templates configured, so some VDA logon attempts route to an unconfigured FAS server Correct answer.
  3. RADIUS is misconfigured
  4. The Workspace App is too new

Explanation

FAS HA depends on every FAS server having identical rules and access to the same enterprise CA templates. If one of the FAS servers in the GPO is misconfigured (no rules, no template access, untrusted), VDAs that pick that FAS for a given launch will fail to obtain a certificate and fall back to a credential prompt.