Which two policy types can a Citrix Administrator apply to a NetScaler Gateway virtual server so that only users accessing with corporate laptops that belong to the network domain are allowed?…

Lena V.Jun 26, 2026

A and E. Pre-Authentication policy runs endpoint checks before the user ever logs in, so you can block non-domain machines at the door, and Session policy controls what that user can actually do once connected, which is where you lock down access to corp-laptop-only resources.

Luis F.Jun 26, 2026

So I actually picked C at first because Authorization sounds like "who gets in," but that one controls resource access after you're already logged in, not whether your device is even allowed to start the login process. Pre-Authentication (A) is the key one here because it runs an EPA scan before the login page even loads and can check if the machine is domain-joined, so a personal laptop gets blocked right at the door. Session policy (E) works alongside it to enforce those same endpoint conditions as part of the session profile, which is how you tie the EPA results to what the user actually gets access to. The two of them together cover both the "check before login" and "apply the right restrictions during the session" sides of the corporate device requirement, so A and E is the right call.

Orla P.Jun 26, 2026

Responder policy is the move here because you can write expressions that inspect client properties at the point of connection and flat-out reject anything that does not match your domain-joined criteria before the user even gets a login prompt, which is exactly the kind of gate you want on a Gateway vserver. Pair that with Session, which lets you scope the access profile to domain machines specifically, and you have a clean two-policy enforcement chain that handles both the door and the room inside it.