1Y0-231 · Question #121
In which order are authentication policies evaluated when a user logs on to Citrix Gateway?
The correct answer is C. Virtual server, global, default. When a user logs on to Citrix Gateway, authentication policies are evaluated in the order: Virtual server → Global → Default. This hierarchy means the most specific binding (the virtual server itself) takes precedence, then falls back to globally-bound policies, and finally to…
Question
In which order are authentication policies evaluated when a user logs on to Citrix Gateway?
Options
- AVPN virtual server, local, load balancing virtual server
- BUnified virtual server, default, local
- CVirtual server, global, default
- DLoad balancing virtual server, default, local
How the community answered
(28 responses)- B4% (1)
- C93% (26)
- D4% (1)
Explanation
When a user logs on to Citrix Gateway, authentication policies are evaluated in the order: Virtual server → Global → Default. This hierarchy means the most specific binding (the virtual server itself) takes precedence, then falls back to globally-bound policies, and finally to the system-level default policy if no match is found earlier.
Why the distractors are wrong:
- A introduces "VPN virtual server" and "load balancing virtual server" as distinct evaluation tiers, which conflates Citrix Gateway concepts with irrelevant load balancing infrastructure.
- B references a "Unified virtual server" - not a real policy evaluation tier in Citrix Gateway's authentication flow.
- D starts with "Load balancing virtual server," which is not part of the Gateway authentication evaluation order at all; load balancing and Gateway authentication operate in separate contexts.
Memory tip: Think of it as a funnel from specific → broad → fallback - "VGD" (Virtual server, Global, Default). The most targeted policy wins first, with each level acting as a safety net for the one before it.
Topics
Community Discussion
4
Brenda K.Jun 20, 2026This one is a quick win, commit the order and move on. The answer is C, virtual server, global, default. Citrix Gateway evaluates authentication policies starting at the most specific binding point first, which is the virtual server level, because policies tied directly to a VPN virtual server are the most targeted and take priority over broader configurations. If no matching policy is found there, it steps out to the global level, where policies apply across all virtual servers, and only if nothing is found globally does it fall through to the default policy. Knowing this hierarchy also protects you on trickier scenario questions that ask why a policy is not being applied, because the answer almost always traces back to a more specific binding overriding a broader one.
Jovan I.Jun 7, 2026The bind hierarchy on Gateway is pretty consistent once you internalize it, most specific scope wins first, so the vServer-level policies fire before global, and global before the default fallback, which is exactly why C is the right pick here. Have you tested what actually happens when you bind conflicting priority numbers at both the vServer and global level, say the same priority 100 at both scopes, and watched ns.log to see which one the engine processes first?
Samuel O.Jun 25, 2026Thought A felt right until I remembered: virtual server first, then global, then default fallback.
Brenda K.Jun 27, 2026Samuel, that order is right for most scenarios, but watch out on timed exams where you can spend 90 seconds second-guessing a question that just needs you to pick and move on.