1Y0-231 · Question #163
Scenario: A Citrix Administrator executed the following commands on the Citrix ADC: > add policy dataset Admin_group ipv4 > bind policy dataset Admin_group 192.168.149.10 -index 11 > bind policy…
The correct answer is C. Only users with a source IP address of 192.168.149.10, 192.168.149.39, or 192.168.149.49 will be. Option C is correct because the responder policy uses the logical NOT operator (!) to invert the match condition: !(CLIENT.IP.SRC...CONTAINS_ANY("Admin_group")) evaluates to TRUE for any IP not in the dataset, triggering a RESET on those connections - effectively allowing only…
Question
Scenario: A Citrix Administrator executed the following commands on the Citrix ADC:
add policy dataset Admin_group ipv4 > bind policy dataset Admin_group 192.168.149.10 –index 11 > bind policy dataset Admin_group 192.168.149.39 –index 12 > bind policy dataset Admin_group 192.168.149.49 –index 13 > add responder policy POL_1 “!(CLIENT.IP.SRC.TYPECAST_TEXT_T.CONTAINS_ANY(\”Admin_group\”))”RESET > bind lb vServer lb_vsrv_www –policyName POL_1 –priority 100 –gotoPriorityExpression END – type REQUEST What will be the effect of these commands?
Options
- AOnly users with a source IP address of 192.168.149.10 or 192.168.149.39 will be allowed to
- BAll traffic from users with a source IP address of 192.168.149.10, 192.168.149.39, or
- COnly users with a source IP address of 192.168.149.10, 192.168.149.39, or 192.168.149.49 will be
- DOnly users with a source IP address of 192.168.149.10, 192.168.149.39, or 192.168.149.49 will be
How the community answered
(37 responses)- A11% (4)
- B22% (8)
- C62% (23)
- D5% (2)
Explanation
Option C is correct because the responder policy uses the logical NOT operator (!) to invert the match condition: !(CLIENT.IP.SRC...CONTAINS_ANY("Admin_group")) evaluates to TRUE for any IP not in the dataset, triggering a RESET on those connections - effectively allowing only the three listed Admin_group IPs (.10, .39, .49) to pass through to the lb_vsrv_www virtual server.
Why the distractors fail:
- A is wrong because it omits
192.168.149.49- all three IPs bound to the dataset are protected, not just two. - B is wrong because it inverts the outcome: the three Admin_group IPs are the ones allowed, not the ones reset/blocked.
- D is wrong for the same logical inversion reason as B - the RESET action targets IPs outside the dataset, not inside it.
Memory tip: Think of the ! as a bouncer rule - "RESET anyone who is NOT on the VIP list." The dataset holds the VIPs; everyone else gets kicked out. When you see !(...CONTAINS_ANY(...)) paired with RESET, the IPs inside the dataset are the ones being protected/allowed.
Topics
Community Discussion
No community discussion yet for this question.