Scenario: A Citrix Administrator suspects an attack on a load-balancing virtual server (IP address 192.168.100.25). The administrator needs to restrict access to this virtual server for 10 minutes…

Question

Options

• Aadd ns acl rule1 DENY -destIP 192.168.100.25 -TTL 600000
• Badd simpleacl rule1 DENY -srcIP 192.168.100.25 -TTL 600000
• Cadd ns acl rule1 DENY -destIP 192.168.100.25 -TTL 600
• Dadd simpleacl rule1 DENY -srcIP 192.168.100.25 -TTL 600

• B
  9% (3)
• C
  6% (2)
• D
  84% (27)

Explanation

Option D is correct because simpleacl is the appropriate ACL type for a quick, temporary block - it takes effect immediately without requiring a separate apply ns acls command, and the TTL of 600 represents 600 seconds (exactly 10 minutes), which matches the requirement.

Why the others are wrong:

• A fails on two counts: ns acl (extended ACL) requires an explicit apply ns acls command before it takes effect, and 600000 seconds equals nearly 7 days - far longer than 10 minutes.
• B uses the correct simpleacl type but specifies TTL 600000, which is the same wrong duration as A.
• C gets the TTL right (600 seconds) but uses ns acl, which requires the apply step and is unnecessarily complex for a quick temporary block.

Memory tip: Think "Simple = Seconds, Simple = Speedy" - simpleacl measures TTL in seconds (600s = 10 min) and goes live immediately, while ns acl needs an apply command. When you need a fast, temporary block, reach for simpleacl.

No community discussion yet for this question.