Scenario: A Citrix Administrator has configured the Citrix ADC as a DNS Proxy Server. The administrator executed the commands in the screenshot on the Citrix ADC using the command- line interface…

Yusuf A.Jan 7, 2026

The answer is C. When the Citrix ADC is configured this way, it generates a brand new DNS response on its own with the TC bit set and rcode NOERROR, rather than just modifying a response that already came back from the upstream DNS server, which is what option A would describe. My senior explained it to me like this: "create" means the ADC is the one crafting that packet from scratch, so the backend server is not involved in what the client receives at that point.

Jovan I.Feb 2, 2026

Jumped straight to A on first read because my brain went to the proxy intercept flow where the ADC is sitting between client and name server and mucking with the response in transit, which is a totally reasonable thing to picture when you hear DNS proxy. But the verb is what kills A, and I had to slow down and look at it again. A says the ADC sets the TC bit in the response FROM the DNS server, meaning it modifies an existing packet the upstream already sent, and that is not what this action type does. C says the ADC CREATES the DNS response, which means the appliance itself originates the reply without ever forwarding to the backend, and that is the actual behavior when you configure a DNS action that synthesizes a truncated response to force the client over to TCP. The ADC is acting as the authoritative responder in that flow, not a middleman tweaking someone else's packet. Once you trace the traffic path correctly, A falls apart and C is the only one that matches what ns.log would actually show you.

Kemal J.Jan 12, 2026

The TC bit lives in responses, not requests, so you can knock out B and D without even looking at the exhibit. The real trap here is A versus C, and it comes down to whether the ADC is intercepting and modifying a response that already came back from the upstream server or whether it is generating a fresh response packet of its own. When the ADC has a DNS action configured to set the TC bit, it constructs and sends its own response to the client with TC set and rcode NOERROR, which tells the client the answer exists but was truncated, so retry over TCP. It is not touching or relaying the upstream server's response at all, which is what makes C the right call and A a convincing decoy for people who skim. Here is what I actually want to know, because I have seen candidates get this right for the wrong reason: do you understand why the ADC would want to force the client onto TCP in the first place, and what upstream behavior or response size condition would typically trigger that action? That changes how you troubleshoot it in production versus just recognizing the answer on paper.

Mateus R.Jan 17, 2026

Think of the ADC here like a forger making a fake letter, not a mail carrier stamping an existing one. When the ADC is configured as a DNS proxy with these action settings, it fabricates a brand new DNS response from scratch with the TC bit set and an rcode of NOERROR, so C is spot on. The TC bit in that crafted response is what tells the client to retry over TCP instead of UDP, which is exactly the behavior you trigger when you create the response rather than just modify one passing through.

Mei-Ling H.Jan 22, 2026

I first picked A because I focused on "DNS Response" and "TC bit" and thought both A and C were basically the same thing, but then I saw the word "Create" in C versus "Set" in A, and that difference matters because the ADC is not modifying a response that came from the DNS server, it is generating its own response with those flags already built in.