Scenario: A Citrix Administrator needs to grant read-only access to a select set of NetScaler features. Corporate password security schema must be supported. Which three steps must the administrator…

The correct answer is A. Bind the built-in read-only command policy to required users/groups. C. Create an Authentication Policy for LDAP authentication. E. Create an Authentication LDAP server. You must bind the built-in read-only command policy to the appropriate AD users/groups so they only get read-only rights. You need an LDAP authentication policy (pointing at your corporate AD) so users authenticate with their corporate passwords. Before you can create that…

ADC Platforms

Question

Scenario: A Citrix Administrator needs to grant read-only access to a select set of NetScaler features. Corporate password security schema must be supported. Which three steps must the administrator take to complete this task? (Choose three.)

Options

ABind the built-in read-only command policy to required users/groups.
BCreate a Custom Command Policy.
CCreate an Authentication Policy for LDAP authentication.
DCreate local system accounts that correspond to User Objects in Active Directory.
ECreate an Authentication LDAP server.

How the community answered

(55 responses)

A
71% (39)
B
20% (11)
D
9% (5)

Explanation

You must bind the built-in read-only command policy to the appropriate AD users/groups so they only get read-only rights. You need an LDAP authentication policy (pointing at your corporate AD) so users authenticate with their corporate passwords. Before you can create that policy, you first configure an LDAP server object on the ADC to represent your AD domain.

Topics

#command policy#LDAP authentication#read-only access#system accounts

Community Discussion

Grace U.Jun 19, 2026

The correct answers are A, C, and E, and the key to unlocking this one is the phrase "corporate password security schema," which is the exam's way of telling you that Active Directory and LDAP are in play. You need to first define where NetScaler goes to validate credentials by creating an LDAP server object (E), then wrap that server definition in an authentication policy that tells NetScaler when and how to use it (C). Once authentication is sorted, you do not need to invent a new command policy from scratch because NetScaler ships with a built-in read-only policy that covers exactly this use case, so you simply bind it to the appropriate users or groups (A). B trips people up because "custom command policy" sounds powerful and precise, but creating one is extra work you do not need here since the built-in read-only policy already does the job. D is the other distractor, and it makes intuitive sense until you remember that LDAP authentication lets users log in with their existing domain credentials, so mirroring those users as local accounts is redundant. Once you see that the scenario is really two problems, setting up LDAP authentication and then applying the right access level, the three steps fall into place pretty naturally.

Anjali D.Jun 15, 2026

Our group debated this one hard the week before the exam because two people were convinced you needed to create local accounts (D) to map to AD users, but when I actually saw a scenario like this on the test I remembered that the LDAP server and auth policy handle that identity bridge for you, so you just bind the built-in read-only command policy on top. A, C, and E is the move, and D is the trap they set for anyone who overthought the local account piece.

Dervla O.Jun 18, 2026

The local account trap gets people every time, but worth adding that binding the command policy at the wrong scope is just as common a mistake, so double-check whether the question specifies device-level or group-level application before you lock in that answer.

Dervla O.Jun 26, 2026

Saw almost this exact stem on mine and the phrase "corporate password security schema" was the unlock, because it told me LDAP was in play, which immediately pointed me to needing both the server object and the policy, and once I had C and E locked in, A was the only logical third since the built-in read-only command policy exists precisely so you do not have to build one from scratch. D fell out fast because local accounts do not satisfy the schema requirement, and B fell out because creating a custom command policy is extra work the question never asked for.

Anjali D.Jun 29, 2026

Solid walk-through, and the read-only command policy point is a good catch, though I would add that a lot of people in our group initially tripped on C before E because they assumed the policy object had to come first in implementation order, when really the question is just asking what you need, not what you configure first.

Jovan I.Jun 13, 2026

The built-in read-only command policy is a blunt instrument, it covers everything or nothing, so the moment the scenario says "a select set of features" you have to throw A out and reach for B. A custom command policy is the only way to scope the permitted commands down to exactly the surfaces you want exposed, full stop. Pair that with C and E because "corporate password security schema" is exam-speak for external authentication, and you cannot bind an LDAP authentication policy without first defining the LDAP server object to point at. So my three are B, C, and E. D trips people up because you do not need local accounts when the whole point of external auth is that Active Directory owns the credential store, the appliance just validates against it.

-2

Dervla O.Jun 13, 2026

Jovan, the read-only command policy does exactly what the stem asks because it restricts access to a defined set of read-only commands, which is the scoping mechanism here, not blanket coverage. You swap B for A because the policy itself handles the "select features" requirement, and C and E remain correct since you still need the LDAP server object defined before you can bind the authentication policy to it.

Full 1Y0-241 Practice