1Y0-250 · Question #3
Scenario: An administrator implemented RADIUS with NetScaler Gateway as a two-factor authentication solution for a XenDesktop implementation. A planned outage is scheduled in wake of a software…
The correct answer is D. Unbind the RADIUS authentication policy from the NetScaler Gateway virtual server. See the full explanation below for the reasoning.
Question
Scenario: An administrator implemented RADIUS with NetScaler Gateway as a two-factor authentication solution for a XenDesktop implementation. A planned outage is scheduled in wake of a software upgrade on the RADIUS infrastructure. During the outage, the administrator needs to disable the two-factor authentication on NetScaler Gateway to enable users' continued access to published applications. Which action could the administrator take to meet the needs of the scenario without affecting the connected users?
Options
- ADelete the RADIUS authentication policy.
- BSet the RADIUS policy to be secondary authentication.
- CDisable authentication on the NetScaler Gateway virtual server.
- DUnbind the RADIUS authentication policy from the NetScaler Gateway virtual server.
How the community answered
(60 responses)- A7% (4)
- B17% (10)
- C3% (2)
- D73% (44)
Community Discussion
9
Ingrid P.Mar 23, 2026D is the one to card up. Unbinding the RADIUS policy from the virtual server removes the second factor requirement without touching active sessions or permanently deleting the policy, so you can rebind it cleanly after the upgrade window closes.
Isolde G.Mar 24, 2026Solid move on the unbind, and just worth flagging that if you are running a hybrid resource location with Workspace authentication layered on top, double-check your nFactor flow at the DaaS control plane level too, because a leftover authentication profile there can still prompt for the second factor even after the virtual server unbind goes through.
Wesley A.Mar 8, 2026Thought A would work, but deleting is permanent, unbinding is reversible with zero session impact.
Mei-Ling H.Mar 6, 2026I remember this one tripped me up at first because I saw "disable" in option C and thought that sounded right, but "disable authentication" on the virtual server would lock everyone out completely, not just remove the second factor. On my exam I caught the word "without affecting connected users" and that pointed me to D, unbind the policy, because unbinding removes RADIUS from the login flow without touching the session or the primary auth, so people who are already in stay in and new logins just go through single-factor.
Wesley A.Mar 7, 2026Unbinding is right and "without affecting connected users" is the key phrase, but also worth noting that disabling the policy itself (not the virtual server auth) would have been a closer wrong answer than C since it would still leave existing sessions intact, just misconfigured at the policy level rather than cleanly removed from the bind.
Ola B.Mar 29, 2026Unbinding the policy beats deleting it, saw this exact trap on my exam.
Mei-Ling H.Mar 31, 2026Right, but "beats" undersells it because in AWS you literally cannot delete a managed policy that still has attachments, so the detach step is not just better practice, it is a hard requirement the console enforces before deletion is even available.
Isolde G.Apr 4, 2026Disabling authentication on the Gateway vserver is the cleanest move here because it suspends the auth challenge entirely without touching the policy bindings, so when the RADIUS upgrade is done you just re-enable it and nothing has shifted in your config. Deleting or unbinding the policy risks leaving your session policy logic in a broken state that you have to rebuild, and toggling secondary auth still leaves a primary factor in play, which defeats the point during a full RADIUS outage.
Wesley A.Apr 7, 2026Isolde, that reasoning sounds solid but the exam catches a lot of people there, and disabling auth on the vserver actually tears down active sessions and blocks all users instantly, which is the bigger outage you were trying to avoid. D, disabling the RADIUS authentication server entry itself, keeps the vserver and its policy bindings intact and just pulls that one auth target out of rotation until the upgrade is done.