Scenario: An administrator plans to implement NetScaler to load balance Web Interface traffic. The Web Interface servers are using standard non-secure ports. Company policy states that all external…

Grace U.Jun 27, 2026

The correct answer is C, HTTP services with an SSL virtual server, and once you see the logic it really does click into place. The services in NetScaler describe how the appliance talks to your backend servers, and since those Web Interface servers are sitting on standard non-secure ports, you define them as HTTP services, plain and simple. The virtual server, on the other hand, is what your external clients connect to, so that one needs to be SSL to satisfy the company policy requiring secure external traffic. What NetScaler is doing here is SSL offloading, accepting the encrypted connection from the outside world, terminating it, and then passing plain HTTP back to your servers, which is exactly why the two pieces do not have to match. The trap in this question is assuming the service type and the virtual server type must be the same, but they do not, because they represent two completely different legs of the connection.

Bao N.Jun 27, 2026

HTTP services to the real servers, SSL vserver facing the outside, C is right.

Samuel O.Jun 27, 2026

The wording trips people up here because "secure" makes you want to pick SSL everywhere, so A looks appealing at first glance. But the servers themselves are running plain HTTP on standard ports, so you define HTTP services to match what the backend is actually listening on, and then you put an SSL virtual server out front to handle the encrypted external traffic, which is exactly what C says.

Hiroshi T.Jun 27, 2026

C is correct, and the Citrix documentation on SSL offload makes the logic airtight. The services you add under Load Balancing represent what the backend servers actually speak, which is HTTP on a standard port, so you bind HTTP services to those Web Interface nodes. The SSL virtual server sits in front and terminates the encrypted session from the client, then forwards plain HTTP internally, which is exactly how NetScaler handles SSL offload per the NetScaler Traffic Management guide. I hit this same scenario on my 1Y0-250 sitting and almost second-guessed myself into B because I conflated "secure external traffic" with needing SSL services on the backend, but the offload architecture is the whole point, and once I recalled that services describe the server side while the vserver describes the client-facing side, C locked in clean.

Viktor S.Jun 21, 2026

C is right. The backend servers run plain HTTP so you define HTTP services for them, but the virtual server facing the outside world must be SSL to satisfy the policy that external traffic be encrypted, and NetScaler handles the SSL offload in between.