1Y0-253 · Question #128
Scenario: A Citrix Administrator is in the process of implementing StoreFront with NetScaler Gateway. Users in the environment will access resources through Citrix Receiver only. What does the…
The correct answer is A. ICA Proxy. See the full explanation below for the reasoning.
Question
Scenario: A Citrix Administrator is in the process of implementing StoreFront with NetScaler Gateway. Users in the environment will access resources through Citrix Receiver only. What does the administrator need to configure on the NetScaler Gateway to enable access through Citrix Receiver only?
Options
- AICA Proxy
- BA Traffic Policy
- CEndpoint Scans
- DAn AppFlow Policy
How the community answered
(23 responses)- A78% (18)
- B9% (2)
- C4% (1)
- D9% (2)
Community Discussion
6
Luis F.Apr 30, 2026The answer is A, ICA Proxy, and this one tripped me up the first time I studied it too. ICA Proxy is the feature you enable on NetScaler Gateway that lets Citrix Receiver talk directly to the gateway over the ICA protocol without needing a full VPN tunnel, which is exactly what the scenario is describing. The other options do real things but they solve different problems, like Endpoint Scans check the health of the client device and AppFlow is all about traffic analytics, neither of which is about enabling Receiver connectivity. Once you tie "Receiver only access" to "ICA Proxy" in your head it sticks pretty well, good luck on the exam!
Grace U.Apr 12, 2026Honestly, when I first read this one I went straight to B, because "Traffic Policy" sounds like exactly the kind of thing that would control how a specific client routes through the gateway. But then I slowed down and thought about what the question is really asking, which is not about shaping or redirecting traffic in general, it is about what specifically makes Citrix Receiver work through NetScaler Gateway at all. ICA Proxy is the piece that lets the gateway speak the ICA protocol on behalf of Receiver clients. When you enable ICA Proxy mode on NetScaler Gateway, the gateway acts as a proxy for ICA connections so that Receiver can reach the backend resources without needing a full VPN tunnel. That is the whole point of a Receiver-only deployment, because Receiver does not establish a traditional SSL VPN, it relies on ICA Proxy to broker that session. Once I thought about the protocol layer rather than a policy layer, A was the only answer that made sense.
Mateus R.Apr 18, 2026ICA Proxy is your bouncer, letting only Receiver traffic through the Gateway.
Brenda K.Apr 20, 2026Good analogy, though the bouncer also checks ID on the way out, since ICA Proxy tunnels the return traffic back through the Gateway too, not just the inbound connection request.
Brenda K.May 1, 2026Clock says B on this one, Traffic Policy is exactly what controls how the Gateway routes and handles specific client traffic, and scoping it to Citrix Receiver sessions is precisely that kind of traffic-shaping decision, not a proxy toggle or a scan. Mark it, move on, you have got bigger sinkholes ahead in this exam.
Mateus R.May 4, 2026Brenda, I appreciate the confidence but the Session Policy is the one doing the heavy lifting here, because that is where ICA Proxy gets enabled and the Citrix Receiver connection is actually brokered through the Gateway, the same way a hotel front desk hands you a room key versus the bellhop who just carries your bags down a specific hallway. Traffic Policy handles the flow after the session is already established, so A is your answer on this one.