Which feature should a Citrix Engineer implement to ensure that client devices do NOT connect directly to back-end components?

ICA Proxy mode on Citrix ADC (NetScaler Gateway) acts as a full intermediary: it terminates the client SSL/ICA session and opens a new connection to the back-end VDA or server. This means client devices communicate only with the ADC and have no direct network path to back-end resources, satisfying the requirement to prevent direct client-to-backend connectivity.

StoreFront is a web-based aggregation and enumeration service for applications and desktops but does not proxy or terminate ICA connections to prevent direct client access to back-end components.

URL Rewrite is a content-switching or traffic manipulation feature on Citrix ADC that modifies HTTP URLs in flight but does not intercept or proxy ICA sessions to block direct back-end access.

Secure Ticket Authority (STA) issues and validates session tickets to authorize ICA connections but does not itself proxy or relay traffic between clients and back-end servers.