Scenario: A Citrix Engineer reviews the log files for a business-critical web application. The engineer notices a series of attempts to directly access a file, /etc/passwd. Which feature can the…

Giselle K.Mar 31, 2026

The correct answer is B, Start URL. What you are seeing in those logs is a path traversal attempt, where someone is trying to step outside the web root and read /etc/passwd directly by manipulating the URL. The Start URL feature in Citrix Application Firewall lets you define exactly which URLs are valid entry points for the application, so any request that does not match that whitelist gets blocked before it ever touches the back end. The other options do not address this vector, Buffer Overflow protects against oversized input, Content Type validates the MIME type of requests, and Form Field Consistency checks that form data has not been tampered with, none of which would catch a rogue URL path like that one.

Prof. SaraApr 18, 2026

The attack pattern here is a direct file request to a path that has nothing to do with the application's intended navigation flow, and one of these four features is specifically designed to enforce which URLs are even permissible entry points into the application in the first place. Here is my clarifying question: if the WAF is configured to only allow requests that begin at a defined, approved URL path, what do you think happens to a request for a system file like /etc/passwd that was never listed as a valid starting point?

Wesley A.Apr 29, 2026

Start URL blocks requests to paths outside the allowed set, trapping that /etc/passwd crawl - B.

Toby R.Apr 13, 2026

Saw almost this exact scenario on mine, they described the /etc/passwd access attempt and I immediately thought path traversal, which is exactly what Start URL is designed to block by enforcing that requests only come through approved entry points. Went with B without second-guessing and moved on.

Ola B.Mar 26, 2026

Content Type is the play here because if you configure Content Type checks on the ADC, it inspects what kind of data is actually being requested or returned, and a direct probe for /etc/passwd is going to trip that filter when the response or request does not match an allowed content type for that app. I spun this up in a lab last week with a basic NetScaler VPX and the Content Type protection blocked those traversal-style requests before they even got close to the backend.