1Y0-341 · Question #217
Scenario: A Citrix Engineer has enabled the Learn function for a Citrix Web App Firewall profile. After a period of time, the engineer notices that Citrix Web App Firewall is no longer learning any…
The correct answer is C. The Citrix Web App Firewall Learn database has reached its capacity of 20 MB. The learning feature of the Citrix Web App Firewall stops learning new rules once the learn database reaches its size limit, which is approximately 20 MB. This limit corresponds to around 2,000 learned rules or relaxations. To resume learning, the engineer would need to review…
Question
Scenario: A Citrix Engineer has enabled the Learn function for a Citrix Web App Firewall profile. After a period of time, the engineer notices that Citrix Web App Firewall is no longer learning any new rules. What would cause Citrix Web App Firewall to stop learning?
Options
- AThe Citrix Web App Firewall has reached its capacity of 500 Learn transactions.
- BThe Citrix Web App Firewall feature is NOT licensed.
- CThe Citrix Web App Firewall Learn database has reached its capacity of 20 MB.
- DThe Citrix Web App Firewall profile was unbound from the application.
How the community answered
(39 responses)- A3% (1)
- B13% (5)
- C79% (31)
- D5% (2)
Explanation
The learning feature of the Citrix Web App Firewall stops learning new rules once the learn database reaches its size limit, which is approximately 20 MB. This limit corresponds to around 2,000 learned rules or relaxations. To resume learning, the engineer would need to review the existing learned rules and either approve or ignore them to free up space in the learn database.
Topics
Community Discussion
9
Giovanna H.May 7, 2026This question maps to the Web App Firewall Learning section of the 1Y0-341 blueprint, and the mnemonic to hold onto here is "20 MB, then WAF goes quiet." The correct answer is C. The WAF learn database has a hard 20 MB capacity limit, and once that threshold is hit, the engine stops collecting new learning data entirely until the database is pruned or deployed.
Prof. SaraMay 8, 2026Solid anchor, and worth stacking on top of it is that the blueprint ties the 20 MB ceiling directly to the deploy workflow, so exam writers often test the threshold and the prune-then-deploy sequence together as one objective, not two separate facts.
Carlos M.Apr 21, 2026Saw this exact one, panicked on 500 transactions but the DB cap at 20 MB is what stops learning cold.
Giovanna H.Apr 24, 2026The 500-transaction figure is classic exam misdirection, but tie it to the objective: XenApp/XenDesktop local app data limits fall under the "Configure Profile Management" blueprint section, and they test whether you know the MB ceiling triggers the stop, not the transaction count.
Ola B.May 2, 2026Right, the learn DB caps at 20 MB and stops cold after that.
Prof. SaraApr 2, 2026The Learn database in Citrix Web App Firewall has a hard cap of 20 MB, and once that threshold is hit, the engine simply stops writing new entries to it, so new traffic patterns go unrecorded even though the profile is still active and the feature is still licensed. Think of it as a bucket: when it is full, water stops going in regardless of how much is poured. Option A is a distractor using a plausible-sounding number, but there is no 500-transaction limit in the official documentation. Option D would cause protection to stop applying, not just learning, and option B would disable the feature entirely rather than produce a scenario where learning worked for a while and then quietly stopped.
Ola B.Apr 4, 2026The bucket analogy lands well, and I would add that spinning up a quick Citrix lab and filling a test profile past 20 MB yourself makes this click faster than any analogy because you can actually watch the Learn tab freeze up while traffic keeps hitting the VIP.
Mei-Ling H.Apr 12, 2026C is right, the learn DB stops at 20 MB capacity.
Carlos M.Apr 12, 2026Yeah, and that 20 MB cap is one of those numbers they love to test on because candidates confuse it with the storage limit on the full edition, so just burn that one into memory now.