Which two policies should a Citrix Engineer add to a deployment package to set the status of a user's device to Out of Compliance and notify the engineer whenever a user installs a blacklisted…

Thekla S.Jan 18, 2026

The correct answers are C and D. Applications Access is the policy that lets you define your blacklisted app list and automatically flag a device as Out of Compliance the moment a prohibited application shows up on it, so that is your compliance enforcement layer. Automated Actions is what closes the loop on the notification side, because it lets you configure a trigger that fires when device status changes to Out of Compliance and sends an alert to the engineer. Neither App Lock nor Restriction touches the compliance status field or has a built-in alerting mechanism tied to app inventory, so those two are distractors. If you think about it as two separate jobs, Applications Access watches the app inventory and sets the status, and Automated Actions watches the status and tells someone about it.

Isolde G.Jan 6, 2026

Automated Actions and Applications Access work together here because Applications Access is what actually defines the blacklisted app list and triggers the Out of Compliance status on the device, while Automated Actions is the engine that watches for that compliance event and fires the notification to the engineer. Without Applications Access, you have no mechanism to flag the app as forbidden in the first place, and without Automated Actions, the compliance state change just sits there silently with nobody alerted. App Lock and Restriction both feel plausible as distractors because they sound security-adjacent, but neither one generates notifications or sets a compliance status based on app inventory, they are reactive controls not detective ones. When I sat the 1Y0-370 I actually second-guessed Automated Actions at first because I kept thinking of it as a remediation tool rather than a detection-and-notify tool, and I nearly swapped it for Restriction out of habit from older XenMobile deployments where restrictions were doing more of the heavy lifting. What pulled me back was remembering that in CEM the Automated Actions policy is literally the only place you configure the "notify administrator" trigger tied to a device condition, so once I anchored on that the Applications Access piece fell right into place as its required partner.

Bao N.Jan 12, 2026

Been grinding 1Y0-370 for weeks and every time I hit a blacklisted app scenario the Restriction policy is what controls what users can and cannot have installed, so B has to be one of the two picks here, and I keep coming back to C for the notification and compliance status trigger because Automated Actions is literally built to fire off alerts and mark devices out of compliance when a condition is met.