1Y0-371 · Question #141
Scenario: A Citrix Engineer needs to provide access from WorxWeb to internal corporate HTTP websites through an internal proxy server. The engineer has configured Single Sign- On to web applications…
The correct answer is B. Set WorxWeb Network access to "Tunneled to internal network". C. Set WorxWeb VPN mode to "Secure browse". See the full explanation below for the reasoning.
Question
Scenario: A Citrix Engineer needs to provide access from WorxWeb to internal corporate HTTP websites through an internal proxy server. The engineer has configured Single Sign- On to web applications on the NetScaler. What are two ways that the engineer could ensure that users are able to access the websites without being prompted to authenticate more than once? (Choose two.)
Options
- ADisable Secure browse mode in the NetScaler session policy.
- BSet WorxWeb Network access to "Tunneled to internal network".
- CSet WorxWeb VPN mode to "Secure browse".
- DAdd the website to the allowed website list for WorxWeb.
How the community answered
(39 responses)- A18% (7)
- B74% (29)
- D8% (3)
Community Discussion
5
Samuel O.Dec 18, 2025B and C are your two answers here. The scenario is about getting traffic from WorxWeb to route through an internal proxy so SSO can do its job, and that only works if the traffic is actually going through the NetScaler VPN stack in the first place. Setting Network access to Tunneled to internal network (B) forces all WorxWeb traffic through the full VPN tunnel rather than the direct internet path, which means the NetScaler gets visibility into the requests and can inject those SSO credentials before the traffic hits the internal proxy. Setting VPN mode to Secure browse (C) is the WorxWeb-side setting that tells the app to wrap traffic through the NetScaler gateway using that micro-VPN approach, which again keeps the SSO chain intact instead of letting the browser handle the connection independently. If you leave either of those unset, the request bypasses the NetScaler entirely and your SSO config becomes irrelevant because there is nothing in the middle to handle the credential injection for you.
Toby R.Nov 21, 2025B and C, though C being "secure browse" while A says disable it tripped me up.
Ola B.Oct 20, 2025Why does tunneling or Secure browse mode both avoid re-prompting, given SSO is already set?
Dervla O.Dec 7, 2025Disabling Secure Browse kills the extra auth prompt, A is solid.
Toby R.Dec 8, 2025Hey Dervla, actually the correct combo is B and C on that one. Disabling Secure Browse sidesteps the symptom but doesn't address the underlying policy conflict, and the exam specifically tests whether you know to resolve it at the config level rather than just turning off the feature.