nerdexam
Citrix

1Y0-401 · Question #149

The company's security compliance policy requires that remote access is logged for auditing purposes. Which data sources should be captured?

The correct answer is A. NetScaler logs, StoreFront logs, and Citrix Director database. To comprehensively audit remote access in a Citrix environment, an architect should capture logs from NetScaler, StoreFront, and the Citrix Director database.

Design Operational Management and Security

Question

The company's security compliance policy requires that remote access is logged for auditing purposes. Which data sources should be captured?

Options

  • ANetScaler logs, StoreFront logs, and Citrix Director database
  • BConfiguration Logging database, NetScaler logs, and Citrix Director database
  • CStoreFront logs, System Event logs, and firewall logs
  • DConfiguration Logging database, firewall logs, and Application Event log

How the community answered

(37 responses)
  • A
    76% (28)
  • B
    8% (3)
  • C
    3% (1)
  • D
    14% (5)

Why each option

To comprehensively audit remote access in a Citrix environment, an architect should capture logs from NetScaler, StoreFront, and the Citrix Director database.

ANetScaler logs, StoreFront logs, and Citrix Director databaseCorrect

NetScaler logs provide details on external connection attempts and authentication, while StoreFront logs capture user login and resource enumeration events. The Citrix Director database (specifically the monitoring database) contains comprehensive records of user sessions, connection details, and application usage, which are crucial for auditing remote access activities.

BConfiguration Logging database, NetScaler logs, and Citrix Director database

The Configuration Logging database tracks administrative changes to the Citrix site, not user remote access activities.

CStoreFront logs, System Event logs, and firewall logs

While StoreFront logs are relevant, System Event logs are too generic for detailed remote access auditing, and firewall logs only provide network-level access, lacking user-specific application launch details.

DConfiguration Logging database, firewall logs, and Application Event log

The Configuration Logging database is irrelevant for user remote access auditing, and general Application Event logs or firewall logs do not provide the detailed user session information found in Director.

Concept tested: Citrix Remote Access Auditing Sources

Source: https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/monitor/director.html

Topics

#remote access logging#auditing#NetScaler logs#StoreFront logs

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 1Y0-401 Practice