nerdexam
Citrix

1Y0-401 · Question #32

Scenario: A Citrix Architect is asked to design a new external access architecture for CGE. The regional datacenters have NetScaler appliances delivering load-balancing services. Security policy…

The correct answer is C. Configure the callback URL to point to the FQDN of the local NetScaler Gateway, and configure the. For an external access architecture where internal StoreFront cannot directly connect to the DMZ's external IP, the callback URL should point to an internal-facing FQDN of the local NetScaler Gateway that the StoreFront can reach for STA validation.

Design XenDesktop Infrastructure Components

Question

Scenario: A Citrix Architect is asked to design a new external access architecture for CGE. The regional datacenters have NetScaler appliances delivering load-balancing services. Security policy mandates that these internal appliances CANNOT connect to the DMZ. How should the architect configure the callback URL with one NetScaler located in all three regional datacenters?

Options

  • AConfigure the callback URL to point to the local NetScaler, and configure the Secure Ticket Authority
  • BConfigure the callback URL to point to the external address, https://secure.cge.com, and configure the
  • CConfigure the callback URL to point to the FQDN of the local NetScaler Gateway, and configure the
  • DConfigure the callback URL to point to the external beacon address.

How the community answered

(50 responses)
  • A
    2% (1)
  • B
    6% (3)
  • C
    80% (40)
  • D
    12% (6)

Why each option

For an external access architecture where internal StoreFront cannot directly connect to the DMZ's external IP, the callback URL should point to an internal-facing FQDN of the local NetScaler Gateway that the StoreFront can reach for STA validation.

AConfigure the callback URL to point to the local NetScaler, and configure the Secure Ticket Authority

"Local NetScaler" is too vague and does not specify that it must be an FQDN or IP address reachable by StoreFront and configured specifically for callback purposes.

BConfigure the callback URL to point to the external address, https://secure.cge.com, and configure the

Configuring the callback URL to the external public address (https://secure.cge.com) would violate the security policy that internal appliances cannot connect to the DMZ's external-facing interfaces.

CConfigure the callback URL to point to the FQDN of the local NetScaler Gateway, and configure theCorrect

The callback URL, configured on StoreFront, is used to validate STA tickets by connecting back to the NetScaler Gateway. Since internal appliances (like StoreFront) cannot connect to the DMZ's external IP, the callback URL must resolve to an internal-facing FQDN or IP address of the NetScaler Gateway service within the DMZ that StoreFront can directly reach, ensuring successful ticket validation.

DConfigure the callback URL to point to the external beacon address.

The external beacon address is used by client devices to determine network location (internal/external), not by StoreFront for callback communication with NetScaler Gateway for STA validation.

Concept tested: NetScaler Gateway callback URL for StoreFront STA

Source: https://docs.citrix.com/en-us/storefront/current-release/configure-gateways.html

Topics

#NetScaler Gateway#callback URL#Secure Ticket Authority#external access

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 1Y0-401 Practice