1Y0-440 · Question #45
A Citrix Architect needs to assess a NetScaler Gateway deployment that was recently completed by a customer and is currently in pre-production testing. The NetScaler Gateway needs to act as a proxy…
The correct answer is D. The Secure Ticket Authority (STA) servers are load balanced on the NetScaler. See the full explanation below for the reasoning.
Question
Options
- AThe required ports have NOT been opened on the firewall between the NetScaler gateway and the Virtual Delivery Agent (VDA) machines.
- BThe StoreFront URL configured in the NetScaler Gateway session profile is incorrect.
- CThe Citrix License Server is NOT reachable.
- DThe Secure Ticket Authority (STA) servers are load balanced on the NetScaler.
How the community answered
(62 responses)- A5% (3)
- B15% (9)
- C6% (4)
- D74% (46)
Community Discussion
5
Dervla O.Feb 27, 2026D is your answer. When STA servers are load balanced on the NetScaler itself, the STA tickets get issued by one server but the validation request can hit a different node, breaking the ticket redemption process and preventing resource launches, so STAs must be referenced directly by their individual URLs rather than through a load-balanced VIP.
Isolde G.Mar 31, 2026Option D is correct because when STA servers are load balanced on the NetScaler rather than listed individually in the Gateway session policy, the Gateway cannot reliably validate tickets, so session launches fail before the ICA proxy connection is even established. The STA servers need to be configured directly in the Gateway virtual server or session profile as discrete entries, not pointed at a VIP.
Wesley A.Mar 16, 2026Has to be C, License Server down kills launches every time.
Yusuf A.Mar 19, 2026Hey Wesley, I think D is actually the one here, because most licensing setups have a grace period or cached credentials that let existing sessions keep running even when the server goes down, so it does not always kill launches right away the way D's scenario does.
Toby R.Mar 25, 2026Honest answer, I went with B first because a wrong StoreFront URL is such a classic gotcha and the question screams misconfiguration, but then I thought about it more carefully. If the StoreFront URL were wrong, users would not even get to the point of seeing resources to launch, so that ruled itself out. The real problem with load balancing STA servers on the NetScaler is that the ticket gets issued by one STA node but the validation request can land on a completely different node that has no record of that ticket, so the session never establishes. The fix is to point the Gateway session profile directly at each STA server by IP or hostname, not through a VIP, so the same server that issued the ticket is the one validating it.