1Y0-A21 · Question #127
Scenario: A network administrator is implementing a NetScaler system for a large environment. The administrator will be using these IP addresses when configuring the NetScaler system: -Internal web…
The correct answer is A. A SNIP in the 192.168.100.X subnet B. A static route to the 192.168.100.x subnet. Citrix 1Y0-A21 Exam
Question
Scenario: A network administrator is implementing a NetScaler system for a large environment. The administrator will be using these IP addresses when configuring the NetScaler system:
-Internal web server IP address: 192.168.100.12 -NetScaler-owned IP addresses:
NSIP: 10.165.30.45 MIP: 10.165.30.60 VIP: 12.15.30.62 Which two items could the administrator specify on the NetScaler system to enable communication with the web server? (Choose two.)
Options
- AA SNIP in the 192.168.100.X subnet
- BA static route to the 192.168.100.x subnet
- CAn intranet IP in the 192.168.100.X subnet
- DA virtual server in the 192.168.100.X subnet
How the community answered
(48 responses)- A83% (40)
- C10% (5)
- D6% (3)
Explanation
Citrix 1Y0-A21 Exam
Topics
Community Discussion
7
Yusuf A.Jun 8, 2026The correct answers are A and B, and once you see why the other two fall apart it really clicks. A senior I work with explained it this way: the NetScaler needs a way to actually reach a subnet it does not belong to, and a SNIP placed in the 192.168.100.x range gives it an owned IP in that subnet so it can initiate connections to the web server directly. A static route to that subnet is the other path because it tells the NetScaler where to send traffic for 192.168.100.x even without a SNIP there, so both options are legitimate ways to bridge that reachability gap. Intranet IPs are a Citrix Access Gateway thing for assigning addresses to VPN clients, not for back-end server communication, so C is out. And a virtual server lives on a VIP that clients connect to from the outside, it does not help the NetScaler talk to a server sitting behind it, so D does not apply here either.
Giselle K.Jun 27, 2026A and B are right. The NetScaler needs either a SNIP in the 192.168.100.x subnet to source connections directly to that server, or a static route pointing to that subnet so the MIP or SNIP knows how to reach it, since none of the NetScaler-owned IPs share that segment.
Ingrid P.Jun 27, 2026A and B are right, though C trips people up if they forget intranet IPs are for clientless VPN outbound, not server reachability.
Mateus R.Jun 29, 2026Good catch, Ingrid, and the way I think about it is that the intranet IP handed to the clientless VPN session is like a temporary visitor badge that lets the guest (the remote browser) send traffic out into the building, not a new address for the building itself, which is why using it to test server reachability is the wrong tool for the job.
Toby R.Jun 22, 2026Got A and B on this one. The SNIP puts the NetScaler in the same subnet as the web server so it can initiate connections directly, while the static route gives it a path to get there if it has to go through a gateway. Quick question though, does anyone know if there are specific scenarios where you would need both at the same time versus just one being enough to reach that 192.168.100.x network?
Mateus R.Jun 15, 2026Think of the NetScaler like a delivery driver who needs a local address in each neighborhood to actually pick up and drop off packages. The intranet IP in the 192.168.100.X subnet gives the NetScaler a home address on that server's network so it can initiate connections and talk directly to 192.168.100.12, which is exactly why C has to be one of the two right answers here.
Toby R.Jun 17, 2026The functionality you described is actually what a SNIP does, and the SNIP is covered in A and B, so C is redundant and not one of the two correct picks. The exam wanted you to recognize that the NetScaler uses the SNIP specifically for that server-side communication role, not a separate intranet address option.