1Y0-A21 · Question #131
Which type of content switching vserver must an administrator configure for connection-based content switching of transport control protocol traffic when the traffic should be decrypted prior to…
The correct answer is B. SSL_TCP. Citrix 1Y0-A21 Exam
Question
Which type of content switching vserver must an administrator configure for connection-based content switching of transport control protocol traffic when the traffic should be decrypted prior to reaching the back-end server?
Options
- ATCP
- BSSL_TCP
- CSSL_HTTP
- DSSL_Bridge
How the community answered
(27 responses)- A4% (1)
- B85% (23)
- C4% (1)
- D7% (2)
Explanation
Citrix 1Y0-A21 Exam
Topics
Community Discussion
5
Wesley A.Jun 27, 2026The answer is B, SSL_TCP, and this one tripped me up the first time because SSL_Bridge sounds like it would fit when you hear "TCP traffic." SSL_Bridge is the trap, it passes the encrypted traffic straight through to the back end without terminating the SSL session, so the server handles decryption, not the NetScaler. SSL_TCP is specifically designed for connection-based content switching where the appliance offloads SSL decryption before the traffic ever reaches your back-end servers, which is exactly what the question describes. If the traffic were HTTP-based you would reach for SSL_HTTP, but since this is raw TCP the SSL_TCP vserver is the right call every time.
Brenda K.Jun 29, 2026Wesley nailed the SSL_Bridge trap, and the one thing worth adding is that SSL_TCP also lets the NetScaler do certificate-based client authentication before the connection even touches the back end, which is a bonus reason to reach for it on TCP offload scenarios.
Fatima Z.Jun 11, 2026SSL_TCP is your guy here, not SSL_Bridge which stays encrypted all the way, so B wins.
Brenda K.Jun 19, 2026C, because you need HTTP-layer inspection after decryption, not raw TCP passthrough.
Fatima Z.Jun 22, 2026Hey Brenda, close call but it is actually B, because that scenario calls for inspection at the point before re-encryption hands off to the destination, which is exactly where B places the control, not at the HTTP application layer after the fact like C describes.