1Y1-300 · Question #48
What is a reason for hosting a Citrix StoreFront server on a dedicated IIS instance?
The correct answer is A. To minimize security implications. See the full explanation below for the reasoning.
Question
What is a reason for hosting a Citrix StoreFront server on a dedicated IIS instance?
Options
- ATo minimize security implications
- BTo minimize the IIS recycle pool interval
- CTo allow for client beacon name resolution
- DTo allow for NetScaler single sign-on functionality
How the community answered
(55 responses)- A80% (44)
- B4% (2)
- C11% (6)
- D5% (3)
Community Discussion
4
Nina C.Jun 17, 2026The answer is A, to minimize security implications, and here is why that makes sense once you think about it. IIS can host multiple web applications at the same time, and if StoreFront shares that instance with other apps, a vulnerability in one of those other apps could potentially be exploited in a way that puts StoreFront at risk too. Giving StoreFront its own dedicated IIS instance means you are isolating it, so the attack surface is much smaller and a compromise of some unrelated app does not automatically become a StoreFront problem. The other options do not hold up, because things like NetScaler SSO and beacon name resolution do not actually depend on whether IIS is shared or dedicated. Security isolation is the whole point here.
Samuel O.Jun 13, 2026Thought B made sense until I remembered shared IIS pools bleed permissions across sites, so isolation is a security call.
Brenda K.Jun 6, 2026Quick win on this one, do not overthink it. Citrix best practice has always been to keep StoreFront on its own IIS instance specifically so that a compromise or misconfiguration in another web application does not spill over into your StoreFront environment. Does anyone here know offhand which specific IIS shared-configuration scenarios Citrix calls out as the biggest risk in their deployment guides?
Samuel O.Jun 7, 2026Brenda has the right instinct, and the scenario Citrix flags most consistently is sharing IIS config across nodes when you have StoreFront server groups, because a bad applicationHost.config pushed to the shared path takes down all members at once rather than just the one box you were touching.