1Y1-300 · Question #67
When the billing and collections department personnel access their desktops from within the internal network, a Citrix Engineer needs to secure the HDX communication, both to and from pooled…
The correct answer is C. Enable SecureICA in the Delivery Group End User settings. See the full explanation below for the reasoning.
Question
When the billing and collections department personnel access their desktops from within the internal network, a Citrix Engineer needs to secure the HDX communication, both to and from pooled desktops. Which action should the engineer take to achieve this?
Options
- AGenerate new security keys.
- BAssign an SSL certificate to the Delivery Controller.
- CEnable SecureICA in the Delivery Group End User settings.
- DConfigure the host connection in Citrix Studio to use HTTPS.
How the community answered
(34 responses)- A9% (3)
- B3% (1)
- C85% (29)
- D3% (1)
Community Discussion
5
Thekla S.Apr 8, 2026The correct answer is C, enable SecureICA in the Delivery Group End User settings. SecureICA encrypts the HDX data stream between the VDA and the endpoint using RC5 128-bit encryption, which is exactly what you need when the goal is to protect the in-session traffic itself rather than just the connection brokering path. Options A and B both miss the mark here because assigning an SSL cert to the Delivery Controller only secures XML broker traffic, not the HDX channel, and generating new security keys is too vague to mean anything actionable in this context. Option D, configuring the host connection to use HTTPS, secures the hypervisor communication in Studio, which is a different plane entirely and does nothing for the ICA stream flowing between the VDA and the user device.
Mei-Ling H.Apr 3, 2026HTTPS on the host connection is what actually encrypts HDX traffic end-to-end, D.
Thekla S.Apr 4, 2026Mei-Ling, the host connection using HTTPS is separate from HDX channel encryption, and option C is correct because Citrix App Protection policies specifically target the ICA/HDX virtual channels to apply anti-keylogging and anti-screen-capture controls before the session content ever reaches the endpoint rendering layer.
Anjali D.Apr 24, 2026I keep coming back to B on this one because the Delivery Controller is the central point handling all HDX traffic brokering, so slapping an SSL cert on it is what actually encrypts that communication end to end for internal users hitting pooled desktops. Anyone else landing here or do most of you have a different read?
Thekla S.Apr 25, 2026Anjali, the Delivery Controller brokers sessions but the HDX data channel itself runs between the client and the VDA, so the SSL certificate that encrypts that traffic in transit belongs on the VDA, not the Controller.