Drag and Drop Question Drag and drop the components on the left that are part of the logical architecture for a single-site deployment of VMware Horizon into their correct position in the diagram on t

Question

Exhibit

Answer Area

Explanation

VMware Horizon Single-Site Logical Architecture

This question tests your understanding of where each Horizon component lives in the logical architecture - from the edge of the network inward to infrastructure services.

The Logical Flow (Outside → Inside)

Think of the architecture in layers: user access edge → cloud connectivity → cloud management → on-prem infrastructure → authentication services.

Component-by-Component Breakdown

1. Unified Access Gateway (UAG)

• Position: Network edge / DMZ
• Why here: UAG is the externally-facing gateway. It receives connections from remote end users over HTTPS/BLAST/PCoIP before anything else touches the internal network. It acts as a reverse proxy and performs pre-authentication, so untrusted traffic never directly reaches internal Horizon components.
• Common mistake: Confusing UAG with a VPN. UAG is Horizon-aware and inspects/proxies Horizon-specific protocols - it's not a general-purpose network gateway.

2. Horizon Cloud Connector

• Position: On-premises, bridges to cloud
• Why here: The Cloud Connector is a virtual appliance deployed on-premises that creates an outbound connection to the Horizon Control Plane (the cloud service). It's the "phone home" bridge - it doesn't sit at the edge but sits behind the firewall connecting your pod to Horizon's cloud management layer.
• Common mistake: Thinking the Cloud Connector lives in the cloud. It's on-prem; the cloud-side counterpart is the Control Plane.

3. Horizon Control Plane

• Position: Cloud (SaaS layer)
• Why here: The Control Plane is Horizon's cloud-hosted management service. It provides centralized management, image management, and monitoring capabilities. The Cloud Connector (item 2) maintains the secure tunnel to this cloud service.
• Common mistake: Assuming this is an on-premises component. In modern Horizon architecture, this is a VMware-operated cloud service - not something you deploy locally.

4. vCenter Server

• Position: On-premises infrastructure layer
• Why here: vCenter manages the ESXi hosts and VMs that power Horizon desktops and RDSH session hosts. Horizon Connection Server communicates with vCenter to provision, clone, and power-manage virtual desktops. It's a core on-premises dependency.
• Common mistake: Placing vCenter in the DMZ or treating it as an external component. vCenter is always internal and should never be directly internet-facing.

5. Enrollment Server

• Position: On-premises, authentication services layer
• Why here: The Enrollment Server enables True SSO - it works with your Microsoft Certificate Authority to issue short-lived certificates on behalf of authenticating users, so they aren't re-prompted for credentials when logging into their virtual desktop. It's an internal service supporting authentication flows, positioned furthest from the edge.
• Common mistake: Thinking Enrollment Server is required for all Horizon deployments. It's only needed if you're implementing True SSO (e.g., smart card / SAML auth scenarios where you want SSO into the guest OS).

Summary Table

The key insight: the arrangement follows trust boundary order - least trusted (public internet edge) to most trusted (internal infrastructure and auth services).

No community discussion yet for this question.