Configure SSL Offload CCA-APPDS-GATEWAY Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the role of an SSL certificate bound to a Citrix ADC virtual server?

   • AIt authenticates the client to the ADC
   • BIt stores the private key on the client's browser
   • CIt provides the public key and identity to clients during the SSL handshake
   • DIt encrypts the traffic between the ADC and the backend servers
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An administrator is troubleshooting an SSL offload issue. Clients are able to connect to the SSL virtual server, but the browser displays a 'connection reset' error after the TLS handshake. The backend servers are healthy and responding to HTTP requests. What is the most likely cause?

   • AThe certificate is expired.
   • BThe SSL protocol is set to TLS 1.3 only.
   • CThe cipher group is empty.
   • DThe service bound to the SSL virtual server is configured with the wrong port.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which benefit is directly associated with SSL offloading on a Citrix ADC?

   • AIt guarantees that all traffic is encrypted end-to-end
   • BIt allows the ADC to inspect decrypted traffic for security policies
   • CIt eliminates the need for any SSL certificates in the environment
   • DIt reduces the number of SSL certificates required to one for the entire organization
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security audit requires that all TLS connections to the Citrix ADC use only TLS 1.2 or higher. The administrator has configured the SSL virtual server with the appropriate cipher groups. After the change, some older clients can no longer connect. The administrator confirms the cipher suite 'TLS1.2-ECDHE-RSA-AES256-GCM-SHA384' is enabled. What is the most likely reason for the connection failures?

   • AThe older clients do not support TLS 1.2 or the required cipher suite.
   • BThe certificate is not bound to the virtual server.
   • CThe backend servers are not configured to use TLS 1.2.
   • DThe cipher group is not applied to the service group.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An administrator is configuring SSL offload for a new virtual server. The security policy requires the use of TLS 1.2 and the cipher suite 'TLS1.2-ECDHE-RSA-AES128-GCM-SHA256'. The administrator creates a cipher group and adds the cipher. What additional step is required to enforce this policy on the virtual server?

   • ARestart the ADC for the changes to take effect.
   • BDisable all other protocols except TLS 1.2.
   • CBind the cipher group to the SSL virtual server.
   • DCreate a new SSL profile and apply it.
   Reveal Solution Discussion Select an answer first