Describe SSL Session Processes CCA-APPDS-GATEWAY Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A client is connecting to a Citrix Gateway. The gateway presents a certificate that is valid and trusted by the client. However, the client receives a warning that the certificate name does not match the site name. What is the most likely cause?

   • AThe certificate is not signed by a trusted CA.
   • BThe certificate is using a weak cipher suite.
   • CThe certificate's subject name or SAN does not include the FQDN used by the client.
   • DThe certificate is expired.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A Citrix Gateway administrator is configuring SSL offload for a high-security environment. The security team requires forward secrecy for all connections. The gateway supports RSA and ECDHE key exchange methods. Which configuration should the administrator choose?

   • AEnable only ECDHE key exchange cipher suites.
   • BEnable ECDHE and RSA, but disable ECDHE for clients that do not support it.
   • CEnable both RSA and ECDHE, but prefer RSA in the cipher suite list.
   • DEnable only RSA key exchange cipher suites.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What does a client verify when checking the validity period of a server certificate?

   • AThat the certificate was issued by a government authority
   • BThat the current date is within the certificate's notBefore and notAfter dates
   • CThat the certificate's public key matches the server's private key
   • DThat the certificate is stored in the client's browser
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst is reviewing a packet capture of an SSL handshake between a client and Citrix Gateway. The analyst sees the ClientHello, ServerHello, Certificate, ServerKeyExchange, and ServerHelloDone messages. What is the next expected message from the client?

   • AChangeCipherSpec
   • BClientKeyExchange
   • CFinished
   • DCertificateVerify
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A Citrix Gateway is configured to offload SSL for a web application. The backend server is located in a different data center and the connection between the gateway and backend traverses a public network. The security team requires that the backend connection be encrypted. What is the best practice?

   • AUse SSL passthrough for both connections to avoid decryption.
   • BUse SSL offload for the client connection and SSL re-encryption for the backend connection.
   • CUse SSL offload only, and let the backend connection be in clear text.
   • DUse a VPN tunnel between the gateway and backend instead of SSL.
   Reveal Solution Discussion Select an answer first