Free Citrix 1Y0-241 Practice Exam with Questions & Answers | Set: 3

Tricky one, this is for 13.1 and classic still is mandatory for AAA until 2023 (with exceptions on Traffic policy) https://docs.citrix.com/en-us/citrix-adc/current-release/appexpert/policies-and-expressions/introduction-to-policies-and-exp/advanced-policy-infrastructure.html

Correct Answer: D. CLIENT.IP.SRC IN_SUBNET(10.107.149.0/24) && (client.UDP.DSTPORT.EQ(53) || client.TCP.DSTPORT.EQ(53))

Short Explanation with reference:

An expression is a logical statement that evaluates to true or false, and can be used to match the required traffic for various purposes, such as filtering, rewriting, or load balancing. An expression can use different operators, functions, and values to specify the criteria for matching the traffic. Some of the common elements of an expression are:

• CLIENT.IP.SRC: This function returns the source IP address of the client request.
• IN_SUBNET: This operator checks whether an IP address belongs to a specified subnet.
• &&: This operator performs a logical AND operation between two expressions.
• ||: This operator performs a logical OR operation between two expressions.
• client.UDP.DSTPORT and client.TCP.DSTPORT: These functions return the destination port of the client request for UDP and TCP protocols, respectively.
• EQ: This operator checks whether two values are equal.

In this scenario, the administrator needs to block all DNS requests from subnet 10.107.149.0/24. DNS requests are typically sent over UDP or TCP protocols, and use port 53 as the destination port. Therefore, the expression that can match this traffic is:

CLIENT.IP.SRC IN_SUBNET(10.107.149.0/24) && (client.UDP.DSTPORT.EQ(53) || client.TCP.DSTPORT.EQ(53))

This expression evaluates to true if the source IP address of the client request is in the subnet 10.107.149.0/24, and the destination port of the client request is 53 for either UDP or TCP protocol.

The other options are incorrect, as they either use the wrong function, operator, or syntax for matching the traffic. For example, option A uses the SRC function instead of the IN_SUBNET operator, which will only match a single IP address instead of a subnet. Option B uses an incorrect delimiter (space) between the subnet address and mask, which will cause a syntax error. Option C uses parentheses incorrectly, which will change the order of evaluation and result in a different meaning.

Configuring expressions | NetScaler : How to Configure an Expression to Filter Traffic - Citrix Customer Support : How to Use Operators in Expressions - Citrix Customer Support

https://training.citrix.com/public/Exam%20Prep%20Guides/231/1Y0-231_Exam_Preparation_Guide_v01.pdf

- Pol1 has a prio of 90 so it's evaluated first

-gotoPrioExpression NEXT means that it will evaluate next item in the policy list

- Pol2 has a prio of 100, so it"s avaluated after Pol1

Correct Answer: B. MIR DISABLED

Short Explanation with reference:

MIR (Multiple IP Response) is a feature that allows the Citrix ADC appliance to send the IP addresses of all the active services in the DNS response when a client requests the IP address of a GSLB (Global Server Load Balancing) virtual server. This can improve the performance and availability of the GSLB service, as the client can choose the best service based on its own criteria, such as round-trip time or proximity. However, MIR can also cause some issues, such as DNS caching, client-side load balancing, and security risks. Therefore, a Citrix Administrator can use the set gslb vServer -MIR DISABLED parameter to change this behavior and disable MIR for a specific GSLB virtual server. This will make the appliance send only one IP address in the DNS response, which is selected based on the configured load balancing method. Therefore, the correct answer is B. MIR DISABLED.

Configuring multiple IP addresses for a GSLB domain | NetScaler : Global Server Load Balancing - Citrix Docs : How to Configure Multiple IP Response (MIR) for GSLB - Citrix Customer Support : Configuring GSLB load balancing methods | NetScaler

https://docs.citrix.com/en-us/citrix-adc/current-release/appexpert/responder/diameter-support-responder.html

Correct Answer: A. Operator

Short Explanation with reference: A command policy is a set of rules that regulates which commands, command groups, virtual servers, and other entities that users and user groups are permitted to use on a Citrix ADC appliance1. Citrix ADC provides a set of built-in command policies that have predefined permission levels for different types of users1. The built-in command policy permission levels are as follows1:

• Read-only: Users can view the configuration of the appliance, but cannot modify it. They can also view statistics and run show commands.
• Operator: Users can view and modify the configuration of the appliance, but cannot save the configuration or access the shell. They can also enable and disable services and servers, clear counters, and run show commands.
• Network: Users can view and modify the network configuration of the appliance, such as interfaces, routes, VLANs, and so on. They can also save the configuration and access the shell.
• Sysadmin: Users have full access to all commands and features of the appliance.

To create local, limited-privilege user accounts for other administrators who require only read-only access and the ability to enable and disable services and servers, the administrator can use the built-in command policy permission level of Operator (option A). This permission level allows users to perform these tasks, but not others that are not required or authorized1. The other options are incorrect because they either grant more privileges than necessary or do not allow enabling and disabling services and servers. Therefore, the correct answer is A. Operator.