Citrix CCA-AppDS (Traffic Management track): Certified Associate - App Delivery and Security Practice Exam

What the Citrix CCA-AppDS (Traffic Management track) exam covers

• 1 Getting Started with Citrix ADC; 3 Citrix ADC Platforms71 questions
• 2 Basic Networking; 4 High Availability83 questions
• 5 Load Balancing; 12 Global Server Load Balancing (GSLB)104 questions
• 6 SSL Offload67 questions
• 7 Securing the Citrix ADC; 8 Troubleshooting74 questions
• 9 Rewrite, Responder, and URL Transform; 10 Content Switching; 11 Optimization84 questions

Free Citrix CCA-AppDS (Traffic Management track) practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 483-question bank.

1. Question 19 Rewrite, Responder, and URL Transform; 10 Content Switching; 11 Optimization

   An administrator must route requests for /video to a pool of streaming servers and requests for /api to a separate pool of application servers, all behind a single public VIP. Which NetScaler feature is designed for this requirement?

   • AGSLB
   • BContent switchingCorrect
   • CSSL offload
   • DAppFlow
   ✓ Correct answer: B

   Content switching lets the appliance distribute client requests across multiple servers based on the content of the request. A content switching virtual server receives the traffic on the single VIP, and content switching policies bound to it select the load balancing virtual server that serves each kind of content, so /video and /api requests can reach different server pools.

   Why the other options are wrong

   • AGSLB balances the load across data centers by directing client requests to the closest or best performing data center (Where does a NetScaler appliance fit in the network?), which is a choice between sites rather than between pools behind one VIP.
   • CSSL offload takes SSL processing off the servers by decrypting the traffic on the appliance (SSL offload and acceleration); choosing a server pool by URL path is what content switching policies do.
   • DAppFlow collects flow and user-session level information for application performance monitoring and analytics (AppFlow); it does not choose which server pool receives a request.
2. Question 25 Load Balancing; 12 Global Server Load Balancing (GSLB)

   While adding members to a service group, the administrator wants each member to use port 8080 even though the load balancing virtual server listens on port 443. Which statement is correct about member ports in a service group?

   • AService group member ports must always match the virtual server's listening port
   • BMember ports are inherited automatically from the ADC's SNIP configuration
   • CService groups do not support specifying an individual port for members
   • DEach service group member has its own back-end port, independent of the vserver portCorrect
   ✓ Correct answer: D

   In Configure service groups, members are bound with bind servicegroup followed by the member IP address or server name and a port, for example bind servicegroup Service-Group-1 10.102.29.30 80. The virtual server has its own port, as in SSL offloading configuration, where an SSL virtual server on port 443 forwards to an HTTP service on port 80.

   Why the other options are wrong

   • AThe SSL offloading configuration example uses an SSL virtual server on port 443 with an HTTP service on port 80, so back-end ports do not have to match the virtual server port.
   • BThe member port is given in the bind servicegroup command for each member (Configure service groups); it is not taken from the SNIP.
   • CThe bind servicegroup command takes an IP address or server name and a port for each member (Configure service groups), so a member port of 8080 is supported.
3. Question 36 SSL Offload

   During a TLS 1.2 handshake on a NetScaler SSL virtual server, the administrator wants clients to be able to negotiate ECDHE-ECDSA cipher suites. Which configuration element must be present for those suites to be usable?

   • AOnly an RSA certificate-key pair is required because ECDHE-ECDSA cipher suites work with any bound key type
   • BAn ECDSA certificate-key pair must be bound to the virtual server in addition to enabling the ECDHE-ECDSA ciphersCorrect
   • CSNI must be disabled on the virtual server before any elliptic-curve cipher suites can be negotiated with clients
   • DThe SSL session reuse timeout must be raised to its maximum value for ECDHE-ECDSA suites to become usable
   ✓ Correct answer: B

   ECDHE-ECDSA cipher suites use ECDHE for the key exchange and ECDSA for server authentication. When the ECDHE_ECDSA cipher group is used, the server certificate must contain an ECDSA-capable public key, so an ECDSA certificate-key pair must be bound to the SSL virtual server. Both ECDSA and RSA server certificates can be bound at the same time, and the virtual server then selects the appropriate one to present to the client.

   Why the other options are wrong

   • AWhen the ECDHE_ECDSA cipher group is used, the server's certificate must contain an ECDSA-capable public key (ECDSA cipher suites support), which an RSA certificate does not.
   • CThe requirement for ECDHE-ECDSA suites is an ECDSA-capable server certificate (ECDSA cipher suites support); SNI does not have to be disabled.
   • DThe requirement for ECDHE-ECDSA suites is an ECDSA-capable server certificate (ECDSA cipher suites support), not a session reuse timeout.
4. Question 41 Getting Started with Citrix ADC; 3 Citrix ADC Platforms

   Before a firmware upgrade, an administrator wants a backup of a NetScaler that also includes less frequently updated files such as the SSL and license directories under nsconfig. Which backup should be created?

   • AA full system backupCorrect
   • BA basic system backup
   • CA save ns config run
   • DA show ns ns.conf dump
   ✓ Correct answer: A

   A basic backup covers files that constantly change, while a full backup includes less frequently updated files in addition to those in a basic backup, such as the ssl, license and fips directories under nsconfig. The backed-up data is stored as a compressed TAR file in /var/ns_sys_backup/, and the new platform build must be the same as the backup or later to restore it.

   Why the other options are wrong

   • BA basic backup covers only files that constantly change; the SSL and license directories are added by a full backup.
   • Csave ns config writes the running configuration to ns.conf; it does not create a restorable backup archive.
   • Dshow ns ns.conf displays the saved configuration; it does not create a backup file.
5. Question 57 Securing the Citrix ADC; 8 Troubleshooting

   An on-call engineer must be able to enable and disable servers and services during maintenance windows, but otherwise only view the NetScaler configuration. Which built-in command policy fits best?

   • Asysadmin
   • BoperatorCorrect
   • Cnetwork
   • Dread-only
   ✓ Correct answer: B

   The built-in operator policy gives read-only access plus the commands to enable and disable services and servers, which is exactly the maintenance need. read-only gives only show commands, network gives full access except the set and unset SSL commands and some show commands, sysadmin can perform all operations except shell access and user and partition configuration, and superuser has full access like nsroot.

   Why the other options are wrong

   • Asysadmin can perform nearly all operations, far more than enabling and disabling servers and services.
   • Cnetwork gives full access apart from the SSL set commands and a few show commands, far more than needed.
   • Dread-only allows show commands only, so the engineer could not enable or disable servers and services.
6. Question 61 Getting Started with Citrix ADC; 3 Citrix ADC Platforms

   An administrator makes several configuration changes on a NetScaler and wants them to survive a restart. What must be done, and where is the saved configuration kept?

   • ARun show ns runningConfig; it is kept in /var/log/ns.log
   • BRun sync ha files; it is kept in /var/nslog/newnslog
   • CNothing; changes are saved to /flash/boot as they are made
   • DRun save ns config; it is stored in /nsconfig/ns.confCorrect
   ✓ Correct answer: D

   NetScaler configurations are stored in /nsconfig/ns.conf, and for configurations to be available across sessions you must save the configuration after every change, with save ns config or the Save icon in the GUI. show ns runningConfig displays the running configuration and show ns ns.conf displays the saved one. Unsaved changes on a standalone appliance are lost at a restart or shutdown.

   Why the other options are wrong

   • Ashow ns runningConfig only displays the running configuration; ns.log is the event log.
   • BSynchronizing HA files copies files to a peer; the saved configuration is ns.conf in /nsconfig.
   • CChanges are not saved automatically; unsaved changes are lost at a restart of a standalone appliance.
7. Question 79 Rewrite, Responder, and URL Transform; 10 Content Switching; 11 Optimization

   While configuring URL transformation, an administrator tries to create transform actions first and add them to a profile afterwards. What does the documentation say about this order?

   • AIt is supported, since actions can be added to any profile later
   • BIt is optional, since actions can also be bound straight to policies
   • CIt is required, since a profile cannot be saved without actions
   • DIt is not possible, as the profile must exist before its actionsCorrect
   ✓ Correct answer: D

   A URL transformation profile describes a specific transformation as a series of actions, and it is a container that sets the order in which the actions are performed. You cannot create actions and then add them to a profile; you must create the profile first and then add actions to it, for example add transform profile, then add transform action and set transform action.

   Why the other options are wrong

   • AActions cannot be created and then added to a profile.
   • BPolicies are associated with profiles; actions live inside a profile.
   • CThe profile is created first; a profile does not need actions before it exists.
8. Question 86 SSL Offload

   A back-end web server requires the NetScaler to authenticate itself with a certificate when the appliance opens SSL connections to it. Which certificate is needed, and where is it bound?

   • AA client certificate and key, bound to the SSL serviceCorrect
   • BA server certificate and key, bound to the SSL service
   • CA CA certificate only, bound to the SSL virtual server
   • DA server certificate and key, bound to the SSL vserver
   ✓ Correct answer: A

   The appliance classifies certificates as server, client, CA, and unknown certificates. On the front end the appliance acts as a server, and a server certificate and private key are bound to an SSL virtual server. On the back end it acts as a client, and a client certificate and private key are bound to the SSL service or service group. CA certificates issue client and server certificates and typically do not need private keys.

   Why the other options are wrong

   • BA server certificate identifies the appliance to clients on the front end, not to back-end servers.
   • CA CA certificate on the virtual server checks client certificates; it does not authenticate the appliance to servers.
   • DA server certificate and key on the virtual server identify the appliance to clients on the front end (SSL certificates); toward the back-end servers the appliance acts as a client and uses a client certificate on the service.
9. Question 99 Rewrite, Responder, and URL Transform; 10 Content Switching; 11 Optimization

   A NetScaler administrator finds built-in rewrite actions whose names start with ns_cvpn. What can be done with them?

   • AModify their expressions, but not disable or delete them
   • BView, enable and disable them, but not modify or delete themCorrect
   • CRename them, but only while the rewrite feature is off
   • DDelete them, but only after unbinding all policies first
   ✓ Correct answer: B

   After enabling rewrite you configure actions unless a built-in rewrite action is enough. All built-in actions have names beginning with ns_cvpn and perform complex tasks such as decoding parts of a clientless VPN request or response or modifying JavaScript or XML data. They can be viewed, enabled and disabled, but cannot be modified or deleted.

   Why the other options are wrong

   • ABuilt-in actions cannot be modified, so their expressions cannot be changed.
   • CRenaming is a change, and built-in actions cannot be modified whether rewrite is on or off.
   • DBuilt-in actions cannot be deleted, even after unbinding the policies.
10. Question 101 Getting Started with Citrix ADC; 3 Citrix ADC Platforms

    After applying a new license file and rebooting, an administrator wants to confirm which license the appliance now has configured. Which command does Licensing overview name for this?

    • Ashow ns licenseserverpool
    • Bshow ns feature
    • Cshow hardware
    • Dshow ns licenseCorrect
    ✓ Correct answer: D

    The Licensing overview section says to use the show ns license command after rebooting the NetScaler appliance to find out the license that is configured. It uses show ns licenseserverpool separately, to display the licenses available on a license server.

    Why the other options are wrong

    • ALicensing overview uses show ns licenseserverpool to display licenses available from the license server; the configured license is shown by show ns license.
    • Bshow ns feature lists each feature with its ON or OFF status (Accelerate load balanced traffic by using compression), not which license is configured.
    • Cshow hardware reports platform details such as the SSL chips (Support for Intel Coleto and Intel Lewisburg SSL chip-based platforms), not the configured license.

Who this Citrix CCA-AppDS (Traffic Management track) practice exam is for

This practice set is for anyone preparing for the Citrix CCA-AppDS (Traffic Management track): Certified Associate - App Delivery and Security exam at the intermediate level - from first-time candidates building a foundation to experienced Citrix practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Citrix CCA-AppDS (Traffic Management track) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Citrix CCA-AppDS (Traffic Management track) exam.

Related Citrix resources

• Citrix CCA-AppDS (Traffic Management track) study guideKey concepts
• Citrix practice examsAll Citrix
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• Citrix CCA-V practice examRelated
• Citrix CCP-AppDS practice examRelated

Citrix CCA-AppDS (Traffic Management track) practice exam FAQ