Citrix CCP-AppDS: Certified Professional - App Delivery and Security Practice Exam

What the Citrix CCP-AppDS exam covers

• Authentication, Authorization, and Auditing (AAA-TM / nFactor)131 questions
• Web App Firewall (WAF)133 questions
• Content Switching, Rewrite, and Responder (AppExpert)132 questions
• Citrix ADC Optimization134 questions
• Citrix ADM, AppFlow, and Analytics134 questions
• GSLB and Advanced Traffic Management136 questions

Free Citrix CCP-AppDS sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 800.

1. Question 1Authentication, Authorization, and Auditing (AAA-TM / nFactor)

   An administrator wants to protect a load-balanced web application on a Citrix ADC 13.x appliance so that users must authenticate before traffic reaches the back-end servers. The authentication should be handled centrally rather than configured separately on each load balancing virtual server. Which configuration BEST achieves this in AAA-TM?

   • AEnable Integrated Caching on the load balancing virtual server and bind an LDAP service group so cached responses require credentials
   • BBind a responder policy to each load balancing virtual server that redirects unauthenticated clients to the LDAP server directly
   • CConfigure a content switching virtual server that routes login traffic to a dedicated back-end authentication server pool
   • DCreate an authentication (AAA) virtual server and bind it to the load balancing virtual server using the -authnVsName parameterCorrect
   ✓ Correct answer: D

   In AAA-TM, a dedicated authentication virtual server holds the authentication policies and login schema. Associating it with a load balancing virtual server via the -authnVsName parameter causes the LB vServer to redirect unauthenticated clients to the AAA vServer for credential validation. Once the AAA session is established, traffic flows to the back-end. This centralizes authentication logic so it can be reused across multiple applications without duplicating policy configuration on each individual virtual server.

   Why the other options are wrong

   • AIntegrated Caching accelerates content delivery and has no role in enforcing user authentication before traffic reaches back-end servers.
   • BA responder redirect to an LDAP server does not create an authenticated AAA session and would still require per-vserver configuration.
   • CContent switching routes requests based on content but does not centrally authenticate users or maintain AAA sessions.
2. Question 2Authentication, Authorization, and Auditing (AAA-TM / nFactor)

   An administrator wants AAA-TM authorization decisions to depend on whether the requested URL path begins with /finance. Which expression type should the authorization policy use in Citrix ADC 13.x to inspect the request path?

   • AAn advanced policy expression using HTTP.REQ.URL.PATH.STARTSWITH("/finance")Correct
   • BA rewrite action with a target of HTTP.RES.BODY
   • CA responder policy bound to the load balancing virtual server
   • DA classic expression referencing REQ.HTTP.HEADER Host
   ✓ Correct answer: A

   Citrix ADC authorization policies use advanced (default-syntax) policy expressions to evaluate request attributes. HTTP.REQ.URL.PATH returns the path portion of the requested URL, and the STARTSWITH operator tests whether it begins with /finance. Binding an authorization policy with this rule and an ALLOW or DENY action lets the ADC make per-request decisions based on the requested resource path. Advanced expressions are the supported and recommended syntax for authorization in ADC 13.x.

   Why the other options are wrong

   • BA rewrite action targeting HTTP.RES.BODY modifies response content and performs no authorization decision for AAA-TM.
   • CA responder policy bound to the load balancing virtual server returns or redirects responses but is not an AAA-TM authorization policy and does not enforce per-user access control.
   • DA classic expression referencing REQ.HTTP.HEADER Host inspects the Host header rather than the URL path, and classic policy syntax is deprecated for authorization in 13.x.
3. Question 3Web App Firewall (WAF)

   A web application uses heavily dynamic JavaScript that builds requests on the fly. The administrator wants to protect against XSS but is worried that strict checking will break the application. Which Citrix ADC 13.x Web App Firewall feature, used before going to block mode, helps build accurate XSS relaxations from real traffic?

   • AThe scheduled signatures auto-update feature that refreshes negative-security rules from Citrix
   • BThe HTTP callout feature that queries an external service for a decision
   • CThe learning feature for the HTML Cross-Site Scripting checkCorrect
   • DA rate-limiting policy that throttles clients sending suspicious request bursts
   ✓ Correct answer: C

   The Web App Firewall learning engine, when enabled for the HTML Cross-Site Scripting check, passively observes live traffic that triggers the XSS inspection and generates relaxation recommendations identifying which fields and URLs legitimately contain content that would otherwise be flagged. The administrator reviews these data-driven recommendations, deploys appropriate exemptions for the dynamic JavaScript content, and then moves the check into block mode with significantly reduced false-positive risk. This learn-then-enforce workflow is the Citrix-recommended approach for protecting complex, dynamically built applications.

   Why the other options are wrong

   • ASignature auto-update refreshes negative-security patterns and does not build positive-security XSS relaxations from traffic.
   • BHTTP callout queries an external server for a decision and has no role in generating XSS relaxation recommendations.
   • DRate limiting controls request volume and does nothing to profile legitimate XSS input for relaxation tuning.
4. Question 4Content Switching, Rewrite, and Responder (AppExpert)

   A content switching virtual server must route requests for the host shop.example.com to a load balancing vServer named lb_shop. Which advanced policy expression correctly matches that host header value?

   • AHTTP.REQ.URL.CONTAINS("shop.example.com")
   • BCLIENT.IP.SRC.EQ("shop.example.com")
   • CHTTP.REQ.HOSTNAME.EQ("shop.example.com")Correct
   • DHTTP.RES.HEADER("Host").EQ("shop.example.com")
   ✓ Correct answer: C

   The HTTP.REQ.HOSTNAME prefix extracts the value of the Host header from the inbound client request, and the EQ() operator performs a case-insensitive exact string match against the specified hostname. Because content switching decisions are evaluated on the inbound request, the expression must operate on HTTP.REQ, making this the standard and correct way to route traffic based on the requested host on a Citrix ADC 13.x content switching vServer.

   Why the other options are wrong

   • AHTTP.REQ.URL.CONTAINS("shop.example.com") inspects the request URL path and query string rather than the Host header, so it would not reliably match the hostname and could produce false positives.
   • BCLIENT.IP.SRC.EQ evaluates the client source IP address, which is a network address and cannot be compared to a DNS hostname string.
   • DHTTP.RES.HEADER("Host") references a response header, but content switching evaluates the client request before a server response exists, making HTTP.RES invalid in this context.
5. Question 5Content Switching, Rewrite, and Responder (AppExpert)

   An engineer wants a rewrite policy to fire only when the client requested HTTPS AND the URL query string contains the parameter "debug". Which default-syntax expression correctly combines these conditions?

   • ACLIENT.SSL.IS_SSL && HTTP.REQ.URL.QUERY.CONTAINS("debug")Correct
   • BHTTP.REQ.IS_SSL.AND(HTTP.REQ.URL.QUERY.EXISTS("debug"))
   • CCLIENT.SSL.IS_SSL.CONTAINS("debug")
   • DCLIENT.SSL.IS_SSL || HTTP.REQ.URL.QUERY.CONTAINS("debug")
   ✓ Correct answer: A

   The && operator is the logical AND in Citrix ADC default-syntax expressions, so the combined rule is TRUE only when both operands are TRUE. CLIENT.SSL.IS_SSL returns a Boolean indicating the connection is over SSL/TLS, and HTTP.REQ.URL.QUERY.CONTAINS("debug") returns TRUE when the query string contains the substring debug. This compound expression precisely encodes the requirement that both an HTTPS connection and the debug query parameter must be present before the rewrite policy fires.

   Why the other options are wrong

   • BThe expression HTTP.REQ.IS_SSL is not a valid prefix; SSL state is exposed under the CLIENT.SSL namespace, and QUERY.EXISTS is not a valid query operator for substring testing.
   • CThe expression chaining .CONTAINS onto CLIENT.SSL.IS_SSL is invalid because IS_SSL returns a Boolean value and CONTAINS is a text operator that cannot be applied to a Boolean.
   • DThe variant using || is a logical OR, which fires when either condition is true rather than requiring both, contradicting the AND requirement.
6. Question 6Citrix ADC Optimization

   An administrator wants to confirm which FEO actions are configured and how often each optimization is being applied to a virtual server. In Citrix ADC 13.x, which approach provides per-action FEO statistics?

   • AInspecting the SSL certificate chain bound to the virtual server for optimization details
   • BReviewing the FEO action and policy bindings along with FEO statistics counters on the applianceCorrect
   • CRunning a GSLB site synchronization to gather per-action optimization figures
   • DChecking the NSIP route table to see how often each FEO action ran
   ✓ Correct answer: B

   To determine which FEO optimizations are active and how frequently they are applied, an administrator reviews the configured FEO actions, their policy bindings on the relevant virtual server, and the FEO statistics counters the ADC maintains. On Citrix ADC 13.x these counters track how many times each optimization type has been performed, providing direct visibility into the effectiveness and behavior of each configured FEO action per virtual server.

   Why the other options are wrong

   • AThe SSL certificate chain concerns TLS trust and carries no FEO per-action statistics.
   • CA GSLB site sync coordinates DNS sites and does not report FEO optimization counts.
   • DThe route table shows Layer 3 routing information, not how often FEO actions are applied.
7. Question 7Citrix ADM, AppFlow, and Analytics

   An administrator created a configuration job in Citrix ADM but wants it to execute automatically every Sunday at 02:00 to push a maintenance configuration. Which option must be set when creating the job?

   • AA StyleBook trigger on the target instances
   • BAn SNMP trap action on the ADM server
   • CA GSLB monitor with a 7-day interval
   • DA recurring schedule with the desired day and timeCorrect
   ✓ Correct answer: D

   Citrix ADM configuration jobs include built-in scheduling options that allow an administrator to set a one-time future execution or a recurring execution by specifying frequency, day, and time. Configuring a weekly recurring schedule for Sunday at 02:00 causes ADM to automatically execute the saved command set against the targeted instances at the specified time without requiring manual intervention, which is the intended mechanism for automating periodic maintenance configurations.

   Why the other options are wrong

   • AA StyleBook trigger on the target instances is not a real scheduling mechanism for configuration jobs; StyleBooks manage application configuration declaratively and do not trigger job execution.
   • BAn SNMP trap action on the ADM server generates or processes alert notifications; it cannot schedule or initiate configuration job execution.
   • CA GSLB monitor with a 7-day interval is a health-probe construct for global load balancing and is completely unrelated to scheduling configuration jobs.
8. Question 8Citrix ADM, AppFlow, and AnalyticsSelect all that apply

   An administrator is hardening proactive monitoring on a pair of Citrix ADC appliances using SNMPv3 for secure trap delivery to an enterprise NMS. Which TWO elements are required to enable authenticated and encrypted SNMPv3 communication? (Choose TWO)

   • AAn SNMP user with defined authentication and privacy protocolsCorrect
   • BAn SNMP view granting the user access to the required OID subtreeCorrect
   • CA clear-text community string matching the NMS
   • DA GSLB service group bound to the SNMP manager
   ✓ Correct answer: A, B

   SNMPv3 replaces the community-based access model of SNMPv1/v2c with the User-based Security Model (USM), requiring an SNMP user configured with an authentication protocol (such as SHA) and a privacy protocol (such as AES) along with their respective passphrases. That user must then be associated with an SNMP view that defines which OID subtree the user is authorized to access. Together these two elements establish authenticated identity and access-controlled authorization, enabling the appliance to send encrypted, authenticated SNMPv3 traps and respond to authenticated GETs.

   Why the other options are wrong

   • CA clear-text community string is an SNMPv1/v2c construct and is not used by SNMPv3, which uses the User-based Security Model instead of community strings.
   • DA GSLB service group is a load-balancing construct for distributing traffic across GSLB services and has no role in SNMP security configuration.
9. Question 9GSLB and Advanced Traffic Management

   A GSLB vserver uses static proximity. An administrator adds a new branch network whose public IP range is not present in the loaded location database. Clients from that range are being routed unpredictably. What is the most appropriate fix?

   • ASwitch the GSLB method to least connections so the unmapped branch range is routed consistently
   • BDisable site persistence on the vserver so the missing location entry no longer affects routing
   • CAdd a custom location entry mapping the new IP range to the correct location qualifiers in the location databaseCorrect
   • DLower the MEP keep-alive interval so the appliance refreshes the branch range's location faster
   ✓ Correct answer: C

   Static proximity selects the closest GSLB site by looking up the resolver IP in the loaded location database. When a range is absent from the database the appliance cannot assign a geographic location, so site selection falls back to a less deterministic method or picks arbitrarily among available sites. Adding a custom location entry that maps the new branch IP range to the appropriate location qualifiers - continent, country, region, city, or custom labels - gives static proximity the data it needs to make a correct, repeatable decision for clients from that network.

   Why the other options are wrong

   • ALeast connections is not a GSLB proximity method and does not resolve a missing location database entry.
   • BDisabling persistence changes session stickiness, not how an unmapped subnet is placed by static proximity.
   • DThe MEP interval governs metric exchange and does not populate location database entries.
10. Question 10Authentication, Authorization, and Auditing (AAA-TM / nFactor)

    After enabling AAA-TM with form-based authentication on a load balancing virtual server, users authenticate successfully but the back-end application still presents its own logon page, forcing a second sign-in. The administrator wants the ADC to replay the captured credentials to the application using HTTP form-based single sign-on. Which configuration is required?

    • AEnabling persistence on the load balancing virtual server so the same back-end server is reused
    • BA Traffic policy with a Traffic action (Form-SSO profile) defining the SSO form action URL and field names, bound to the AAA/LB virtual serverCorrect
    • CAn authorization policy with an ALLOW action that references the application's back-end login URL
    • DA rewrite policy that strips the application's Set-Cookie header from the server response
    ✓ Correct answer: B

    AAA-TM authenticates the user to the appliance, but replaying credentials to a back-end application that has its own logon form requires Traffic Management SSO. You define a Form-SSO profile (the application's form action URL, the username/password field names, and any hidden fields), attach it to a Traffic action, and bind a Traffic policy to the AAA or LB virtual server so the ADC submits the saved credentials on the user's behalf. Hence the Traffic policy with a Form-SSO profile is the correct mechanism.

    Why the other options are wrong

    • APersistence keeps a client on one server but performs no single sign-on credential replay to the application.
    • CAuthorization policies permit or deny access; they cannot replay captured credentials into the app's logon form.
    • DStripping a Set-Cookie header does not submit the user's credentials, so the second login page still appears.

Related Citrix resources

• Citrix CCP-AppDS study guideKey concepts
• Citrix practice examsAll Citrix
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• Citrix CCA-V practice examRelated
• Citrix CCA-AppDS practice examRelated

Citrix CCP-AppDS practice exam FAQ