Citrix CCP-AppDS: Certified Professional - App Delivery and Security Practice Exam

What the Citrix CCP-AppDS exam covers

• Authentication, Authorization, and Auditing (AAA-TM / nFactor)131 questions
• Web App Firewall (WAF)133 questions
• Content Switching, Rewrite, and Responder (AppExpert)132 questions
• NetScaler Optimization134 questions
• Citrix ADM, AppFlow, and Analytics134 questions
• GSLB and Advanced Traffic Management136 questions

Free Citrix CCP-AppDS practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 800.

1. Question 1Authentication, Authorization, and Auditing (AAA-TM / nFactor)

   An administrator wants to protect a load-balanced web application on a Citrix ADC 13.x appliance so that users must authenticate before traffic reaches the back-end servers. The authentication should be handled centrally rather than configured separately on each load balancing virtual server. Which configuration BEST achieves this in AAA-TM?

   • AEnable Integrated Caching on the load balancing virtual server and bind an LDAP service group so cached responses require credentials
   • BBind a responder policy to each load balancing virtual server that redirects unauthenticated clients to the LDAP server directly
   • CConfigure a content switching virtual server that routes login traffic to a dedicated back-end authentication server pool
   • DCreate an authentication (AAA) virtual server and bind it to the load balancing virtual server using the -authnVsName parameterCorrect
   ✓ Correct answer: D

   In AAA-TM, a dedicated authentication virtual server holds the authentication policies and login schema. Associating it with a load balancing virtual server via the -authnVsName parameter causes the LB vServer to redirect unauthenticated clients to the AAA vServer for credential validation. Once the AAA session is established, traffic flows to the back-end. This centralizes authentication logic so it can be reused across multiple applications without duplicating policy configuration on each individual virtual server.

   Why the other options are wrong

   • AIntegrated Caching accelerates content delivery and has no role in enforcing user authentication before traffic reaches back-end servers.
   • BA responder redirect to an LDAP server does not create an authenticated AAA session and would still require per-vserver configuration.
   • CContent switching routes requests based on content but does not centrally authenticate users or maintain AAA sessions.
2. Question 2Authentication, Authorization, and Auditing (AAA-TM / nFactor)

   While building AAA-TM audit logging, an administrator wants the Citrix ADC to forward AAA events to an external SIEM over UDP while also preserving them on the appliance for quick local review. Which combination of audit constructs satisfies this in Citrix ADC 13.x?

   • AA single NSLOG action with the SIEM's IP address configured as its remote server destination
   • BA SYSLOG action targeting the SIEM with its logFacility parameter set to NONE for local retention
   • CA SYSLOG action pointing to the SIEM plus an NSLOG action writing locally, each referenced by its own audit policyCorrect
   • DTwo SYSLOG actions, one for the SIEM and one for local files, bound through a single shared audit policy
   ✓ Correct answer: C

   Citrix ADC supports two distinct audit mechanisms: SYSLOG, which sends messages over UDP to an external syslog server or SIEM, and NSLOG, which can write either to a remote nslog server or to appliance-local newnslog files. To simultaneously forward AAA events to a SIEM over UDP and retain them locally, you create a SYSLOG action targeting the SIEM IP and an NSLOG action configured for local storage, then bind each through its own audit policy to the AAA virtual server or globally. Both destinations receive every matching event in real time.

   Why the other options are wrong

   • AAn NSLOG action pointed at the SIEM sends only the nslog format to that remote server and does not also keep a local copy.
   • BSetting logFacility to NONE suppresses categorization and does not create both a remote and a local destination.
   • DA single audit policy references exactly one action, so two SYSLOG actions cannot share one policy, and SYSLOG does not write to local newnslog files.
3. Question 3Web App Firewall (WAF)

   An administrator must protect a SOAP/XML API endpoint that also accepts query-string parameters. They want the SQL Injection check to inspect not only the body and query but also custom request headers used by the API. Which SQL Injection check option must be enabled?

   • ACheck for SQL Wildcard Characters
   • BSQL Comments Handling set to Nested
   • CInspectQueryContentTypes
   • DCheck Request HeadersCorrect
   ✓ Correct answer: D

   By default, the HTML SQL Injection check on NetScaler inspects form fields and query-string parameters. Enabling Check Request Headers extends the inspection scope to include HTTP request headers, which is critical for APIs that carry meaningful data such as custom authorization tokens, API keys, or other user-controlled values in headers. Without this option, a SQL injection payload delivered in a custom header would pass through undetected. This option directly addresses the requirement to inspect custom headers alongside query and body content.

   Why the other options are wrong

   • ACheck for SQL Wildcard Characters adds evaluation of wildcard characters (%, _) to the injection analysis but does not change which parts of the request - headers, body, or query - are inspected.
   • BSQL Comments Handling set to Nested changes how comment delimiters are parsed during inspection and does not extend the scope of inspection to request headers.
   • CInspectQueryContentTypes is not a named option of the SQL Injection check; content-type-based scope adjustments are controlled through separate content-type configuration settings, not by a setting with that exact name on the SQLi check.
4. Question 4Content Switching, Rewrite, and Responder (AppExpert)

   An administrator wants the content switching virtual server to forward any request that does NOT match any bound content switching policy. Which configuration achieves this?

   • ABind a default load balancing virtual server to the content switching vServer using the default (no-policy) target bindingCorrect
   • BCreate a content switching policy with the expression true and bind it at priority 1 to catch all requests
   • CEnable the -stateupdate option on the content switching vServer so unmatched requests are forwarded
   • DSet the content switching vServer redirect URL to the load balancing vServer FQDN for fallthrough
   ✓ Correct answer: A

   A content switching virtual server supports a dedicated default target binding where an LB vServer is bound without an associated policy. Any request that does not match any explicitly bound content switching policy is automatically forwarded to this default LB vServer, ensuring no client request is dropped or reset. This is the recommended and purpose-built NetScaler mechanism for providing a catch-all destination on a CS vServer.

   Why the other options are wrong

   • BA true policy at priority 1 would match everything, overriding real policies rather than acting as a default target.
   • CThe -stateupdate option affects state propagation, not routing of policy-unmatched requests.
   • DA redirect URL sends an HTTP redirect rather than forwarding unmatched traffic to a default target.
5. Question 5Content Switching, Rewrite, and Responder (AppExpert)

   A pattern set named "blocked_uris" contains 40 path fragments. The administrator must reference one specific entry and also know which entry matched at runtime so the responder action can log the index. Which expression returns the zero-based index of the matched pattern?

   • AHTTP.REQ.URL.PATH.CONTAINS_ANY("blocked_uris")
   • BHTTP.REQ.URL.PATH.EQUALS_ANY("blocked_uris")
   • CHTTP.REQ.URL.PATH.CONTAINS_INDEX("blocked_uris")Correct
   • DHTTP.REQ.URL.PATH.GET_PATTERN("blocked_uris")
   ✓ Correct answer: C

   The CONTAINS_INDEX operator searches the target string for any pattern in the named pattern set and returns the numeric index of the matching pattern, which can then be used in logging or further conditional logic. Each entry in a pattern set can be assigned a distinct index, and this operator surfaces that index so a responder action can record exactly which fragment triggered the match. This is the purpose-built operator for index-aware pattern set matching in NetScaler default-syntax expressions.

   Why the other options are wrong

   • ACONTAINS_ANY returns only a Boolean TRUE or FALSE indicating whether any pattern matched, so it cannot reveal which specific pattern set entry was responsible.
   • BEQUALS_ANY performs whole-string equality comparison against the set rather than a substring contains match, and it also returns only a Boolean rather than an index value.
   • DGET_PATTERN is not a valid default-syntax operator for pattern sets and would fail to compile.
6. Question 6NetScaler Optimization

   An administrator wants to confirm which FEO actions are configured and how often each optimization is being applied to a virtual server. In Citrix ADC 13.x, which approach provides per-action FEO statistics?

   • AInspecting the SSL certificate chain bound to the virtual server for optimization details
   • BReviewing the FEO action and policy bindings along with FEO statistics counters on the applianceCorrect
   • CRunning a GSLB site synchronization to gather per-action optimization figures
   • DChecking the NSIP route table to see how often each FEO action ran
   ✓ Correct answer: B

   To determine which FEO optimizations are active and how frequently they are applied, an administrator reviews the configured FEO actions, their policy bindings on the relevant virtual server, and the FEO statistics counters the ADC maintains. On Citrix ADC 13.x these counters track how many times each optimization type has been performed, providing direct visibility into the effectiveness and behavior of each configured FEO action per virtual server.

   Why the other options are wrong

   • AThe SSL certificate chain concerns TLS trust and carries no FEO per-action statistics.
   • CA GSLB site sync coordinates DNS sites and does not report FEO optimization counts.
   • DThe route table shows Layer 3 routing information, not how often FEO actions are applied.
7. Question 7Citrix ADM, AppFlow, and Analytics

   An administrator created a configuration job in Citrix ADM but wants it to execute automatically every Sunday at 02:00 to push a maintenance configuration. Which option must be set when creating the job?

   • AA StyleBook trigger on the target instances
   • BAn SNMP trap action on the ADM server
   • CA GSLB monitor with a 7-day interval
   • DA recurring schedule with the desired day and timeCorrect
   ✓ Correct answer: D

   Citrix ADM configuration jobs include built-in scheduling options that allow an administrator to set a one-time future execution or a recurring execution by specifying frequency, day, and time. Configuring a weekly recurring schedule for Sunday at 02:00 causes ADM to automatically execute the saved command set against the targeted instances at the specified time without requiring manual intervention, which is the intended mechanism for automating periodic maintenance configurations.

   Why the other options are wrong

   • AA StyleBook trigger on the target instances is not a real scheduling mechanism for configuration jobs; StyleBooks manage application configuration declaratively and do not trigger job execution.
   • BAn SNMP trap action on the ADM server generates or processes alert notifications; it cannot schedule or initiate configuration job execution.
   • CA GSLB monitor with a 7-day interval is a health-probe construct for global load balancing and is completely unrelated to scheduling configuration jobs.
8. Question 8Citrix ADM, AppFlow, and AnalyticsSelect all that apply

   An administrator is hardening proactive monitoring on a pair of NetScaler appliances using SNMPv3 for secure trap delivery to an enterprise NMS. Which TWO elements are required to enable authenticated and encrypted SNMPv3 communication? (Choose TWO)

   • AAn SNMP user with defined authentication and privacy protocolsCorrect
   • BAn SNMP view granting the user access to the required OID subtreeCorrect
   • CA clear-text community string matching the one set on the NMS
   • DA GSLB service group bound to the SNMP manager
   ✓ Correct answer: A, B

   SNMPv3 replaces the community-based access model of SNMPv1/v2c with the User-based Security Model (USM), requiring an SNMP user configured with an authentication protocol (such as SHA) and a privacy protocol (such as AES) along with their respective passphrases. That user must then be associated with an SNMP view that defines which OID subtree the user is authorized to access. Together these two elements establish authenticated identity and access-controlled authorization, enabling the appliance to send encrypted, authenticated SNMPv3 traps and respond to authenticated GETs.

   Why the other options are wrong

   • CA community string is SNMPv1/v2c authentication, sent in clear text; SNMPv3 replaces it with a user carrying authentication and privacy protocols.
   • DA GSLB service group is a load-balancing construct for distributing traffic across GSLB services and has no role in SNMP security configuration.
9. Question 9GSLB and Advanced Traffic Management

   A GSLB vserver uses static proximity. An administrator adds a new branch network whose public IP range is not present in the loaded location database. Clients from that range are being routed unpredictably. What is the most appropriate fix?

   • ASwitch the GSLB method to least connections so the unmapped branch range is routed consistently
   • BDisable site persistence on the vserver so the missing location entry no longer affects routing
   • CAdd a custom location entry mapping the new IP range to the correct location qualifiers in the location databaseCorrect
   • DLower the MEP keep-alive interval so the appliance refreshes the branch range's location faster
   ✓ Correct answer: C

   Static proximity selects the closest GSLB site by looking up the resolver IP in the loaded location database. When a range is absent from the database the appliance cannot assign a geographic location, so site selection falls back to a less deterministic method or picks arbitrarily among available sites. Adding a custom location entry that maps the new branch IP range to the appropriate location qualifiers - continent, country, region, city, or custom labels - gives static proximity the data it needs to make a correct, repeatable decision for clients from that network.

   Why the other options are wrong

   • ALeast connections is not a GSLB proximity method and does not resolve a missing location database entry.
   • BDisabling persistence changes session stickiness, not how an unmapped subnet is placed by static proximity.
   • DThe MEP interval governs metric exchange and does not populate location database entries.
10. Question 10Authentication, Authorization, and Auditing (AAA-TM / nFactor)

    After enabling AAA-TM with form-based authentication on a load balancing virtual server, users authenticate successfully but the back-end application still presents its own logon page, forcing a second sign-in. The administrator wants the ADC to replay the captured credentials to the application using HTTP form-based single sign-on. Which configuration is required?

    • AEnabling persistence on the load balancing virtual server so the same back-end server is reused
    • BA Traffic policy with a Form-SSO profile defining the SSO form action URL and field names, bound to the virtual serverCorrect
    • CAn authorization policy with an ALLOW action that references the application's back-end login URL directly
    • DA rewrite policy that strips the application's Set-Cookie header from the server response
    ✓ Correct answer: B

    AAA-TM authenticates the user to the appliance, but replaying credentials to a back-end application that has its own logon form requires Traffic Management SSO. You define a Form-SSO profile (the application's form action URL, the username/password field names, and any hidden fields), attach it to a Traffic action, and bind a Traffic policy to the AAA or LB virtual server so the ADC submits the saved credentials on the user's behalf. Hence the Traffic policy with a Form-SSO profile is the correct mechanism.

    Why the other options are wrong

    • APersistence keeps a client on one server but performs no single sign-on credential replay to the application.
    • CAuthorization policies permit or deny access; they cannot replay captured credentials into the app's logon form.
    • DStripping a Set-Cookie header does not submit the user's credentials, so the second login page still appears.

Who this Citrix CCP-AppDS practice exam is for

This practice set is for anyone preparing for the Citrix CCP-AppDS: Certified Professional - App Delivery and Security exam at the advanced level - from first-time candidates building a foundation to experienced Citrix practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Citrix CCP-AppDS practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Citrix CCP-AppDS exam.

Related Citrix resources

• Citrix CCP-AppDS study guideKey concepts
• Citrix practice examsAll Citrix
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• Citrix CCA-AppDS practice examRelated
• Citrix CCA-V practice examRelated

Citrix CCP-AppDS practice exam FAQ