01. Scenario: A Citrix Engineer runs the following command:
import api specFile orders_v2 https://repo.example.com/orders_v2.json
When the engineer then tries to use an API specification named orders_v2 in a Web App Firewall profile, no such entity exists.
Which command should the engineer run next?
a) show api spec orders_v2
b) add api spec orders_v2 -File orders_v2 -Type OAS
c) update api spec orders_v2 -File orders_v2 -Type OAS
d) stat apispec orders_v2
02. Scenario: A Citrix Engineer is creating the profile for an online banking application. The plan is to configure HTML SQL Injection, HTML Cross-Site Scripting, the web form checks and Cookie Consistency, and to use the learning feature to build their relaxations.
Which command should the engineer use to create the profile?
a) add appfw profile bank_prof -defaults advanced
b) add appfw profile bank_prof -defaults basic
c) add appfw profile bank_prof -defaults core
d) add appfw profile bank_prof -defaults basic, then select Learn on each check
03. A Citrix Engineer reviews a profile that was created with:
add appfw profile api_core -defaults core
Which statement describes the security checks this profile enables by default?
a) Learning on every check that supports it, ready for relaxations
b) A limited fundamental set: grammar-based SQL and command injection, cross-site scripting, buffer overflow and block keywords
c) The web form checks: Form Field Consistency, Field Formats and CSRF Form Tagging
d) Every check enabled by basic defaults, plus the advanced form checks
04. Scenario: Each quarter, a Citrix Engineer creates new NetScaler Console configuration jobs that start from the same set of NTP and syslog commands. The engineer wants to store that command set once in Console, select it when creating each job, and also reuse it when building audit templates.
What should the engineer save the commands as?
a) A backup of one instance's configuration
b) A StyleBook imported into Console
c) A configuration template
d) A private IP block of the target instances
05. Scenario: A CA has issued the renewal of a certificate that is bound to SSL virtual servers on 12 NetScaler instances managed by NetScaler Console. The renewed certificate is already in the Console certificate store.
The Citrix Engineer must replace the certificate on every instance without logging on to the instances, writing CLI commands or building a configuration job.
What should the engineer do?
a) Link the installed certificate to the renewed certificate on the SSL dashboard
b) Add the renewed certificate's issuer to the enterprise policy as a trusted CA
c) Re-add the 12 instances to Console so that the certificate store copy is applied to them
d) Select the installed certificate on the SSL dashboard and update it with the renewal
06. A Citrix Engineer is deploying NetScaler Web App Firewall for the first time in a new environment.
Which set of objects makes up the initial security configuration?
a) A bot profile and a bot policy
b) A profile and an auditing policy
c) A policy, a profile and a signatures object
d) A policy label, a responder action and an HTML error object
07. Scenario: Cookie Consistency is enabled on a profile. A user edits a cookie that the website set, changing role=user to role=admin, and sends the next request.
How does the Cookie Consistency check handle the modified cookie?
a) It restores the original value that the appliance saved for the cookie and forwards the request
b) It strips the modified cookie from the request before forwarding it to the server
c) It forwards the cookie and adds a header that warns the server of tampering
d) It sends the cookie to Buffer Overflow for length checks
08. Scenario: A Citrix Engineer runs add appfw profile shop_guard -defaults advanced. The appliance returns an error and the profile is not created, although show appfw profile lists no profile with that name. The rewrite configuration on the same appliance already contains an action called shop_guard.
What is the cause?
a) The name is already used by an action
b) Advanced defaults can be used only after the learning feature is enabled
c) The add command must also set the profile type with -type HTML
d) A policy that references shop_guard must exist before the profile
09. A Citrix Engineer wants built-in NetScaler Web App Firewall protection for the VPN virtual server of a NetScaler Gateway deployment, without building a user-defined profile.
Which built-in profile is intended for this virtual server?
a) ns-aaa-default-appfw-profile
b) ns-vpn-default-appfw-profile
c) ns-aaatm-default-appfw-profile
d) APPFW_BLOCK, applied through a policy on the VPN virtual server
10. Scenario: A NetScaler Gateway appliance has been upgraded to a current 14.1 build. A security architect assumes that the built-in API specification for the authentication and VPN endpoint URLs hosted by NetScaler is already checking that traffic.
Which statement should the Citrix Engineer give the architect?
a) It is present on the appliance but disabled by default
b) It must first be imported with import api specFile and added as an entity
c) It runs only on Linux-based CPX and BLX deployments
d) It is enabled by default and validates every authentication request