Which mechanism can a Citrix Administrator use to restrict access to the Citrix ADC management IP (NSIP) address?

Which mechanism can a Citrix Administrator use to restrict access to the Citrix ADC management IP (NSIP) address?

• A. Command policy
• B. Access Control List (ACL)
• C. Authentication policy
• D. Authorization policy

Answer: (B)

Access Control List filtering is the right tool for limiting who can reach the Citrix ADC management IP. An ACL lets you specify which source IP addresses or networks are allowed to reach the NSIP (the management interface) and can deny everything else. By binding an ACL to the NSIP’s inbound traffic, you ensure that only trusted hosts can establish management sessions (GUI, SSH, REST, etc.), effectively securing the management plane. The other options operate at different stages of access: a command policy restricts which CLI commands a logged-in user can run, not who can initiate a connection to the NSIP; an authentication policy handles validating a user’s credentials during login; and an authorization policy determines what resources a user can access after authentication. None of these prevents the initial network reach to the management IP like an ACL does.

Access Control List filtering is the right tool for limiting who can reach the Citrix ADC management IP. An ACL lets you specify which source IP addresses or networks are allowed to reach the NSIP (the management interface) and can deny everything else. By binding an ACL to the NSIP’s inbound traffic, you ensure that only trusted hosts can establish management sessions (GUI, SSH, REST, etc.), effectively securing the management plane.

The other options operate at different stages of access: a command policy restricts which CLI commands a logged-in user can run, not who can initiate a connection to the NSIP; an authentication policy handles validating a user’s credentials during login; and an authorization policy determines what resources a user can access after authentication. None of these prevents the initial network reach to the management IP like an ACL does.