In a Citrix ADC deployment with one interface in the DMZ and the other on the internal network, which deployment mode should be used?

• A. One-Arm
• B. Two-Arm
• C. Forward Proxy
• D. Transparent

Answer: (B)

In Citrix ADC, when you have a DMZ interface and a separate internal-network interface, you place the appliance between the two networks in a two-arm deployment. This mode uses one interface on the DMZ (facing the external clients) and another interface on the internal network (facing the servers). It allows the ADC to route and manage traffic between the front end and back end, enable proper load balancing to internal resources, and apply security policies across the two distinct networks without needing to NAT traffic across them.

A single-interface setup wouldn’t fit this topology because there isn’t a way to simultaneously border both networks from one NIC. A forward proxy is for outbound Internet requests and doesn’t address inbound traffic balancing between DMZ clients and internal servers. Transparent mode is an inline, Layer-2 bridging approach and isn’t the typical choice when you want clear separation and control between DMZ and internal networks. Two-arm provides clean separation, direct reachability to both sides, and is the standard fit for this scenario.