Where should a CERT authentication policy be bound to apply to Citrix Gateway traffic?

• A. The AAA virtual server
• B. Citrix Gateway virtual server
• C. Content Switching virtual server
• D. Global policy

Answer: (B)

Certificate-based authentication for Citrix Gateway should be applied at the gateway termination point. The Citrix Gateway virtual server is the entity that terminates the gateway connections and handles all gateway traffic, so binding the CERT authentication policy there ensures every gateway session presents and is validated against the client certificate before access is granted.

Binding this policy to a AAA virtual server would affect a different authentication path (non-gateway traffic), binding to a Content Switching virtual server would apply only to traffic routed through that switch, and binding at global level would affect all traffic, not just gateway traffic. For gateway-specific authentication, the gateway virtual server is the correct binding point.