Scenario: A newly created Citrix Virtual Apps and Desktops site has sensitive information. The users consistently use different browsers for their daily tasks. A
Citrix Engineer is looking for ways to minimize attacks like ransomware, phishing, and session hijacking.
Which two steps can the engineer take to minimize attacks without interfering with user productivity? (Choose two.)
To minimize attacks like ransomware, phishing, and session hijacking without interfering with user productivity, the engineer can implement HTTP Strict Transport Security (HSTS) and use HTTP response headers to send security policies to endpoint browsers. HSTS ensures that browsers connect to websites over HTTPS, which secures the communication and prevents certain types of attacks. Using HTTP response headers to send security policies helps enforce security measures directly on the user's browser, providing additional protection without requiring changes to the user's behavior or disabling any essential functionality.
Seems it should be C and D • Use HTTPS for access to external web sites, especially if sensitive data will be transmitted. HTTP Strict Transport Security (HSTS) can be optionally implemented by web applications to prevent the use of HTTP for the web connection by using a special response header. • HTTP response headers can be used to send security policies to an endpoint’s browser, ultimately ensuring a more secure connection.
C & D are correct answer
shouldn't this be B&C?
I Don't think that HSTS is on Exam scope
Maybe it's really B+C
C&D are both NetScaler settings. I assume this is a CVAD environment, so the answer should be A&B
I go for C and D as A and B restrict the users productivity.
I believe this one should be C and D. While disabling user plugins would be good from a security standpoint, it doesn't meet the constraints of the question (minimize attacks *without interfering with user productivity*).
It should be B & C. HTTP Strict Transport Security (HSTS) can be optionally implemented by web applications to prevent the use of HTTP for the web connection by using a special response header. Source: CWS-315-2I-en-StudentManual-1-3-days-v02 - Page 246
I agree. B&C
HSTS do not help the client security in terms of pishing, ransomware. B is OK
C D are correct
Definitely B C makes sense: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html