Citrix 1Y0-204 CCA-V Citrix Virtual Apps and Desktops 7 Administration exam Exam Practice Test

Typically, the migration of existing profiles to a new profile management system occurs during the user’s first logon after the policy has been applied, as this is when the user’s profile is first accessed and can be migrated.

https://docs.citrix.com/en-us/workspace-environment-management/current-release/user-interface-description/policies-and-profiles/citrix-upm-settings.html

 According to the Citrix documentation, the -denySSLReneg parameter specifies the type of SSL renegotiation that the Citrix ADC denies. The possible options are:

NONSECURE: Deny renegotiation requests from a client if the initial handshake between the Citrix ADC and the client is not secure. A secure handshake is one in which both parties prove their identities to each other by presenting valid certificates.

FRONTEND_CLIENT: Deny renegotiation requests from a client on a front-end SSL connection, regardless of whether the initial handshake is secure or not. A front-end SSL connection is one in which the Citrix ADC communicates with the client over SSL.

ALL: Deny all renegotiation requests from a client on a front-end SSL connection and from a server on a back-end SSL connection. A back-end SSL connection is one in which the Citrix ADC communicates with the server over SSL.

NO: Allow all renegotiation requests.

Therefore, the correct answer is A and C.

 A resource location is a collection of resources that you use to deliver applications and desktops to users. It can include Citrix ADC, VDA, Active Directory Domain, and Hypervisor. These resources are required for hosting and managing the machines that deliver apps and desktops to users1. StoreFront, Citrix Director, Citrix Provisioning, and Database are not part of a resource location, but are components of the Citrix Cloud service2.

Option B is correct because spillover policies are applied on the GSLB virtual server level, not on the individual GSLB service level. Therefore, the user cannot have a backup for a subset of GSLB services1.

Option C is correct because the selection of a GSLB service is based on the load balancing method configured on the GSLB virtual server, which applies to all the GSLB services bound to it. The user cannot restrict the selection of a GSLB service from a subset of GSLB services for the given domain1.

Option A is incorrect because an administrator can define a backup for a backup Vserver in an active standby GSLB setup for a given GSLB domain by using the backup domain option2.

Option D is incorrect because a GSLB Vserver can load-balance multiple FQDNs by using the domain list option

Citrix policies allow administrators to centrally manage session behavior, client-side functionality, and resource control across a Citrix Virtual Apps and Desktops deployment. Citrix documentation identifies the following components as manageable through Citrix policy settings:

✔ Citrix Workspace app (A)

Policies such as client drive mapping, clipboard redirection, client audio, USB device redirection, and session graphics settings directly affect Workspace app behavior. These are configured through Citrix policies and enforced on the client during ICA sessions.

✔ Citrix Profile Management (B)

Citrix Profile Management (UPM) is managed entirely through Citrix policies (either via Studio or GPO). These policies control profile streaming, folder redirection integration, exclusions, synchronization, and profile handling behavior.

✔ Delivery Controller (E)

Policies determine how sessions are brokered and how Delivery Controllers enforce settings such as session reliability, load management, visual experience, printing, and bandwidth control.

Why the other choices are incorrect:

StoreFront (C): StoreFront has its own dedicated management console and configuration files. It is not managed through Citrix policies.

Citrix License Server (D): Licensing is handled by the License Server console—not by Citrix policies.

Documentation References

Citrix Virtual Apps and Desktops → Policy Overview

Citrix Profile Management Policy Settings Guide

Workspace App ICA Policy and Client Control Settings

Citrix Policy Processing in Delivery Controllers

Citrix Studio is the management console that allows administrators to provide customized permissions, including adding applications to junior administrators1.

The Machine Utilization report in the Machine Details page shows the CPU, memory, disk, and network usage of the selected machine over time1. This can help the Citrix Administrator identify any resource bottlenecks or spikes that may affect the performance of the applications launched from the published desktop session. The other reports do not provide information about the machine’s resource utilization, but rather about the user’s connection, session, and application launch failures2.

1: Machine utilization | Director - Citrix Product Documentation 2: Troubleshoot user issues | Director - Citrix Product Documentation

Pass-through from NetScaler Gateway is the authentication method that allows external users to access internal resources through StoreFront without having to enter their credentials again. This method requires that users authenticate on NetScaler Gateway, which then passes the user identity to StoreFront. This option is only available if it has been enabled for the store. See Pass-through from Citrix Gateway for more details.

According to the Delivery Controllers document, Citrix recommends having at least two Controllers on different physical servers for redundancy and scalability in a production site. The document also states that “additional Controllers enable you to handle more users and more applications and desktop requests, and can improve overall responsiveness.” Therefore, the minimum number of Delivery Controllers required to deploy Citrix Virtual Apps and Desktops for 500 users is 2.

A SSL profile is a collection of SSL settings that define the SSL behavior of a virtual server. A Citrix Administrator can use SSL profiles to apply the same SSL settings to multiple SSL virtual servers, which simplifies the configuration and management of SSL parameters1.

1: SSL Profiles

According to the policy priority and filtering, the Accounting users will match the policy “Accounting”, which has ‘Client Network Drives’ enabled and ‘Client Fixed Drives’ not configured. The policy “Baseline” will not apply because it has a lower priority. Therefore, the Accounting users will be able to access only the client network drives, and not the client fixed drives. This is confirmed by the Citrix documentation on policy filtering and precedence.

Comprehensive and Detailed Explanation

(Paraphrased — Citrix-Accurate)

Citrix provides a feature called Browser Content Redirection (BCR), which allows web content to be offloaded from the VDA to the endpoint device. This includes HTML5 content, videos, and general web rendering tasks.

Key points about BCR from Citrix documentation:

Web pages render directly on the client, not inside the VDA session

This reduces CPU and GPU load on the VDA

Improves performance for video-heavy or media-rich websites

Enhances scalability for multi-user server OS environments

Works with supported browsers (e.g., Chrome, Edge) with Citrix policies enabled

Therefore, BCR is the correct feature when the administrator wants rendering to occur locally on the client machine rather than on the server.

Why the other options are incorrect:

A. Microsoft Teams OptimizationOnly optimizes Teams audio/video meetings — not general web or video content.

B. Enlightened Data Transport (EDT)Optimizes ICA transport protocol, not browser rendering.

D. Citrix OptimizerA tool for tuning OS images; does not handle content redirection.

Documentation References

Citrix Virtual Apps and Desktops Policy Settings → Browser Content Redirection

Citrix Workspace App Documentation → Client-Side Rendering Features

HDX Optimization Features Guide → BCR Overview

According to the Citrix Virtual Apps and Desktops 7 Deployment and Administration course, Citrix Provisioning can reduce the total number of writes on the storage by using a single shared image that is streamed to multiple target devices. This eliminates the need to store multiple copies of the same image on the storage. The course also states that Citrix Provisioning can reduce the storage requirements by up to 90% compared to traditional methods1

1: CWS-215: Citrix Virtual Apps and Desktops 7 Deployment and Administration, Module 9: Implementing Citrix Provisioning, Lesson: Introduction to Citrix Provisioning, Slide 6.

In the scenario described, when network connectivity to Citrix Cloud is lost, the Local Host Cache (LHC) feature allows one of the Citrix Cloud Connectors at the resource location to become the primary broker. This enables it to broker new sessions and manage existing HDX connections using the LHC, ensuring continuity of service during outages

The administrator received this error because they did not run the Add-PSSnapin Citrix* command before running the Get-BrokerSite PowerShell command. This is required to load the Citrix PowerShell snap-ins.

The Get-BrokerSite PowerShell command retrieves information about the site, including the name of the deployment, the local host cache configuration, and the license level. This command is part of the Citrix Virtual Apps and Desktops 7 Administration toolkit and is used to manage various aspects of the site configuration.

 CDF Control is a tool that can be used to collect information to investigate issues with session performance. CDF Control allows the administrator to enable and disable tracing, collect trace logs, and analyze them using Citrix Scout or Citrix Insight Services

According to the Citrix Cloud documentation1, a Citrix Administrator needs to supply the following information when creating a silent installation of the Cloud Connector:

The customer ID of the Citrix Cloud account for which the administrator is installing the Cloud Connector.

The client ID and secret of the secure API client the administrator wants to use to install the Cloud Connector.

The resource location ID for the resource location that the administrator wants to associate with the Cloud Connector. If the administrator does not supply this value, Citrix Cloud uses the ID of the default resource location.

Therefore, the correct answer is C, Resource Location ID.

1: Install Cloud Connectors from the command line | Citrix Cloud

Application Lingering allows applications to stay open for a configurable amount of time after a user closes them, which can reduce application launch times in subsequent sessions.

A SSL profile is a collection of SSL settings that define the SSL behavior of a virtual server. A Citrix Administrator can use SSL profiles to apply the same SSL settings to multiple SSL virtual servers, which simplifies the configuration and management of SSL parameters1.

1: SSL Profiles

VDA registration can be configured using:

Group Policy Object (GPO): Policy-based configuration using LGPO or GPO.

Organizational Unit (OU) based Controller discovery: Legacy OU discovery method.

MCS-based PERSONALITY.INI: Using the personality.ini file for MCS-based deployments.

These methods ensure that the VDA has accurate and current Controller or Cloud Connector information as Controllers are added, moved, and removed in the site1.

The dig +trace command can be used to resolve DNS requests by tracing the path from the root name servers to the authoritative name servers. This can help identify any issues with DNS resolution or delegation. The nslookup command can also be used to query DNS records, but it does not provide the trace option. The curl command can be used to transfer data from or to a server, but it does not resolve DNS requests. The ping command can be used to test the connectivity and latency between two hosts, but it does not resolve DNS requests.

Application Prelaunch is a feature that allows users to launch applications faster by creating a session when the user logs on to Citrix Workspace app, before the user requests an application. This feature is enabled by Delivery Group and can be configured for all users or a subset of users1.

Session Sharing is a feature that allows users to launch multiple applications using the same session, reducing the load on the server and improving the user experience. This feature is enabled by default and can be configured using Citrix policies2.

1: Prelaunch and linger 2: Session Sharing Explained with Troubleshooting Steps

When using Machine Creation Services, the Delivery Controller must communicate with the configured hosting connection (such as VMware, Hyper-V, Citrix Hypervisor, Nutanix AHV). This communication enables provisioning, power management, and information retrieval from the hypervisor.

Citrix documentation defines the Citrix Host Service as the Delivery Controller service responsible for:

Managing hypervisor connections

Sending provisioning and power-action commands

Communicating with hosting infrastructure APIs

Initiating VM creation and updates for MCS catalogs

The Citrix Broker Service manages session brokering, not hypervisor communication.

The Citrix Environment Test Service focuses on diagnostics.

“Citrix Hypervisor Service” is not a Citrix Delivery Controller service.

Therefore, the correct service enabling Controller-to-hypervisor communication is the Citrix Host Service.

Documentation References:

Citrix Virtual Apps and Desktops → Delivery Controller Services Overview

Citrix Host Service Description within Hosting Connections

The ns_allow expression always evaluates to true, which means it allows all users access through the vServer. The ns_disallow and ns_false expressions always evaluate to false, which means they deny all users access. The ns_true expression is not a valid policy expression1

1: Citrix ADC 13.0 - Policy Expressions

 According to the Citrix documentation1, persistence time-out is the parameter that determines how long the service continues to serve requests from the client after it is disabled manually. The service accepts new requests or connections only to honor persistence. After the persistence time-out expires, no new requests or connections are directed to the service and all of the existing connections are closed. This parameter is available only when the service is disabled gracefully. The default value is 2 minutes. The other options are not related to the scenario described in the question.

According to the Citrix Virtual Apps and Desktops 7 Deployment and Administration documentation1, the collation sequence for the site database should be _100_CI_AS_KS. This collation sequence is case-insensitive, accent-sensitive, kana-sensitive, and width-insensitive. It is also compatible with the SQL Server mirroring feature. Other collation sequences might cause errors or unexpected behavior when using SQL Server mirroring2.

Gateway Insight provides information about user authentication failures, such as the failure reason, the time of failure, and the number of failures1. It also shows the list of users who faced authentication failures and the authentication type they used2.

StoreFront system requirements in the Citrix 2402 LTSR documentation specify that StoreFront can only be installed on supported modern Windows Server operating systems. As of the 2402 LTSR release, the minimum supported OS for StoreFront is Windows Server 2019.

Windows Server 2016 and Windows Server 2012 R2 are no longer supported for StoreFront in the 2402 LTSR lifecycle.

Windows Server 2022 is supported, but it is not the minimum requirement — Server 2019 is.

Documentation References:

Citrix StoreFront 2402 LTSR System Requirements

Citrix Virtual Apps and Desktops 2402 LTSR Product Documentation → StoreFront Requirements

The Cloud Connector requires outbound connectivity on port 443 for communication with the internet2

Enabling NTUSER.DAT backup allows Profile Management to maintain a last known good backup of the NTUSER.DAT file and use it to recover the profile if corruption is detected. This can help prevent data loss from users’ profiles. According to the Registry policy settings document, “If you do not configure this policy here or in the.ini file, Profile Management does not back up NTUSER.DAT.” The other options are not relevant to preventing profile corruption or data loss.

Enabling NTUSER.DAT backup allows Profile Management to maintain a last known good backup of the NTUSER.DAT file and use it to recover the profile if corruption is detected. This can help prevent data loss from users’ profiles. According to the Registry policy settings document, “If you do not configure this policy here or in the.ini file, Profile Management does not back up NTUSER.DAT.” The other options are not relevant to preventing profile corruption or data loss.

According to the policy priority and filtering, the Accounting users will match the policy “Accounting”, which has ‘Client Network Drives’ enabled and ‘Client Fixed Drives’ not configured. The policy “Baseline” will not apply because it has a lower priority. Therefore, the Accounting users will be able to access only the client network drives, and not the client fixed drives. This is confirmed by the Citrix documentation on policy filtering and precedence.

 The Secure Ticket Authority (STA) server locations must be configured on the Citrix Gateway and StoreFront to facilitate secure external access. The Citrix Gateway uses STA to validate session requests and the StoreFront communicates with the STA to manage user sessions securely.

 To allocate the Citrix Virtual Desktops license file from the Citrix.com account, a Citrix Administrator needs the hostname of the Citrix License Server. The hostname is case sensitive and must match the name entered in the Citrix Licensing Manager or the License Server Console

According to the Citrix Virtual Apps and Desktops 7 Deployment and Administration course description12, the course covers how to deploy and manage machines running the VDA in both on-premises datacenters and public clouds, such as AWS1. The Citrix Virtual Apps and Desktops service also supports Azure and Google Cloud Platform as resource locations for VDAs3. Citrix Cloud is not a resource location, but a platform that hosts the Citrix Virtual Apps and Desktops service3. VMware Workspace One is not a supported resource location for VDAs, but a competing product from VMware.

The NSIP address is the NetScaler-owned IP address that uniquely identifies the NetScaler on your network, and it provides access to the appliance. By default, the NSIP is the source IP address for packets originating from the NetScaler appliance, such as packets destined for NTP servers1.

1: Configuring NetScaler-owned IP addresses | Networking

According to the Citrix documentation, when you bind an interface to a VLAN, the native VLAN of the interface changes to the VLAN to which it is bound. In this scenario, the native VLAN of interface 1/1 was 40 before the command was executed, so it remains 40 after the command is executed. The command does not change the native VLAN of the interface, only the VLAN to which it is bound. Therefore, the correct answer is B.

 According to the IBM documentation1, the Corrupt qualifier is used to modify the HTTP header of an HTTP request. The Corrupt qualifier changes the current value to a different value for a request or response header. If a value exists for the header, then this value is changed equivalent to a regular expression search and replace.

According to the Create store page from the Citrix Product Documentation, the administrator can create a store for unauthenticated users by ticking the option “Allow only unauthenticated users to access this store” when creating the store. This option is suitable for contractors who will not be Active Directory users and need access to specific resources. The other options (HTTP Basic, Smart card, and Pass-through) are authentication methods that require user credentials.

According to the Citrix documentation, the command bind cs vserver MYVPN_http -lbvserver Vserver-CS-1 binds a load balancing virtual server to a content switching virtual server. This means that the content switching virtual server will forward the requests that match its policies to the load balancing virtual server. In this case, the content switching virtual server MYVPN_http has a policy that matches requests for http://server.citrix.lab, so it will forward those requests to the load balancing virtual server Vserver-CS-1. Therefore, the users trying to access http://server.citrix.lab will be connected to the Vserver MYVPN_http, which will then connect them to Vserver-CS-1.

According to the Citrix Virtual Apps and Desktops 7 Deployment and Administration guide, the expression CLIENT.SSL.CLIENT_CERT.VALID_NOT_AFTER.EQ(GMT2020) checks whether the client certificate is valid until the specified date (GMT2020). The other expressions are either incorrect or irrelevant for this requirement.

Gateway Insight provides information about user authentication failures, such as the failure reason, the time of failure, and the number of failures1. It also shows the list of users who faced authentication failures and the authentication type they used2.

The Applications and Trends features within Citrix Director can be used to view historical resource utilization for a machine running the VDA. The Applications feature shows the application usage and resource consumption of each application on a specific machine2. The Trends feature shows the historical trends of various metrics such as CPU, memory, disk, and network utilization for a specific machine3.

Citrix Director can capture utilization statistics for CPU, IOPS, and memory for each machine in a selected delivery group1. The resource utilization tab in the trends page displays the historical data for these metrics, along with the peak concurrent sessions graph2. The machine statistics page also shows the CPU and memory usage of the selected machine over time, as well as the processes contributing to high resource consumption3. Citrix Director does not capture utilization statistics for disk space or network, but it does provide other information related to these components, such as disk latency4 and network analysis5.

1: Monitor historical trends across a site | Director 2: How to use Director to monitor storage performance - Citrix 3: Machine Statistics | Citrix Analytics for Performance 4: Citrix Director Provides Disk Usage Information 5: [Network analysis | Director]

Without a bound SSL certificate, the SSL virtual server cannot establish secure connections and will be in a DOWN state.

According to the Citrix documentation, “To enable SSL offloading for a virtual server, you must bind an SSL certificate to the virtual server.”

The image you sent shows the configuration commands for setting up an SSL virtual server and services. However, there is no command to bind an SSL certificate to the virtual server.

Therefore, the correct answer is D. The SSL Certificate is NOT bound to the virtual server.

https://docs.citrix.com/en-us/citrix-adc/13/ssl/ssl-offload-howto.html

According to the Citrix documentation1, the Least Response Time method uses the response time of the monitor probes to determine the best service. However, this method requires that a monitor is bound to each service and that the monitor response times are recorded. Therefore, the virtual server uses the Round Robin method until each bound service has been probed by the monitor at least once. This mode is called startup round robin mode2.

 The administrator should negate the expression of the Responder policy to avoid the HTTP callout recursion issue. According to the Citrix documentation, “If you configure an HTTP callout policy that is bound globally, you must ensure that the policy expression does not match the callout request. Otherwise, the callout request will trigger the policy, resulting in a callout recursion.” The expression in option B ensures that the policy does not match the callout request by adding the NOT operator at the end.

https://docs.citrix.com/en-us/citrix-adc/13/appexpert/http-callout/http-callout-policy.html

The issue is caused by the policy expression of the no_chunk_pol being ‘true’ and ‘NOT HTTP.REQ.IS_VALID’. This means that the policy will always be true and thus, always be invoked, preventing the other policy from being used. This is explained in the Citrix Virtual Apps and Desktops 7 Deployment and Administration (CWS-215) course, under the section “Load Balancing Virtual Server Rewrite Policy Binding”.

Citrix Studio provides a feature called Limit Visibility, which allows administrators to hide specific published resources (apps or desktops) from chosen users or groups. This is the correct method to selectively exclude users from seeing or launching certain apps without removing them from the Delivery Group.

Correct Approach:

To prevent HR10 from seeing or accessing APP_A, the administrator should configure Limit Visibility so that only HR1–HR9 are allowed visibility for APP_A.

This ensures:

The entire HR group still receives all published apps

Only HR10 is restricted from APP_A

The Delivery Group configuration remains intact

Why the other options are incorrect:

A. Remove HR10 from the Delivery Group:This would remove HR10’s access to all Delivery Group applications, not just APP_A.

C. Remove APP_A from the Delivery Group:This removes the app for everyone, not just HR10.

D. Limit visibility on APP_A to HR10:This would assign visibility only to HR10, the opposite of what is needed.

Documentation References

Citrix Virtual Apps and Desktops → Application Publishing and Visibility

Citrix Studio → App Properties → “Limit Visibility” Feature

Citrix App Assignment Best Practices

Citrix Gateway can be hosted in Citrix Cloud or in a customer-controlled resource location. It provides secure remote access to Citrix Virtual Apps and Desktops service deployments.

The Get-BrokerSite PowerShell command retrieves information about the site, including the name of the deployment, the local host cache configuration, and the license level. This command is part of the Citrix Virtual Apps and Desktops 7 Administration toolkit and is used to manage various aspects of the site configuration.

When deploying a Citrix Virtual Apps and Desktops Site with SQL database mirroring, Citrix requires that the collation setting used by the Site database must be explicitly set and must match the required Citrix standard. Citrix documentation states that the database collation must be case-insensitive and consistent between the principal and mirror SQL servers.

This collation is not automatically assigned by SQL Server when you create an empty database for mirroring. Therefore, administrators must manually configure the correct collation during initial creation. If the collation does not match Citrix requirements, the Site creation or Controller functionality may fail.

Other listed options (SQL version, database type, mirroring version) do not require manual configuration at database-creation time for Citrix Sites.

Documentation References:

Citrix Virtual Apps and Desktops Database Requirements → SQL Collation Requirements

Citrix Delivery Controller Installation Requirements → Database Mirroring Configuration

 According to the Access Control Lists documentation, the add ns acl command is used to create an extended ACL that can filter packets based on various parameters, such as source IP address, source port, action, and protocol. An extended ACL can define the conditions that a packet must satisfy for the Citrix ADC to process the packet, bridge the packet, or drop the packet. Therefore, to bridge traffic originating from 192.168.10.200, a Citrix Administrator can use the following command:

add ns acl bridge_192.168.10.200 BRIDGE -srcIP 192.168.10.200

This command creates an extended ACL named bridge_192.168.10.200 with the action BRIDGE and the source IP address 192.168.10.200. Any packet that matches these conditions will be bridged to the destination without processing by the Citrix ADC.

According to the Citrix documentation1, burst capacity allows an instance to use more bandwidth than its dedicated bandwidth when there is spare bandwidth available on the SDX appliance. The priority parameter determines which instance gets the spare bandwidth first. A higher priority value indicates a higher priority. Therefore, the administrator can configure burst capacity of 1GB with priority 10 on the instance that requires more bandwidth, to meet traffic requirements.

1: Citrix Virtual Apps and Desktops 7 Deployment and Administration - Configure burst capacity

 According to the Citrix Virtual Apps and Desktops 7 Deployment and Administration course, the Generate Support File option on the Citrix ADC appliance allows the administrator to collect logs and configuration information for troubleshooting purposes. The support file can be downloaded and sent to the Citrix Support Engineer for analysis. The other options are not relevant for this scenario.

This command enables the Delivery Controllers to trust requests sent to the XML service port. This is required for securing communication between StoreFront and the Delivery Controllers

According to the Citrix documentation1, when connection proxy is used as the site persistence method, the Subnet IP (SNIP) address of the appliance is used to source the traffic when the connection is proxied. This ensures that the response from the server goes back to the same appliance that proxied the request.

1: Connection Proxy

Beginning with Citrix Virtual Apps and Desktops 2402 LTSR, Citrix introduced enhanced support for multiple policy sets assigned to a single Delivery Group. This improvement allows administrators to:

Combine multiple policy sets

Layer policy configurations

Apply different sets of rules to the same Delivery Group

Improve flexibility and reduce the need for large monolithic policy sets

Citrix documentation clarifies that Delivery Groups now support assignment of more than one policy set, and all applicable policies are processed according to their priorities.

Therefore, the correct answer is that a Delivery Group can use multiple policy sets simultaneously.

Documentation References:

Citrix Virtual Apps and Desktops 2402 LTSR → Policy Sets Enhancements

Citrix Policy Processing and Delivery Group Assignment

ttps://support.citrix.com/article/CTX239687/vda-registration-fails-when-a-vda-versions-functional-level-is-lower-than-its-machine-catalogs-minimum-functional-level

To get application enumeration working in a Citrix Cloud migration scenario with on-premises StoreFront and Citrix ADC, the administrator needs to add the Citrix Cloud Connectors as Secure Ticket Authority (STA) servers on both Citrix ADC and StoreFront12.

 According to the Policies page of Citrix Virtual Apps and Desktops 7 2308 documentation, Classic policies are a collection of settings that define how sessions, bandwidth, and security are managed for a group of users, devices, or connection types. You can apply policy settings to physical and virtual machines or to users. Classic policies can be filtered by various criteria, such as HTTP, IP, and TCP. These are the only options allowed when using Classic policies. Other options, such as CLIENT, SERVER, and DNS, are not valid filters for Classic policies.