Which statement reflects the correct ACL approach to limit access to a vServer for a fixed TTL?

Which statement reflects the correct ACL approach to limit access to a vServer for a fixed TTL?

• A. Use a deny rule on simple ACL with TTL 600000.
• B. Use a deny rule on NS ACL with TTL 600000.
• C. Use a deny rule on simple ACL with TTL 600.
• D. Use a deny rule on NS ACL with TTL 600.

Answer: (B)

The idea being tested is using a time-bound access control rule to temporarily block a vServer. In Citrix ADC, you can attach a deny rule that has a TTL, so the block lasts only for the specified duration and then automatically expires. Only NS ACLs support TTL for their rules, whereas simple ACLs do not offer TTL functionality. Therefore, to enforce a fixed-duration limit on access, you create a deny rule on an NS ACL and set the TTL to the desired duration in milliseconds. A TTL of 600000 milliseconds equals 10 minutes, which is why the best choice uses a deny rule on NS ACL with TTL 600000. Using a TTL value like 600 would either be unsupported or interpreted incorrectly due to the unit, making it unsuitable.

The idea being tested is using a time-bound access control rule to temporarily block a vServer. In Citrix ADC, you can attach a deny rule that has a TTL, so the block lasts only for the specified duration and then automatically expires. Only NS ACLs support TTL for their rules, whereas simple ACLs do not offer TTL functionality. Therefore, to enforce a fixed-duration limit on access, you create a deny rule on an NS ACL and set the TTL to the desired duration in milliseconds. A TTL of 600000 milliseconds equals 10 minutes, which is why the best choice uses a deny rule on NS ACL with TTL 600000. Using a TTL value like 600 would either be unsupported or interpreted incorrectly due to the unit, making it unsuitable.