A Responder policy bound to a vserver with type REQUEST acts on the inbound client request and can issue a redirect to a different URL or host. Because it processes the request, not the response, the policy can instruct the client to go to a new destination. So if the policy redirects to host.example.com, the request that originated from host1.example.net is redirected to host.example.com. This is why the correct description is that the request from host1.example.net is redirected to host.example.com. The other scenarios involve responses or different origins, which would be associated with a policy bound to type RESPONSE rather than REQUEST.

You implement a blacklist/allowlist that works in harmony with IP reputation by using a policy data set that lists the IPs to block or allow, and then apply that data set in a policy tied to the IP reputation evaluation. The idea is to complement reputation scores with explicit, administrator-defined IP lists. You create a data set containing the IP addresses you want to block or permit, build a policy that checks the source IP against this set, and then define the action (block or allow) based on the match. This lets you override or reinforce reputation signals with precise controls—for example, allow traffic from a known trusted IP even if its reputation score is borderline, or block a high-risk IP despite a neutral reputation. Why this is the best fit: it directly provides a mechanism to maintain and enforce explicit IP lists while also leveraging IP reputation, giving you both dynamic risk signals and static, administrator-defined controls in a single policy. Why the other approaches don’t fit as well: enabling MAC-based Forwarding is about layer-2 behavior and doesn’t address IP reputation or IP-based access control. Creating a data set for IPv4 address matching is related but incomplete without a policy that uses IP reputation to decide actions. Creating several simple ACL policies can enforce blocks/allows, but they’re less centralized and harder to maintain compared with a single policy data set that works alongside IP reputation.

A content-switching virtual server acts as the traffic director at the edge, deciding which backend handles each request by examining the request content. It uses content-switching policies that look at elements like the URL path, host header, or specific cookies to route traffic to the appropriate service group. This enables hosting multiple applications behind a single IP/port, with each application handled by its own backend pool. While SSL termination, caching, and traffic modifications are separate capabilities handled by other configurations, the defining role here is routing requests to different backends based on content rules. For example, a request to /images would go to the image service, while /api would go to the API service.

Centralized authentication, authorization, and accounting on Citrix ADC is handled by AAA. AAA brings together the processes of verifying who a user is (authentication), deciding what they are allowed to access (authorization), and recording access events for auditing (accounting). It can integrate with external identity stores like LDAP, RADIUS, SAML, or certificate-based methods, and you configure an AAA virtual server with authentication and authorization policies plus accounting logs to enforce and track access across Citrix ADC and Citrix Gateway sessions. This centralized control is what ensures consistent security and auditing for all access. ICA proxy is for proxied ICA traffic to remote apps, integrated caching speeds content delivery, and AppFlow is for traffic analytics and data export, not for centralized AAA.

Persistence Time-Out is the setting that controls how long the system will honor the same client’s session with the originally chosen service after that service is disabled. This lets existing connections finish on the service they started on, even though new requests are no longer sent to it. If the timeout is too short, active requests could be dropped; if it’s too long, failover for new requests is unnecessarily delayed. The other options don’t govern how long to keep serving ongoing sessions: they relate to thresholds for triggering changes or delays in handling requests, not the duration of persistence for existing connections.