In which two ways can a Citrix Engineer encrypt communication between the Virtual Delivery Agent (VDA) machines and Citrix Workspace app? (Choose two.)

To encrypt the HDX session traffic directly between a Virtual Delivery Agent (VDA) and the Citrix Workspace app, Transport Layer Security (TLS) must be configured on the VDA. This process involves two fundamental steps. First, a valid server certificate must be installed on each VDA machine to authenticate its identity to the connecting client. Second, the TLS protocol must be explicitly enabled on the VDA, which configures the HDX listener to use the installed certificate and accept secure connections. These two actions work together to establish an encrypted channel for all session data.

A. Install a certificate on the Delivery Controllers. This secures communication between VDAs and Delivery Controllers, not the HDX session traffic between the VDA and the end-user's Workspace app.
D. Enable TLS on the StoreFront servers. This encrypts authentication and resource enumeration traffic between the Workspace app and StoreFront servers, but it does not encrypt the actual HDX session.

1. Citrix Virtual Apps and Desktops Documentation. (2023). Transport Layer Security (TLS).

Section: Enable TLS on a VDA

Content: "Configuring TLS encryption on a VDA consists of the following steps: 1. Obtain a server certificate and install it on each VDA. ... 2. Configure the TLS listener on the VDA to use the installed certificate. You can do this using the Enable-VdaSSL.ps1 PowerShell script." This source directly validates that installing a certificate on the VDA (Option C) and enabling TLS on the VDA (Option B) are the required steps.

2. Citrix Virtual Apps and Desktops Documentation. (2023). Transport Layer Security (TLS).

Section: Install a server certificate on a VDA

Content: "For TLS encryption, the VDA requires a server certificate to identify itself to the client. Citrix recommends using certificates from a public Certificate Authority (CA) or your enterprise CA." This confirms the necessity of installing a certificate on the VDA as a prerequisite for enabling TLS encryption for the HDX session.