In a DMZ deployment of a Citrix ADC MPX appliance with one interface in the DMZ and the other on the internal network, which deployment mode is appropriate?

• A. Two-arm
• B. One-arm
• C. Transparent
• D. Forward proxy

Answer: (A)

Separating networks with dedicated interfaces is the key idea here. In a DMZ deployment, you want the appliance to sit between two distinct security zones so traffic can be routed and policy-enforced cleanly. Two-arm mode gives the Citrix ADC two NICs (or VLANs): one on the DMZ facing clients, and one on the internal network where the backend servers reside. This setup lets you place the VIP in the DMZ to handle client connections, while the SNIP on the internal side allows the ADC to reach internal servers and apply load balancing across them, all behind the firewall.

This arrangement supports proper security segmentation, clear routing between the DMZ and internal network, and straightforward ACL and firewall configurations. It also aligns with typical DMZ best practices: the DMZ side handles external access, and the internal side handles server-side communication, without exposing internal resources directly to the Internet.

In contrast, a one-arm deployment uses a single interface to handle both networks, which blurs the boundary between DMZ and internal traffic and complicates routing and security controls. Transparent mode operates as a bridge, not a routed path between networks, so it isn’t suited for the typical DMZ-to-internal load-balancing role. Forward proxy is focused on outbound web traffic rather than general load balancing between DMZ clients and internal resources.