Horizon Client on a home PC must not talk directly to Connection Server on the internal VLAN. How should the access path be described?
Select an answer to reveal the explanation.
Short Explanation
Connection Server belongs inside, like the records room. Home Horizon Client should hit Unified Access Gateway in the DMZ, and the firewall should only allow that path. Do not hang the broker on the internet or aim Client at vCenter.
Full Explanation
Home Horizon Client must not talk directly to internal Connection Server; place Unified Access Gateway in the DMZ and let the firewall restrict inbound paths to that access tier. In municipal EUC terms, treat the endpoint as a window into city systems when the architecture says so, not as the system of record for the files or apps in the stem. Distractor concept: Publishing Connection Server on the internet and disabling the firewall for Blast exposes the broker. Distractor concept: App Volumes Manager in the DMZ is not the remote display access path. Distractor concept: Pointing Horizon Client at vCenter on the management VLAN is wrong and dangerous. Exam caveat: Remote path = client → UAG (DMZ) → internal brokers; never expose Connection Server or vCenter. Operational check: Trace home traffic to the UAG VIP only, confirm Connection Server is not internet-reachable, and validate firewall allow-lists. Record the chosen control and the rejected failure modes in the civic change ticket or runbook so on-call staff and auditors share the same rationale after the next maintenance window. Re-validate after personnel or image changes that the same control still meets the city's continuity, security, and support expectations for this service.