A civic diagram of remote Horizon access shows inspector laptops, then a load balancer, then an appliance, then Connection Server, then the desktop VM. Which hop is the internet-facing secure gateway?
Select an answer to reveal the explanation.
Short Explanation
Read the diagram like a museum line: the public door is the first staffed checkpoint, not the vault in the basement. That door is Unified Access Gateway behind the load balancer in the DMZ. Connection Server and the desktop VM stay inside; NAT-publishing Blast or parking an Access Connector at someone's house skips the gateway this exam expects.
Full Explanation
In the remote access diagram—client, load balancer, appliance, Connection Server, desktop VM—the internet-facing secure gateway hop is Unified Access Gateway behind the load balancer in the DMZ. In municipal EUC terms, treat the endpoint as a window into city systems when the architecture says so, not as the system of record for the files or apps in the stem. Distractor concept: Connection Server on the internal VLAN must not be the first public hop. Distractor concept: Publishing the desktop VM Blast port with civic firewall NAT exposes the guest incorrectly. Distractor concept: Workspace ONE Access Connector on the inspector's home LAN is not the internet-facing Horizon gateway. Exam caveat: Public door for Horizon remote access = UAG (often behind VIP), not Connection Server, desktop NAT, or Access Connector at home. Operational check: Label the civic diagram with UAG as the DMZ gateway and verify external probes only reach that tier. Record the chosen control and the rejected failure modes in the civic change ticket or runbook so on-call staff and auditors share the same rationale after the next maintenance window. Re-validate after personnel or image changes that the same control still meets the city's continuity, security, and support expectations for this service.