A civic diagram of remote Horizon access shows inspector laptops, then a load balancer, then an appliance, then Connection Server, then the desktop VM. Which hop is the internet-facing secure gateway?
Select an answer to reveal the explanation.
Short Explanation
Read the diagram like a museum line: the public door is the first staffed checkpoint, not the vault in the basement. That door is Unified Access Gateway behind the load balancer in the DMZ. Connection Server and the desktop VM stay inside; NAT-publishing Blast or parking an Access Connector at someone's house skips the gateway this exam expects.
Full Explanation
A typical remote Horizon path is client to load balancer to Unified Access Gateway to Connection Server to the agent in the desktop VM. UAG (often behind an LB VIP) is the internet-facing secure hop; Connection Server is not placed on the public edge. Publishing a desktop Blast port with firewall NAT bypasses the gateway model. Workspace ONE Access Connector syncs identity from the datacenter; it is not the Horizon DMZ appliance.