Library LAN thin clients sit on the trusted civic network, while remote park rangers work from untrusted home ISPs. How should Horizon access paths differ?
Select an answer to reveal the explanation.
Short Explanation
Same product family, two driveways: library LAN clients can pull up to the broker VIP, while rangers on a coffee-shop ISP must use the UAG gate. Do not hang Connection Server on the internet just to keep the paths identical.
Full Explanation
Library LAN thin clients on the trusted civic network may use the Horizon broker VIP directly, while remote park rangers on untrusted home ISPs must use Unified Access Gateway. That split access path is the standard associate-depth Horizon design: internal clients to Connection Server, internet clients to UAG in the DMZ. It is false that both groups must use UAG because Horizon Client cannot talk to Connection Server on a LAN. It is false that both groups must skip UAG and expose Connection Server on the internet. Saying park rangers use NSX overlay while library clients use Workspace ONE Tunnel as the VDI gateway misassigns networking and UEM VPN products into the Horizon path. Exam caveat: some organizations force everyone through UAG for consistency, but when the exam asks how paths differ, recognize internal broker access versus mandatory UAG for untrusted remote users. Operational check: connect a library thin client to the internal broker VIP, connect a ranger home client to the UAG FQDN, confirm Connection Server is not reachable from the ranger’s untrusted network, and capture both paths on the city’s Horizon access diagram. Keep civic diagrams labeled so help-desk and network teams do not swap these products during incidents.