To configure a rate-limiting policy for DNS requests at 1,000 per second, which command should you run?

To configure a rate-limiting policy for DNS requests at 1,000 per second, which command should you run?

• A. HTTP.REQ.LIMIT(<limit_identifier>)
• B. SYS.CHECK.LIMIT(<limit_identifier>)
• C. SYS.CHECK.LIMIT(<limit_identifier>) || CONNECTION.IP.LIMIT(<limit_identifier>)
• D. SYS.CHECK.LIMIT(<limit_identifier>) || HTTP.REQ.LIMIT(<limit_identifier>)

Answer: (B)

Rate limiting in Citrix ADC uses a system-level check to enforce a traffic threshold. DNS traffic is not HTTP, so an HTTP-specific limit command won’t affect DNS requests. Limiting by per-IP connections would throttle based on individual clients rather than overall DNS query rate, which isn’t what you want here. Using a system-wide limit is the correct approach. SYS.CHECK.LIMIT(<limit_identifier>) defines and enforces a total rate cap, so you can set the limit identifier to 1,000 requests per second and apply it to the DNS path. This directly constrains the overall DNS request rate without tying the limit to a protocol-specific metric. The other options mix protocol-specific checks or combine checks unnecessarily, which would either fail to apply to DNS or complicate the rule without adding the needed clarity for a DNS-rate limit.

Rate limiting in Citrix ADC uses a system-level check to enforce a traffic threshold. DNS traffic is not HTTP, so an HTTP-specific limit command won’t affect DNS requests. Limiting by per-IP connections would throttle based on individual clients rather than overall DNS query rate, which isn’t what you want here.

Using a system-wide limit is the correct approach. SYS.CHECK.LIMIT() defines and enforces a total rate cap, so you can set the limit identifier to 1,000 requests per second and apply it to the DNS path. This directly constrains the overall DNS request rate without tying the limit to a protocol-specific metric.

The other options mix protocol-specific checks or combine checks unnecessarily, which would either fail to apply to DNS or complicate the rule without adding the needed clarity for a DNS-rate limit.