In a non-domain-joined StoreFront deployment, which statement about authentication is true?

• A. Authentication occurs at the Domain Controller
• B. Two-factor authentication is NOT supported
• C. Authentication occurs at the Delivery Controller
• D. Authentication occurs at the Citrix ADC

Answer: (C)

In a non-domain-joined StoreFront deployment, the Delivery Controller is the authentication point because there is no Domain Controller to validate credentials. StoreFront collects the user’s credentials and hands them to the Delivery Controller, which then authenticates against its own local store or any configured identity source and provides access to the apps. This flow lets users be authenticated and authorized without relying on Active Directory.

The Citrix ADC can handle gateway authentication for remote access, but that’s a separate layer and doesn’t replace the Delivery Controller as the broker for authenticating and enumerating resources. Two-factor authentication is supported when properly configured through gateway or identity integrations, so the statement that 2FA isn’t supported isn’t accurate.