In an active-passive Citrix ADC HA pair, if the upstream router is not updating its ARP table, which configuration resolves the issue?

Answer: D — Virtual MAC

When an active-passive Citrix ADC HA pair faces an upstream router that isn’t updating its ARP table, the traffic issue is solved by giving the VIP a stable, shared identity at the Layer 2 level. A Virtual MAC provides exactly that: a mac address that both ADC nodes can present for the VIP, so the router and switches always see the same MAC for the VIP regardless of which node is active. The active unit responds to ARP for this VMAC, and when failover occurs, the new active unit continues to respond with the same MAC. Because the MAC seen by the upstream network doesn’t change, the router’s ARP entry remains valid and traffic is directed correctly to the current active node without needing ARP updates on the upstream side. Other options relate to route or health monitoring or network configuration modes, which don’t address the ARP stability issue for a VIP in an HA pair as effectively as using a Virtual MAC does.