Exam 1Y0-402 topic 1 question 43 discussion

Scenario: A Citrix Architect needs to design a new XenApp and XenDesktop environment.
The architect has identified the User Layer requirements, as shown in the Exhibit.
Click the Exhibit button to view the requirements.

Additionally, management at the organization has identified the following general Access Layer requirements:
✑ A multi-factor authentication method is required for any connections to the XenApp and XenDesktop environment originating from outside the corporate network.
✑ External connections must be authenticated by a NetScaler Gateway virtual server located in a DMZ network.
✑ Internal connection traffic should NOT leave the internal corporate network.
Which Access Layer feature should the architect configure to meet the security requirements of the Accountants group?