nerdexam
F5

101 · Question #212

Which is an advantage of terminating SSL communication at the BIG-IP rather than the ultimate web server.

The correct answer is A. Terminating SSL at the BIG-IP can eliminate SSL processing at the web servers.. Terminating SSL at the BIG-IP offloads CPU-intensive cryptographic processing from web servers, freeing server resources for application workloads.

Section 4: Security Basics

Question

Which is an advantage of terminating SSL communication at the BIG-IP rather than the ultimate web server.

Options

  • ATerminating SSL at the BIG-IP can eliminate SSL processing at the web servers.
  • BTerminating SSL at the BIG-IP eliminates all unencrypted traffic from the nternal.network.
  • CTerminating SSL at the BIG-IP eliminates all unencrypted traffic from the .nternal.network.
  • DTerminating SSL at the BIG-IP eliminates the need to purchase SSL certificates from a certificate
  • ETerminating SSL at the BIG-IP eliminates the need to use SSL acceleration hardware anywhere

How the community answered

(26 responses)
  • A
    88% (23)
  • C
    4% (1)
  • D
    8% (2)

Why each option

Terminating SSL at the BIG-IP offloads CPU-intensive cryptographic processing from web servers, freeing server resources for application workloads.

ATerminating SSL at the BIG-IP can eliminate SSL processing at the web servers.Correct

SSL/TLS encryption and decryption are computationally expensive operations. By terminating SSL at the BIG-IP, web servers receive plain HTTP connections and are relieved of all cryptographic overhead, allowing them to dedicate their CPU cycles to serving application content and improving overall throughput and scalability.

BTerminating SSL at the BIG-IP eliminates all unencrypted traffic from the nternal.network.

Terminating SSL at the BIG-IP actually introduces unencrypted traffic on the internal network between the BIG-IP and the web servers unless a ServerSSL profile is used to re-encrypt that leg.

CTerminating SSL at the BIG-IP eliminates all unencrypted traffic from the .nternal.network.

Same technical flaw as option B - SSL offload without re-encryption means traffic between the BIG-IP and pool members travels in cleartext internally.

DTerminating SSL at the BIG-IP eliminates the need to purchase SSL certificates from a certificate

An SSL certificate is still required and must be installed on the BIG-IP itself to present to connecting clients; offloading SSL does not eliminate the certificate requirement.

ETerminating SSL at the BIG-IP eliminates the need to use SSL acceleration hardware anywhere

SSL acceleration hardware may still be needed or beneficial at the BIG-IP tier itself, especially under high connection volumes, so this advantage is not eliminated.

Concept tested: F5 BIG-IP SSL offloading performance advantage

Source: https://support.f5.com/csp/article/K14783

Topics

#SSL offload#SSL termination#web server performance#certificate management

Community Discussion

No community discussion yet for this question.

Full 101 Practice