1Y0-351 · Question #291
Which load-balancing method is used in connection mirroring and firewall load balancing?
The correct answer is B. Source IP Soure Port Hash. See the full explanation below for the reasoning.
Question
Which load-balancing method is used in connection mirroring and firewall load balancing?
Options
- AURL Hash
- BSource IP Soure Port Hash
- CDestination IP Hash
- DCall ID Hash
How the community answered
(53 responses)- A13% (7)
- B75% (40)
- C4% (2)
- D8% (4)
Community Discussion
7
Jovan I.May 10, 2026Answer is B, Source IP Source Port Hash. The whole point of firewall load balancing is that a stateful firewall has to see both legs of a connection, so you cannot afford to scatter related packets across different firewall nodes. Hashing on source IP alone is not enough because two flows from the same client on different ports are functionally independent sessions, and a pure IP hash would still land them on the same node by coincidence rather than by design tied to the actual five-tuple. Source IP plus source port hash pins each unique flow to one specific firewall vServer backend, which is exactly the symmetry connection mirroring depends on to keep state synchronized. URL Hash is an application-layer construct that has no place here, Destination IP Hash would break return-path symmetry on the inside interface, and Call ID Hash is strictly a SIP persistence method for VoIP deployments.
Orla P.May 11, 2026Worth adding that the inside-leg load balancer has to mirror this with a destination IP plus destination port hash on return traffic, otherwise you lose the symmetry right at the point where stateful inspection matters most.
Mei-Ling H.May 25, 2026Saw "mirroring" and almost picked C, but "source port" was the clue, B confirmed.
Orla P.May 28, 2026Source port alone nails it every time, though it helps to know mirroring copies traffic passively so it never touches the original flow, which is why some folks get tripped up and overthink the answer.
Orla P.Jun 24, 2026The wording here lures you toward C because "destination IP hash" sounds like it belongs in a firewall context, but connection mirroring and firewall load balancing both need to keep the same client source tied to the same firewall instance across a session, so the method that hashes on both source IP and source port is the one that does that job. B is your answer.
Dervla O.Jun 9, 2026Source IP Source Port Hash is the right call here, because connection mirroring and firewall load balancing need to guarantee that both directions of a flow land on the same device, and hashing on the source IP plus source port gives you that sticky, deterministic mapping without any shared session state. The other options either target content-layer fields (URL Hash) or only half the connection tuple, which breaks symmetry the moment you have return traffic.
Jovan I.Jun 10, 2026Source IP Source Port Hash does give you that deterministic mapping, but for firewall load balancing specifically you almost always want full 4-tuple hashing (source IP, source port, destination IP, destination port) because two clients on the same NAT box sharing a source IP and port but hitting different destination ports will collide onto the same firewall and skew your distribution.