1Y0-A21 · Question #137
An administrator needs to configure an SSL virtual server for HTTP content switching in an environment that requires end-to-end encryption. Which type of content switching virtual server (Front-end)…
The correct answer is A. Front-end SSL, back-end SSL. See the full explanation below for the reasoning.
Question
An administrator needs to configure an SSL virtual server for HTTP content switching in an environment that requires end-to-end encryption. Which type of content switching virtual server (Front-end) and service (Back-end) should the administrator configure?
Options
- AFront-end SSL, back-end SSL
- BFront-end SSL, back-end HTTP
- CFront-end TCP, back-end SSL_TCP
- DFront-end SSL_TCP, back-end SSL_TCP
How the community answered
(53 responses)- A74% (39)
- B8% (4)
- C15% (8)
- D4% (2)
Community Discussion
6
Anjali D.Mar 15, 2026Option A is the right call here. End-to-end encryption means the traffic stays encrypted all the way from the client to the back-end server, so you need SSL on both sides, front-end SSL virtual server for the client connection and an SSL service on the back-end to re-encrypt before it hits the server. If you picked B, you are decrypting at the NetScaler and sending plain HTTP to the back end, which breaks the "end-to-end" requirement entirely.
Samuel O.Feb 24, 2026B trips up a lot of people because SSL offload is exactly what most shops actually deploy, so your hands want to pick it, but the question is explicit that you need end-to-end encryption, which means the back-end leg cannot drop to plain HTTP, and that makes A the only answer that keeps the session encrypted all the way to the server.
Mei-Ling H.Mar 5, 2026I almost picked B because I focused on "content switching" and thought the NetScaler just needed to decrypt at the front-end, but the phrase "end-to-end encryption" is the trap word there, meaning the back-end connection must also be encrypted, so the traffic stays SSL the whole path, which is exactly what A gives you with SSL on both sides.
Yusuf A.Mar 19, 2026When I first saw this one I almost picked B because I kept thinking "the NetScaler already decrypted it, so why re-encrypt to the back end," but then I remembered our senior engineer saying that end-to-end encryption means SSL all the way through, front door to server, so A is the only one that holds up. The phrase "end-to-end" is doing all the work in that question, do not let it slip past you.
Anjali D.Mar 20, 2026Yusuf nailed the core point, though it is worth adding that some orgs do terminate SSL at the NetScaler intentionally for inspection or load balancing, so the question is really testing whether you know the definition of end-to-end rather than whether termination is always wrong.
Mateus R.Mar 24, 2026Think of it like a relay race where the baton has to stay sealed the whole way. The SSL_TCP front-end keeps the connection encrypted without terminating it, and the SSL_TCP back-end carries that same sealed baton all the way to the server, giving you true end-to-end encryption that option C nails perfectly, while A drops the ball by requiring the NetScaler to actually terminate and re-encrypt, which is a totally different beast than just passing traffic through.