nerdexam
F5

201 · Question #224

A web server administrator informs the BIG-IP Administrator that web servers are overloaded Starting next month, the BIG-IP device will terminate SSL to reduce web server load. The BIG-IP device is re

The correct answer is A. Remove the server SSL profile and configure the Pool Members to use HTTP. To offload SSL from web servers when the BIG-IP is already terminating client SSL, the administrator should remove the server SSL profile and configure the pool members to receive unencrypted HTTP traffic.

Section 2: Configure Load Balancing Features

Question

A web server administrator informs the BIG-IP Administrator that web servers are overloaded Starting next month, the BIG-IP device will terminate SSL to reduce web server load. The BIG-IP device is ready using client SSL client profile and Rules on HTTP level. What actions should the BIG-IP Administrators to achieve the desired configuration?

Options

  • ARemove the server SSL profile and configure the Pool Members to use HTTP
  • BRemove the client SSL profile and configure the Pool Members to US HTTP
  • CRemove the chart SSL profile and change the Virtual Server to accept HTTP
  • DRemove the server SSL profile and change the Virtual Server to accept HTTP traffic

How the community answered

(31 responses)
  • A
    77% (24)
  • B
    13% (4)
  • C
    3% (1)
  • D
    6% (2)

Why each option

To offload SSL from web servers when the BIG-IP is already terminating client SSL, the administrator should remove the server SSL profile and configure the pool members to receive unencrypted HTTP traffic.

ARemove the server SSL profile and configure the Pool Members to use HTTPCorrect

Since the BIG-IP already uses a client SSL profile to terminate client-side SSL, the web server overload from SSL implies the BIG-IP is re-encrypting traffic to the servers (SSL bridging). Removing the server SSL profile tells the BIG-IP to send plain HTTP to the pool members, thus offloading SSL processing entirely from the web servers.

BRemove the client SSL profile and configure the Pool Members to US HTTP

Removing the client SSL profile would cause the BIG-IP to stop terminating SSL from clients, preventing the desired SSL offloading at the BIG-IP.

CRemove the chart SSL profile and change the Virtual Server to accept HTTP

Removing the client SSL profile (assuming 'chart' is a typo for client) would stop BIG-IP from terminating client SSL, and changing the Virtual Server to accept HTTP would mean clients connect via HTTP, which is not the typical goal of SSL offloading at the BIG-IP.

DRemove the server SSL profile and change the Virtual Server to accept HTTP traffic

Changing the Virtual Server to accept HTTP traffic means clients would connect via HTTP, which is not the intent when BIG-IP is meant to terminate SSL from clients; only the backend connection to pool members should be HTTP.

Concept tested: BIG-IP SSL Offloading configuration

Source: https://techdocs.f5.com/en-us/big-ip-local-traffic-management-concepts/understanding-ssl-offload.html

Topics

#SSL offloading#client SSL profile#server SSL profile#HTTP communication

Community Discussion

No community discussion yet for this question.

Full 201 Practice