201 · Question #269
A site needs to terminate client HTTPS traffic at the BIG-IP and forward that traffic unencrypted. Which two are profile types that must be associated with such a virtual server? (Choose two.)
The correct answer is A. TCP D. ClientSSL. To terminate client HTTPS traffic at the BIG-IP and forward it unencrypted, a virtual server requires a ClientSSL profile for decryption and a TCP profile for the underlying transport.
Question
A site needs to terminate client HTTPS traffic at the BIG-IP and forward that traffic unencrypted. Which two are profile types that must be associated with such a virtual server? (Choose two.)
Options
- ATCP
- BHTTP
- CHTTPS
- DClientSSL
- EServerSSL
How the community answered
(25 responses)- A76% (19)
- B8% (2)
- C4% (1)
- E12% (3)
Why each option
To terminate client HTTPS traffic at the BIG-IP and forward it unencrypted, a virtual server requires a ClientSSL profile for decryption and a TCP profile for the underlying transport.
The TCP profile is fundamental for any virtual server to handle the underlying transport layer communication, regardless of the application protocol.
An HTTP profile is used for HTTP protocol optimizations and manipulation, but it is not mandatory for basic HTTPS termination and unencrypted forwarding, nor does it handle SSL decryption itself.
HTTPS is a protocol, not a profile type directly associated with the virtual server for this purpose; ClientSSL handles the SSL/TLS part.
The ClientSSL profile is essential for decrypting incoming HTTPS traffic from clients at the BIG-IP, enabling the device to inspect and then forward the traffic unencrypted to the backend servers.
A ServerSSL profile would be used if the BIG-IP needed to re-encrypt traffic before sending it to the backend servers, which is contrary to the requirement of forwarding traffic unencrypted.
Concept tested: BIG-IP HTTPS termination profiles
Source: https://techdocs.f5.com/en-us/bigip-15-1-0/big-ip-local-traffic-management-concepts/profiles-in-virtual-servers.html
Topics
Community Discussion
No community discussion yet for this question.