nerdexam
F5

201 · Question #301

Which statement is true concerning SSL termination?

The correct answer is A. A virtual server that has both ClientSSL and ServerSSL profiles can still support cookie persistence. A virtual server configured with both ClientSSL and ServerSSL profiles can still utilize cookie persistence because the BIG-IP decrypts the client-side traffic, allowing it to inspect and manipulate application-layer data like HTTP cookies.

Section 2: Configure Load Balancing Features

Question

Which statement is true concerning SSL termination?

Options

  • AA virtual server that has both ClientSSL and ServerSSL profiles can still support cookie persistence.
  • BDecrypting traffic at the BIG-IP allows the use of iRules for traffic management, but increases the
  • CWhen any virtual server uses a ClientSSL profile, all SSL traffic sent to the BIG-IP is decrypted before
  • DIf a virtual server has both a ClientSSL and ServerSSL profile, the pool members have less SSL

How the community answered

(38 responses)
  • A
    74% (28)
  • B
    8% (3)
  • C
    13% (5)
  • D
    5% (2)

Why each option

A virtual server configured with both ClientSSL and ServerSSL profiles can still utilize cookie persistence because the BIG-IP decrypts the client-side traffic, allowing it to inspect and manipulate application-layer data like HTTP cookies.

AA virtual server that has both ClientSSL and ServerSSL profiles can still support cookie persistence.Correct

When a virtual server uses a ClientSSL profile, the BIG-IP decrypts the client's SSL traffic, making the HTTP headers and payload accessible for inspection and manipulation. Cookie persistence relies on reading and inserting HTTP cookies, which is possible once the traffic is decrypted by the ClientSSL profile, even if the traffic is subsequently re-encrypted to the server via a ServerSSL profile.

BDecrypting traffic at the BIG-IP allows the use of iRules for traffic management, but increases the

The statement is incomplete ("increases the") and therefore cannot be fully assessed as a true or false claim about SSL termination's impact on iRules and performance.

CWhen any virtual server uses a ClientSSL profile, all SSL traffic sent to the BIG-IP is decrypted before

A ClientSSL profile only decrypts SSL traffic destined for the specific virtual server it is applied to, not all SSL traffic across the entire BIG-IP system.

DIf a virtual server has both a ClientSSL and ServerSSL profile, the pool members have less SSL

If a virtual server uses a ServerSSL profile, the BIG-IP re-encrypts the traffic to the pool members, meaning the pool members still perform SSL decryption on their end, just from the BIG-IP instead of directly from the client, so they do not necessarily have less SSL processing.

Concept tested: BIG-IP SSL profiles and persistence interaction

Source: https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-implementations-12-1-0/4.html

Topics

#SSL termination#ClientSSL profile#ServerSSL profile#cookie persistence

Community Discussion

No community discussion yet for this question.

Full 201 Practice