An operator has been asked to increase SSL offload performance for a Virtual Service without compromising security. The Virtual Service is currently configured with both RSA and EC certificates…

Question

Options

• AIn the SSL/TLS Profile, disable all ciphers that have a check mark in the PFS column
• BIn the Virtual Service, scale out to an additional Service Engine
• CIn the SSL/TLS Profile, uncheck "Enable SSL Session Reuse"
• DIn the Virtual Service edit page, arrange the order so the EC certificate is before RSA

• A
  7% (2)
• B
  77% (23)
• C
  3% (1)
• D
  13% (4)

Explanation

Scaling out to an additional Service Engine (option B) distributes the SSL processing load across more compute resources, directly increasing throughput and handshake capacity without touching any security configuration - it's a pure capacity increase.

Why the distractors are wrong:

• A is wrong because PFS (Perfect Forward Secrecy) ciphers are a security feature; disabling them explicitly compromises security, violating the stated requirement.
• C is wrong because SSL Session Reuse improves performance by caching handshake parameters for reconnecting clients - disabling it would make performance worse, not better.
• D is a common trap: while EC certificates are computationally faster than RSA, modern TLS clients already negotiate EC when both are available, so reordering provides negligible real-world gain and doesn't address a true performance bottleneck.

Memory tip: When a question says "increase performance without compromising security," any answer that modifies cipher settings or security features is automatically suspect - only resource scaling (more engines, more CPU) can boost performance while leaving the security posture completely unchanged.

No community discussion yet for this question.