C1000-038 · Question #32
A customer starts using z/OS Encryption Readiness Technology (zERT) to gather knowledge about the state of encrypted network traffic in their system. They also use Sysplex Distributor, so there is…
The correct answer is D. Move the collection of data to the network routers neighboring the z/OS systems. Note: The provided answer key (D) appears to be incorrect. zERT is a z/OS-specific technology that runs on z/OS TCP/IP stacks - it cannot run on network routers, making D technically impossible and an invalid solution. The correct answer is A. When Sysplex Distributor routes…
Question
A customer starts using z/OS Encryption Readiness Technology (zERT) to gather knowledge about the state of encrypted network traffic in their system. They also use Sysplex Distributor, so there is TLS- encrypted traffic routed through the distributor systems to application hosts. The distributor systems also host TLS-encrypted TN3270 services for the network. They started gathering data from the Sysplex Distributor hosts, since encrypted traffic is routed through those systems. A large number of encrypted TCP sessions seem to be missing from the customer's analysis. What does the customer need to do to gather full analysis data?
Options
- AStart gathering zERT data on all z/OS systems in their environment.
- BConfigure the zERT collection correctly on the Sysplex Distributor hosts.
- CMove the collection of data to the z/OS application data hosts.
- DMove the collection of data to the network routers neighboring the z/OS systems.
How the community answered
(49 responses)- A24% (12)
- B6% (3)
- C12% (6)
- D57% (28)
Explanation
Note: The provided answer key (D) appears to be incorrect. zERT is a z/OS-specific technology that runs on z/OS TCP/IP stacks - it cannot run on network routers, making D technically impossible and an invalid solution.
The correct answer is A.
When Sysplex Distributor routes TLS traffic, it proxies TCP connections from clients to application hosts - the TLS sessions actually terminate on the application hosts, not on the distributor. The distributor hosts only see TLS for their own local services (like the TN3270 sessions mentioned). By gathering zERT data only from the distributor hosts, the customer misses all the TLS sessions terminating on the application hosts, which accounts for the large number of "missing" sessions.
Why the distractors are wrong:
- B is wrong because this isn't a misconfiguration on the distributor - zERT there simply can't see sessions that terminate elsewhere.
- C is partially right (application hosts do hold the missing TLS sessions), but it would abandon the distributor data, losing the TN3270 sessions that legitimately terminate there.
- D is wrong because zERT is a z/OS Communications Server feature - it has no mechanism to run on external network routers.
Memory tip: Think of TLS sessions like a phone call - zERT only "hears" calls where your system is one of the endpoints. If the distributor passes calls through to application hosts, zERT on the distributor is just overhearing the routing, not the conversation. You need zERT everywhere TLS actually terminates.
Topics
Community Discussion
No community discussion yet for this question.