A customer needs to intercept all of the redirects its application is sending to clients. When a redirect is matched, the customer needs to log a message including the client IP address.Which iRule should be used?

when HTTP_RESPONSE { if { [HTTP::is_redirect] } { log local0. 'redirecting client ip address [IP::addr [IP::remote_addr]]' } }

when HTTP_RESPONSE { if { [HTTP::is_3xx] } { log local0. 'redirecting client ip address [IP::addr [IP::remote_addr]]' } }

when HTTP_REQUEST { if { [HTTP::is_301] } { log local0. 'redirecting client ip address [IP::addr [IP::remote_addr]]' } }

when HTTP_REQUEST { if { [HTTP::is_redirect] } { log local0. 'redirecting client ip address [IP::addr [IP::remote_addr]]' } }

when HTTP_RESPONSE { if { [HTTP::is_redirect] } { log local0. 'redirecting client ip address [IP::addr [IP::remote_addr]]' } }

A web application requires knowledge of the client's true IP address for logging and analysis purposes. Instances of the application that can decode X-Forwarded-For HTTP headers reside in pool_a, while pool_b instances assume the source IP is the true address of the client.Which iRule provides the proper functionality?

when HTTP_REQUEST { if {[HTTP::header exists X-Forwarded-For]}{ pool pool_a } else { pool pool_b } }

when HTTP_DATA { if {[HTTP::header exists X-Forwarded-For]}{ pool pool_a } else { pool pool_b } }

when HTTP_RESPONSE { if {[HTTP::header exists X-Forwarded-For]}{ pool pool_a } else { pool pool_b } }

when HTTP_REQUEST { if {[HTTP::header exists X-Forwarded-For]}{ pool pool_a } else { pool pool_b } }

when HTTP_OPEN { if {[HTTP::header exists X-Forwarded-For]}{ pool pool_a } else { pool pool_b } }

Which iRule will reject any connection originating from a 10.0.0.0/8 network?

when CLIENT_ACCEPTED { set remote_ip [IP::addr [IP::client_addr] mask 255.0.0.0] switch $remote_ip { '10.0.0.0' { reject } '11.0.0.0' { pool pool_http1} default { pool http_pool } } }

when CLIENT_ACCEPTED { set remote_ip [IP::addr [IP::remote_addr] mask 8] switch $remote_ip { '10.0.0.0' { reject } '11.0.0.0' { pool pool_http1} default { pool http_pool } } }

when CLIENT_ACCEPTED { set remote_ip [IP::addr [IP::local_addr] mask 8] switch $remote_ip { '10.0.0.0' { reject } '11.0.0.0' { pool pool_http1} default { pool http_pool } } }

when CLIENT_ACCEPTED { set remote_ip [IP::addr [IP::client_addr] mask 255.0.0.0] switch $remote_ip { '10.0.0.0' { reject } '11.0.0.0' { pool pool_http1} default { pool http_pool } } }

when CLIENT_ACCEPTED { set remote_ip [IP::addr [IP::local_addr] mask 255.0.0.0] switch $remote_ip { '10.0.0.0' { reject } '11.0.0.0' { pool pool_http1} default { pool http_pool } } }

There is a fault with an LTM device load balanced trading application that resides on directly connected VLAN vlan-301. The application virtual server is 10.0.0.1:80 with trading application backend servers on subnet 192.168.0.0/25. The LTM Specialist wants to save a packet capture with complete payload for external analysis.Which command should the LTM Specialist execute on the LTM device command line interface?

tcpdump -vvv -s 0 -nni vlan-301 -w /var/tmp/trace.cap 'net 192.168.0.0/25'

tcpdump -vvv -w /var/tmp/trace.cap 'net 192.168.0.0/25'

tcpdump -vvv -s 0 -w /var/tmp/trace.cap 'net 192.168.0.0/25'

tcpdump -vvv -nni vlan-301 -w /var/tmp/trace.cap 'net 192.168.0.0/25'

tcpdump -vvv -s 0 -nni vlan-301 -w /var/tmp/trace.cap 'net 192.168.0.0/25'

An LTM Specialist has just captured trace /var/tmp/trace.cap for site www.example.com while listening on virtual address 10.0.0.1:443 configured on partition ApplicationA . The data payload being captured is SSL encrypted.Which command should the LTM Specialist execute to decrypt the data payload?

ssldump -Aed -nr /var/tmp/trace.cap -k /config/filestore/files_d/Common_d/certificate_key_d/:Common:www.example.com.key_1

ssldump -Aed -nr /var/tmp/trace.cap -k /config/filestore/files_d/Common_d/certificate_d/:Common:www.example.com.crt_1

ssldump -Aed -nr /var/tmp/trace.cap -k /config/filestore/files_d/Common_d/certificate_key_d/:Common:www.example.com.key_1

ssldump -Aed -nr /var/tmp/trace.cap -k /config/filestore/files_d/ApplicationA_d/certificate_d/:ApplicationA:www.example.com.crt_1

ssldump -Aed -nr /var/tmp/trace.cap -k /config/filestore/files_d/ApplicationA_d/certificate_key_d/:ApplicationA:www.example.com.key_1

An LTM Specialist must perform a packet capture on a virtual server with an applied standard FastL4 profile. The virtual server 10.0.0.1:443 resides on vlan301.Which steps should the LTM Specialist take to capture the data payload successfully while ensuring no other virtual servers are affected?

A new FastL4 profile should be created and applied to the virtual server with PVA acceleration disabled. Then the packet capture tcpdump -ni vlan301 should be executed on the command line interface.

The standard FastL4 profile should have PVA acceleration disabled. Then the packet capture tcpdump -ni vlan301 should be executed on the command line interface.

The packet capture tcpdump -ni vlan301 should be executed on the command line interface. There is no need to change profiles or PVA acceleration.

A new FastL4 profile should be created and applied to the virtual server with PVA acceleration disabled. Then the packet capture tcpdump -ni vlan301 should be executed on the command line interface.

The LTM device is under light load. The traffic should be mirrored to a dedicated sniffing device. On the sniffing device, the packet capture tcpdump -ni vlan301 should be executed.

A new VLAN vlan301 has been configured on a highly available LTM device in partition Application A . A new directly connected backend server has been placed on vlan301. However, there are connectivity issues pinging the default gateway. The VLAN self IPs configured on the LTM devices are 192.168.0.251 and 192.168.0.252 with floating IP 192.168.0.253. The LTM Specialist needs to perform a packet capture to assist with troubleshooting the connectivity.Which command should the LTM Specialist execute on the LTM device command line interface to capture the attempted pings to the LTM device default gateway on VLAN vlan301?

tcpdump -ni /ApplicationA/vlan301 'host 192.168.0.253'

tcpdump -ni vlan301 'host 192.168.0.253'

tcpdump -ni /ApplicationA/vlan301 'host 192.168.0.251 or host 192.168.0.252'

tcpdump -ni vlan301 'host 192.168.0.251 or host 192.168.0.252'

An LTM Specialist needs to modify the logging level for tcpdump execution events. Checking the BigDB Key, the following is currently configured:sys db log.tcpdump.level {value 'Notice'}Which command should the LTM Specialist execute on the LTM device to change the logging level to informational?

tmsh modify /sys db log.tcpdump.level value informational

tmsh set /sys db log.tcpdump.level value informational

tmsh set /sys db log.tcpdump.level status informational

tmsh modify /sys db log.tcpdump.level value informational

tmsh modify /sys db log.tcpdump.level status informational

An application is configured on an LTM device:Virtual server: 10.0.0.1:80 (VLAN vlan301)SNAT IP: 10.0.0.1Pool members: 10.0.1.1:8080, 10.0.1.2:8080, 10.0.1.3:8080 (VLAN vlan302)Which packet capture should the LTM Specialist perform on the LTM device command line interface to capture only client traffic specifically for this virtual server?

tcpdump -ni vlan301 -s 0 'port 80 and host 10.0.0.1' -w /var/tmp/trace.cap

tcpdump -ni 0.0:nnn -s 0 'host 10.0.0.1' -w /var/tmp/trace.cap

tcpdump -ni vlan301 -s 0 'port 80 and host 10.0.0.1' -w /var/tmp/trace.cap

tcpdump -ni vlan301 -s 0 'port 8080 and host 10.0.1.1 or host 10.0.1.2 or host 10.0.1.3' -w /var/tmp/trace.cap

tcpdump -ni vlan302 -s 0 'port 8080 and host 10.0.1.1 or host 10.0.1.2 or host 10.0.1.3' -w /var/tmp/trace.cap

tcpdump -ni 0.0:nnn -s 0 '(port 80 and host 10.0.0.1) or (port 8080 and host 10.0.1.1 or host 10.0.1.2 or host 10.0.1.3)' -w /var/tmp/trace.cap

An application is configured on an LTM device:Virtual server: 10.0.0.1:80 (VLAN vlan301)SNAT IP: 10.0.0.1Pool members: 10.0.1.1:8080, 10.0.1.2:8080, 10.0.1.3:8080 (VLAN vlan302)Which packet capture should the LTM Specialist perform on the LTM device command line interface to capture only server traffic specifically for this application?

tcpdump -ni vlan302 -s 0 'port 8080 and (host 10.0.1.1 or host 10.0.1.2 or host 10.0.1.3)' -w /var/tmp/trace.cap

tcpdump -ni 0.0:nnn -s 0 'host 10.0.0.1' -w /var/tmp/trace.cap

tcpdump -ni vlan301 -s 0 'port 80 and host 10.0.0.1' -w /var/tmp/trace.cap

tcpdump -ni vlan302 -s 0 'port 8080 and (host 10.0.1.1 or host 10.0.1.2 or host 10.0.1.3)' -w /var/tmp/trace.cap

tcpdump -ni 0.0:nnn -s 0 '(port 80 and host 10.0.0.1) or (port 8080 and host 10.0.1.1 or host 10.0.1.2 or host 10.0.1.3)' -w /var/tmp/trace.cap

An LTM Specialist sees these entries in /var/log/ltm:Oct 25 03:34:31 tmm warning tmm[7150]: 01260017:4: Connection attempt to insecure SSL server (see RFC5746) aborteD. 172.16.20.1:443Oct 25 03:34:32 tmm warning tmm[7150]: 01260017:4: Connection attempt to insecure SSL server (see RFC5746) aborteD. 172.16.20.1:443Oct 25 03:34:32 tmm warning tmm[7150]: 01260017:4: Connection attempt to insecure SSL server (see RFC5746) aborteD. 172.16.20.1:443Oct 25 03:34:32 tmm warning tmm[7150]: 01260017:4: Connection attempt to insecure SSL server (see RFC5746) aborteD. 172.16.20.1:443Oct 25 03:34:32 tmm warning tmm[7150]: 01260017:4: Connection attempt to insecure SSL server (see RFC5746) aborteD. 172.16.20.1:443Oct 25 03:34:33 tmm warning tmm[7150]: 01260017:4: Connection attempt to insecure SSL server (see RFC5746) aborteD. 172.16.20.1:443Assume 172.16.20.0/24 is attached to the VLAN 'internal.'What should the LTM Specialist use to troubleshoot this issue?

ssldump -i internal host 172.16.20.1

curl -d - -k https://172.16.20.1

ssldump -i internal host 172.16.20.1

tcpdump -i internal host 172.16.20.1 > /shared/ssl.pcap ssldump < /shared/ssl.pcap

tcpdump -s 64 -i internal -w /shared/ssl.pcap host 172.16.20.1 ssldump -r /shared/ssl.pcap

A virtual server for a set of web services is constructed on an LTM device. The LTM Specialist has created an iRule and applied this iRule to the virtual server:when HTTP_REQUEST {switch [HTTP::uri] {'/WS1/ws.jsp' {log local0. '[HTTP::uri]-Redirected to JSP Pool'pool JSP}default { log local0. '[HTTP::uri]-Redirected to Non-JSP Pool'pool NonJSP}}}However, the iRule is NOT behaving as expected. Below is a snapshot of the log:/WS1/ws.jsp-Redirected to JSP Pool/WS1/ws.jsp-Redirected to JSP Pool/WS1/ws.jsp-Redirected to JSP Pool/WS1/WS.jsp-Redirected to Non-JSP Pool/ws1/WS.jsp-Redirected to Non-JSP Pool/WS1/ws.jsp-Redirected to JSP Pool/ws1/ws.jsp-Redirected to Non-JSP PoolWhat is the problem?

The condition in the iRule is case sensitive.

The 'switch' command in the iRule has been used incorrectly.

The pool members of both pools need to be set up as case-insensitive members.

The 'Process Case-Insensitivity' option for the virtual server needs to be selected.

An LTM Specialist is tasked with ensuring that the syslogs for the LTM device are sent to a remote syslog server.The following is an extract from the config file detailing the node and monitor that the LTM device is using for the remote syslog server:monitorSyslog_15002 {defaults from udpdest *:15002}node 91.223.45.231 {monitor Syslog_15002screen RemoteSYSLOG}There seem to be problems communicating with the remote syslog server. However, the pool monitor shows that the remote server is up.The network department has confirmed that there are no firewall rules or networking issues preventing the LTM device from communicating with the syslog server. The department responsible for the remote syslog server indicates that there may be problems with the syslog server. The LTM Specialist checks the BIG-IP LTM logs for errors relating to the remote syslog server. None are found. The LTM Specialist does a tcpdump:tcpdump -nn port 15002, with the following results:21:28:36.395543 IP 192.168.100.100.44772 > 91.223.45.231.15002: UDP, length 1921:28:36.429073 IP 192.168.100.100.39499 > 91.223.45.231.15002: UDP, length 16921:28:36.430714 IP 192.168.100.100.39499 > 91.223.45.231.15002: UDP, length 18121:28:36.840524 IP 192.168.100.100.39499 > 91.223.45.231.15002: UDP, length 16921:28:36.846547 IP 192.168.100.100.39499 > 91.223.45.231.15002: UDP, length 18121:28:39.886343 IP 192.168.100.100.39499 > 91.223.45.231.15002: UDP, length 144NotE. 192.168.100.100 is the self IP of the LTM device.Why are there no errors for the remote syslog server in the log files?

The monitor type used is inappropriate.

The -log option for tcpdump needs to be used.

The monitor type used is inappropriate.

The 'verbose' logging option needs to be enabled for the pool.

When the remote syslog sever fails, it returns to service before the timeout for the monitor has expired.

Given a tcpdump on an LTM device from both sides of a connection on the External and Internal VLANs, how should an LTM Specialist determine if SNAT is enabled for a particular pool?

by checking to see if the Source IP is carried through from the External Vlan to the Internal Vlan

by checking to see if the Destination port is carried through from the External Vlan to the Internal Vlan

by checking to see if the Source port is carried through from the External Vlan to the Internal Vlan

by checking to see if the Destination IP is carried through from the External Vlan to the Internal Vlan

An LTM Specialist has a OneConnect profile and HTTP profile configured on a virtual server to load balance an HTTP application.The following HTTP headers are seen in a network trace when a client connects to the virtual server:Clientside:GET / HTTP/1.1Host: 192.168.136.100User-Agent: Mozilla/5.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-EncodinG. gzip, deflateConnection: keep-aliveServerside:HTTP/1.1 200 OKDatE. 5 Jun 1989 17:06:55 GMTServer: Apache/2.2.14 (Ubuntu)Vary: Accept-EncodingContent-EncodinG. gzipContent-LengtH. 3729X-Cnection: closeContent-TypE. text/htmlThe LTM Specialist notices the OneConnect feature is working incorrectly.Why is OneConnect functioning incorrectly?

Server must support HTTP keep-alive.

Client must support HTTP keep-alive.

Server must support HTTP keep-alive.

A virtual server for a set of web services is constructed on an LTM device. The LTM Specialist has created an iRule and applied this iRule to the virtual server:when HTTP_REQUEST {switch [HTTP::uri] {'/ws1/ws.jsp' {log local0. '[HTTP::uri]-Redirected to JSP Pool'pool JSP}default { log local0. '[HTTP::uri]-Redirected to Non-JSP Pool'pool NonJSP}}}However, the iRule is NOT behaving as expected. Below is a snapshot of the log:/WS1/ws.jsp-Redirected to JSP Pool/WS1/ws.jsp-Redirected to JSP Pool/WS1/ws.jsp-Redirected to JSP Pool/WS1/WS.jsp-Redirected to Non-JSP Pool/ws1/WS.jsp-Redirected to Non-JSP Pool/WS1/ws.jsp-Redirected to JSP Pool/ws1/ws.jsp-Redirected to Non-JSP PoolWhat should the LTM Specialist do to resolve this?

Use the followinG. switch [string tolower [HTTP::uri]]

Use the followinG. switch -lc [HTTP::uri]

Use the followinG. switch [string tolower [HTTP::uri]]

Set the 'Case Sensitivity' option of each member to 'None'.

Select the 'Process Case-Insensitivity' option for the virtual server.

An LTM device has a virtual server configured as a Performance Layer 4 virtual listening on 0.0.0.0:0 to perform routing of packets to an upstream router. The client machine at IP address 192.168.0.4 is attempting to contact a host upstream of the LTM device on IP address 10.0.0.99.The network flow is asymmetrical, and the following TCP capture displays:# tcpdump -nnni 0.0 'host 192.168.0.4 and host 10.0.0.99'tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on 0.0, link-type EN10MB (Ethernet), capture size 96 bytes05:07:55.499954 IP 192.168.0.4.35345 > 10.0.0.99.443: S 3205656213:3205656213(0) ack 3267995082 win 148005:07:55.499983 IP 10.0.0.99.443 > 192.168.0.4.35345: R 1:1(0) ack 1 win 005:07:56.499960 IP 192.168.0.4.35345 > 10.0.0.99.443: S 3205656213:3205656213(0) ack 3267995082 win 148005:07:56.499990 IP 10.0.0.99.443 > 192.168.0.4.35345: R 1:1(0) ack 1 win 04 packets capturedWhich option within the fastL4 profile needs to be enabled by the LTM Specialist to prevent the LTM device from rejecting the flow?

Generate Initial Sequence Number

An LTM Specialist has configured a virtual server for www.example.com, load balancing connections to a pool of application servers that provide a shopping cart application. Cookie persistence is enabled on the virtual server. Users are able to connect to the application, but the user's shopping cart fails to update. A traffic capture shows the following:Request:GET /cart/updatecart.php HTTP/1.1Host: www.example.comConnection: keep-aliveCache-Control: max-age=0User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.4 (KHTML, like Gecko) Chrome/22.0.1229.94 Safari/537.4Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-EncodinG. gzip,deflate,sdchAccept-LanguagE. en-US,en;q=0.8Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3CookiE. BIGipServerwebstore_pool=353636524.20480.0000Response:HTTP/1.1 200 OKDatE. Wed, 24 Oct 2012 18:00:13 GMTServer: Apache/2.2.22 (Ubuntu)X-Powered-By: PHP/5.3.10-1ubuntu3.1Set-CookiE. cartID=647A5EA6657828C69DB8188981CB5; path=/; domain=wb01.example.comKeep-AlivE. timeout=5, max=100Connection: Keep-AliveContent-TypE. text/htmlNo changes can be made to the application.What should the LTM Specialist do to resolve the problem?

Use an iRule to rewrite the cartID cookie domain.

Create a universal persistence profile on the cartID cookie.

Enable source address persistence as a fallback persistence method.

Create a cookie persistence profile with 'match across services' enabled.

An LTM Specialist has been asked to configure a virtual server to distribute connections between a pool of two application servers with addresses 172.16.20.1 and 172.16.20.2. The application servers are listening on TCP ports 80 and 443. The application administrators have asked that clients be directed to the same node for both HTTP and HTTPS requests within the same session.Virtual servers vs_http and vs_https have been created, listening on 1.2.3.100:80 and 1.2.3.100:443, respectively.Which configuration option will result in the desired behavior?

Create pool http_pool with members 172.16.20.1:80 and 172.16.20.2:80 Create pool https_pool with members 172.16.20.1:443 and 172.16.20.2:443 Assign http_pool as the default pool for vs_http Assign https_pool as the default pool for vs_https Create a source address persistence profile with 'match across services' enabled Assign the persistence profile to vs_http and vs_https

Create pool app_pool with members 172.16.20.1:any and 172.16.20.2:any Assign app_pool as the default pool for both vs_http and vs_https Disable port translation for vs_http and vs_https

Create pool http_pool with members 172.16.20.1:80 and 172.16.20.2:80 Assign pool http_pool as the default pool for both vs_https and vs_https Disable port translation for vs_https Create an SSL persistence profile with 'match across virtual servers' enabled Assign the persistence profile to vs_http.

Create pool http_pool with members 172.16.20.1:80 and 172.16.20.2:80 Create pool https_pool with members 172.16.20.1:443 and 172.16.20.2:443 Assign http_pool as the default pool for vs_http Assign https_pool as the default pool for vs_https Create a source address persistence profile with 'match across services' enabled Assign the persistence profile to vs_http and vs_https

Create pool http_pool with members 172.16.20.1:80 and 172.16.20.2:80 Create pool https_pool with members 172.16.20.1:443 and 172.16.20.2:443 Assign http_pool as the default pool for vs_http Assign https_pool as the default pool for vs_https Create an SSL persistence profile with 'match across virtual servers' enabled Assign the persistence profile to vs_http

An LTM Specialist is investigating reports from users that SSH connections are being terminated unexpectedly. SSH connections are load balanced through a virtual server. The users experiencing this problem are running SQL queries that take upwards of 15 minutes to return with no screen output. The virtual server is standard with a pool associated and no other customizations.What is causing the SSH connections to terminate?

The virtual server has no persistence.

The pool has Reselect Retries set to 0.

Users in a branch office are reporting a website is always slow. No other users are experiencing the problem. The LTM Specialist tests the website from the external VLAN along with testing the servers directly. All tests indicate normal behavior. The environment is a single HTTP virtual server on the external VLAN with a single pool containing three HTTP pool members on the internal VLAN.Which two locations are most appropriate to collect additional protocol analyzer data? (Choose two.)

a user's Active Directory authentication

An LTM Specialist has a single HTTPS virtual server doing SSL termination. No server SSL profile is defined. The pool members are on the internal VLAN answering on HTTP port 80. Users with certain browsers are experiencing issues.Which two locations are most appropriate to gather packets needed to determine the SSL issue? (Choose two.)

LTM device's management interface

An application owner claims an LTM device is delaying delivery of an HTTP application. The LTM device has two VLANs, an internal and an external. The application servers reside on the internal VLAN. The virtual server and clients reside on the external VLAN.With appropriate filters applied, which solution is most efficient for obtaining packet captures in order to investigate the claim of delayed delivery?

one capture on the internal interface

one capture on the external interface

one capture on the management interface

A client (10.10.1.30) connecting to an HTTPS virtual server (10.10.1.100) with a clientssl profile is getting an SSL error.Which options will trace this issue?

tcpdump -i external -s 0 -w /shared/ssl_problem.cap port 443 and host 10.10.10.30 and host 10.10.1.100 ssldump -r /shared/ssl_problem.cap -n -x

tcpdump -i external -X -e -nn -vvv -w /shared/ssl_problem.cap port 443 and host 10.10.1.30 ssldump -r /shared/ssl_problem.cap -n -x

tcpdump -i external -s 0 -w /shared/ssl_problem.cap port 443 and host 10.10.10.30 and host 10.10.1.100 ssldump -r /shared/ssl_problem.cap -n -x

tcpdump -i external -X -s 0 -vvv src host 10.10.10.30 and dst host 10.10.1.100 and port 443 > /shared/ssl_problem.cap ssldump -r /shared/ssl_problem.cap -n -x

tcpdump -i external -X -e -nn -vv port 443 and host 10.10.1.100 and host 10.10.1.30 > /shared/ssl_problem.cap ssldump -n -x < /shared/ssl_problem.cap

An LTM device is deployed in a one-armed topology. The virtual server, clients, and web servers are connected on the LTM device internal VLAN. A client tries to connect to the virtual server and is unable to establish a connection. A packet capture from the LTM device internal VLAN shows that the HTTP request is being forwarded to the web server.From which two additional locations should protocol analyzer data be collected? (Choose two.)

network interface of web server

network interface of client machine

network interface of web server

network interface of client machine

internal VLAN interface of LTM device

external VLAN interface of LTM device

any network interface of the Internet firewall

An LTM Specialist configures a new HTTP virtual server on an LTM device external VLAN. The web servers are connected to the LTM device internal VLAN. Clients trying to connect to the virtual server are unable to establish a connection. A packet capture shows an HTTP response from a web server to the client and then a reset from the client to the web server.From which two locations could the packet capture have been collected? (Choose two.)

network interface of web server

network interface of client machine

network interface of web server

network interface of client machine

internal VLAN interface of the LTM device

external VLAN interface of the LTM device

management VLAN interface of the LTM device

The LTM Specialist is writing a custom HTTP monitor for a web application and has viewed the content by accessing the site directly via their browser. The monitor continually fails. The monitor configuration is:ltm monitor http /Common/exampleComMonitor {defaults-from /Common/httpdestination *:*interval 5recv 'Recent Searches'send 'GET /app/feed/current\?uid=20145 HTTP/1.1\\r\\nHost: www.example.com\\r\\nAccept-EncodinG. gzip, deflate\\r\\nConnection: close\\r\\n\\r\\n'time-until-up 0timeout 16}A trace shows the following request and response:Request:GET /app/feed/current?uid=20145 HTTP/1.1Host www.example.comAccept-Encoding gzip, deflateConnection: closeResponse:HTTP/1.1 302 Moved TemporarilyDate Wed, 17 Oct 2012 18:45:52 GMTServer ApacheLocation https://example.com/login.jspContent-Encoding gzipContent-Type text/html;charset=UTF-8Set-CookiE. JSESSIONID=261EFFBDA8EC3036FBCC22D991AC6835; Path=/app/feed/current?uid=20145What is the problem?

The request does NOT include any cookies and the application is expecting a session cookie.

The request does NOT include a User-Agent header.

The HTTP monitor does NOT support monitoring jsp pages.

The request does NOT include any cookies and the application is expecting a session cookie.

The request includes an Accept-Encoding so the server is responding with a gzipped result and LTM monitors CANNOT handle gzipped responses.

An LTM Specialist configures an HTTP monitor as follows:ltm monitor http stats_http_monitor {defaults-from httpdestination *:*interval 5recv 'Health check: OK'send 'GET /stats/stats.html HTTP/1.1\\r\\nHost: www.example.com\\r\\nAccept-EncodinG. gzip, deflate\\r\\nConnection: close\\r\\n\\r\\n'time-until-up 0timeout 16}The monitor is marking all nodes as down. A trace of the HTTP conversation shows the following:GET /stats/stats.html HTTP/1.1Host: www.example.comAccept-EncodinG. gzip, deflateConnection: closeHTTP/1.1 401 Authorization RequiredDatE. Tue, 23 Oct 2012 19:38:56 GMTServer: Apache/2.2.15 (Unix)WWW-AuthenticatE. Basic realm='Please enter your credentials'Content-LengtH. 480Connection: closeContent-TypE. text/html; charset=iso-8859-1Which action will resolve the problem?

Add a valid username and password to the monitor.

Add an NTLM profile to the virtual server.

Add a valid username and password to the monitor.

Use an HTTPS monitor with a valid certificate instead.

Add a backslash before the colon in the receive string.

The following decoded TCPDump capture shows the trace of a failing health monitor.00:00:13.245104 IP 10.29.29.60.51947 > 10.0.0.12.http: P 1:59(58) ack 1 win 46 <nop,nop,timestamp 2494782300 238063789> out slot1/tmm3 lis=0x0000: 4500 006e 3b19 4000 4006 ce0c 0a1d 1d3c E ..n;.@.@......<0x0010: 0a00 000c caeb 0050 8be5 aca3 dd65 e3e1 .......P .....e..0x0020: 8018 002e 1b41 0000 0101 080a 94b3 5b5c .....A ........[\0x0030: 0e30 90ad 4745 5420 2f74 6573 745f 7061 .0..GET ./test_pa0x0040: 6765 2e68 746d 6c20 4854 5450 312e 310d ge.html.HTTP1.1.0x0050: 0a48 6f73 743a 200d 0a43 6f6e 6e65 6374 .Host:...Connect0x0060: 696f 6e3a 2043 6c6f 7365 0d0a 0d0a 0105 ion:.Close......0x0070: 0100 0003 00 .....00:00:13.245284 IP 10.0.0.12.http > 10.29.29.60.51947: . ack 59 win 362 <nop,nop,timestamp 238063789 2494782300> in slot1/tmm3 lis=0x0000 0ffd 0800 4500 00c9 6f68 4000 8006 755d ....E...oh@...u]0x0010 0a29 0015 0a29 0103 0050 e0d6 4929 90eb .)...)...P..I)..0x0020 6f12 d83c 8019 fab3 9b31 0000 0101 080a o..<.....1......0x0030 0068 4e10 5240 6150 4854 5450 2f31 2e31 .hN.R@aPHTTP/1.10x0040 2034 3030 2042 6164 2052 6571 7565 7374 .400.Bad.Request0x0050 0d0a 436f 6e74 656e 742d 5479 7065 3a20 ..Content-Type:.0x0060 7465 7874 2f68 746d 6c0d 0a44 6174 653a text/html..Date:0x0070 2054 6875 2c20 3231 204a 616e 2032 3031 .Mon,.01.Jan.2010x0080 3020 3138 3a35 383a 3537 2047 4d54 0d0a 2.00:00:01.GMT..0x0090 436f 6e6e 6563 7469 6f6e 3a20 636c 6f73 Connection:.clos0x00a0 650d 0a43 6f6e 7465 6e74 2d4c 656e 6774 e..Content-Lengt0x00b0 683a 2032 300d 0a0d 0a3c 6831 3e42 6164 h:.20....< h1 >Bad0x00c0 2052 6571 7565 7374 3c2f 6831 3e .Request< /h1 >The health monitor is sending the string shown in the capture; however, the server response is NOT as expected. The correct response should be an HTML page including the string 'SERVER IS UP'.What is the issue?

Incorrect syntax in send string. 'HTTP1 .1' should be 'HTTP/1 .1'.

The /test_page.html does NOT exist on the web server.

Incorrect syntax in send string. 'HTTP1 .1' should be 'HTTP/1 .1'.

Incorrect syntax in send string. 'Connection: Close' should be 'Connection: Open'.

The wrong HTTP version is specified in the send string. Version 1 .2 should be used instead of version 1 .1 .

An LTM device is monitoring pool members on port 80. The LTM device is using an HTTP monitor with a send string of GET / and a blank receive string.What would cause the pool members to be marked down?

A pool member does NOT acknowledge the connection SYN on port 80.

A pool member responds with an HTTP 200 series response code.

A pool member responds with an HTTP 300 series response code.

A pool member responds with an HTTP 400 series response code.

A pool member responds with an HTTP 500 series response code.

A pool member does NOT acknowledge the connection SYN on port 80.

An LTM HTTP pool has an associated monitor that sends a string equal to 'GET /test.html'.Which two configurations could an LTM Specialist implement to allow server administrators to disable their pool member servers without logging into the LTM device? (Choose two.)

Set 'receive string' equal to 'SERVER UP and ask the server team to set string 'SERVER DOWN' in test.html.

Set 'receive disable string' equal to 'SERVER DOWN' and ask the server team to set string 'SERVER DOWN' in test.html.

Set monitor to transparent and ask the server team to set string 'TRANSPARENT' in test.html.

Set 'receive string' equal to 'SERVER UP and ask the server team to set string 'SERVER DOWN' in test.html.

Set 'alias' equal to 'SERVER DOWN' and ask the server team to set string 'SERVER DOWN' in test.html.

Set 'receive disable string' equal to 'SERVER DOWN' and ask the server team to set string 'SERVER DOWN' in test.html.

Set 'disable pool member' equal to 'SERVER UP' and ask the server team to set string 'SERVER DOWN' in test.html.

An LTM Specialist is receiving reports from customers about multiple applications failing to work properly. The LTM Specialist looks at the services running and notices that the bigd process has NOT started.How are monitored LTM device objects marked when the bigd process is stopped?

unchanged until bigd is restarted

An LTM Specialist is setting up a monitor for an HTTP 1.1 server. The response to a GET / is:HTTP/1.1 302 Moved TemporarilyLocation: http://www.example.com/new/location.htmlWhich send string settings should the LTM Specialist use to force a proper response?

GET /new/location.html HTTP/1.1\r\nHost: www.example.com\r\nConnection: Close\r\n\r\n

GET / HTTP/1.0\r\nHost: host.domain.com\r\nConnection: Close\r\n\r\n

GET /new/location.html HTTP/1.1\r\nHost: www.example.com\r\nConnection: Close\r\n\r\n

GET / HTTP/1.1\r\nHost: www.example.com/new/location.html\r\nConnection: Close\r\n\r\n

GET /new/location.html HTTP/1.1\r\nHost: host.domain.com/new/locations.html\r\nConnection: Close\r\n\r\n

F5 301b Practice Test 2 - Free Online Exam Prep & Questions

Question 1 / 40

An IT administrator wants to log which server is being load balanced to by a user with IP address 10.10.10.25.

Which iRule should the LTM Specialist use to fulfill the request?

when SERVER_CONNECTED { if { [IP::addr [IP::remote_addr]] equals 10.10.10.25]} { log local0. 'client 10.10.10.25 connected to pool member [IP::addr [LB::server addr]]' } }

when CLIENT_ACCEPTED { if { [IP::addr [clientside [IP::remote_addr]] equals 10.10.10.25]} { log local0. 'client 10.10.10.25 connected to pool member [IP::addr [LB::server addr]]' } }

when SERVER_CONNECTED { if { [IP::addr [clientside [IP::remote_addr]] equals 10.10.10.25]} { log local0. 'client 10.10.10.25 connected to pool member [IP::addr [LB::server addr]]' } }

when CLIENT_ACCEPTED { if { [IP::addr [IP::remote_addr] equals 10.10.10.25]} { log local0. 'client 10.10.10.25 connected to pool member [IP::addr [LB::server addr]]' } }

Comment (0)

F5 301b Practice Test 2

Question

F5 301b Practice Tests

Practice Tests