F5 101 - Application Delivery Fundamentals

Front 1

Persistent connection was made available in what HTTP version?

Back 1

HTTP/1.1

Front 2

SIP can be described as a protocol to allow what?

Back 2

Communicating between different devices on a company network, whether on the LAN, the WAN, or across the Internet

Front 3

With FTP, which port is the control port & what is the data port?

Back 3

Control port: 21, Data Port: 20

Front 4

Valid definition of a cookie?

Back 4

A cookie is a piece of text that a web server can store on a user's hard disk. Cookies allow a website to store information on a user's machine and later retrieve it. The piece of information are stored as a name-value pair.

Front 5

What 3 parts does the URL consist of?

Back 5

1. Network protocol

2. Host name or address

3. File or resource location IE: http:// or ftp://

Front 6

What is an iRule?

Back 6

A script that you write if you want to make use of some of the extended capabilities of the BIG-IP that are unavailable via the CLI or GUI.

Front 7

Using iRules, you send traffic not only to pools, but to where?

Back 7

Individual pool members, ports, or URIs

Front 8

What does UIE stand for?

Back 8

Universal Inspection Engine

Front 9

The syntax that you use to write iRules is based on what?

Back 9

Tool Command Language (Tcl)

Front 10

iRules are configuration objects, which means they are part of what file?

Back 10

bigip.conf file - along with your pools, virtual servers, monitors, etc

Front 11

TCL is an interpreted scripting language, so why do you not need to instantiate the interpreter every time an iRule is executed?

Back 11

Every time you save your configuration all of your iRule are pre-compiled into byte-code. Byte-code is mostly compiled and has the vast majority of the interpreter tasks already performed, so that TMM can directly interpret the remaining object

Front 12

What must be done before an iRule is actually effective?

Back 12

It must be applied to a virtual server before it can affect any traffic. If it's not applied to a virtual server it's effectively disabled

Front 13

Events are one of the ways in which iRules have been made to be what?

Back 13

Network aware, as a language

Front 14

When would it be ideal to use an iRule?

Back 14

When you're looking to add some form of functionality to your application or app deployment , at the network layer. This functionality is NOT available within the GUI or CLI.

Front 15

What is an iApp?

Back 15

A user-customized framework for deploying applications

Front 16

What three components make up an iApp?

Back 16

1. Templates

2. Application Services

3. Analytics

Front 17

What is the definition of iControl?

Back 17

The first open API that enables applications to work in concert with the underlying network based on true software integration.

Front 18

What protocol does iControl use to ensure open communications between dissimilar systems?

Back 18

SOAP/XML

Front 19

What are two other more common names for a reverse proxy?

Back 19

1. Load balancer

2. Cache

Front 20

Reverse proxies are generally HTTP focused, but more recently can be seen used for what other 3 protocols?

Back 20

1. Streaming audio (RTSP)

2. File transfer (FTP)

3. Any application protocol over UDP or TCP.

Front 21

How many connections does a full proxy maintain?

Back 21

A full proxy maintains 2 separate connections:

1. One between itself and the client

2. One between and the destination server

Front 22

A full proxy maintains how many session tables?

Back 22

A full proxy maintains 2 separate session:

1. One on the client-side

2. One on the server-side

Front 23

What is packet-based design?

Back 23

A network device located in the middle of a stream of communications, but it is not an endpoint for those communications.

Front 24

Difference between packet-based design & proxy-based design?

Back 24

A proxy-based design fully understands the protocols, and is itself an endpoint and an originator for the protocol.

Front 25

A full proxy can have it's own __________ because it is a communication endpoint?

Back 25

Buffering, retransmits, & TCP options

Front 26

When running BIG-IP systems as a single device, HA refers to what?

Back 26

Core services being up and running on that devices, and VLANs being able to send and receive traffic.

Front 27

When running a BIG-IP system as a unit of a redundant system configuration, HA refers to what?

Back 27

Core system services being up and running on one of the two BIG-IP systems in the configuration. Connections being available between the BIG-IP system and pool of routers, and VLANs on the system being able to send/receive traffic.

Front 28

What are the two possible modes of HA?

Back 28

1. Active/standby

2. Active/Active

Front 29

When you configure hard-wires failover, you enable failover by using what?

Back 29

A failover cable to physically connect the two redundant units.

Front 30

When you configure a network failover, you enable failover by configuring your redundant system to use what?

Back 30

To use the network to determine the status of the active unit.

Front 31

To facilitate coordination of the failover process, each unit has what?

Back 31

Unit ID

Front 32

What is the process where you replicate one unit's main configuration file on the peer unit

Back 32

Configuration Synchronization or "ConfigSync"

Front 33

For active-active systems, you must configure what? What alone is not sufficient?

Back 33

You must configure network failover. Hard-wired failover alone is not sufficient

Front 34

What would you use to assign unit ID 1 to the flowing self IP address pertaining to virtual servers A & B?

Back 34

Configuration utility

Front 35

What is a static self IP address?

Back 35

IP address that you assign to a BIG-IP system VLAN

Front 36

F5 recommends that you setup what on each unit of a redundant system?

Back 36

Create an additional VLAN on each unit to be used specifically for failover communication.

Front 37

What is the ability of a BIG-IP system to monitor certain aspects of the system or network, detect, interruptions, and consequently take some action, such as rebooting or initiating failover to the peer unit?

Back 37

Fail-Safe

Front 38

It is essential that each unit shares, or synchronizes it's current configuration data with its peer unit in what deployment?

Back 38

Redundant System Configuration

Front 39

With respect to configuration synchronization, you can use the configuration utility to do what 4 things?

Back 39

1. View or specify the peer IP address to user for sync.

2. Enable or disable encryption of config data prior to sync.

3. Enable or disable the global display of sync status.

4. Specify sync direction

Front 40

What are 2 examples of load balancing algorithms?

Back 40

1. Round-Robin

2. Ratio

Front 41

What are two examples of dynamic load balancing algorithms?

Back 41

1. Least Connections

2. Fastest

Front 42

How does least connections algorithm work?

Back 42

Looks at current connection counts at layer 4 to the server and chooses the server with the least connections

Front 43

How does fastest algorithm work?

Back 43

Looks at the outstanding Layer 7 request and chooses the server with the lowest amount.

Front 44

What are persistent connections?

Back 44

Connections that are kept opened and reused. Most commonly in HTTP.

Front 45

What is persistence?

Back 45

It is related to the ability of the load-balancer or other traffic management solution to maintain a virtual connection between a client and a specific server

Front 46

Positive security moves away from "blocked" to a more what?

Back 46

"Allow what I know and expect" methodology

Front 47

Negative security moves towards what sort of policy?

Back 47

"Block what I know is bad", or deny access based on what has previously identified as content to be blocked

Front 48

A digital signature is basically a way to ensure that an electronic document is what?

Back 48

Authentic. Authentic means you know who created the document and you know it has not been altered in any way since the person created it.

Front 49

What is the process of taking all the data that one computer is sending to another and encoding it into a form that only the other computer will be able to decode?

Back 49

Encryption

Front 50

What is the process of verifying that information is coming from the trusted source?

Back 50

Authentication

Front 51

What does SAML stand for?

Back 51

Security Assertion Markup Lanuage

Front 52

What is SAML used for?

Back 52

Used for exchanging user authentication, entitlement, and attribute information. It is a derivative of XML.

Front 53

What are the 2 types of hardware platforms that F5 builds?

Back 53

Application delivery switches & chassis

Front 54

A chassis gives the customer what?

Back 54

The ability to purchase additional blades that can be inserted into the chassis when needed.

Front 55

What is the world's first on-demand ADC?

Back 55

VIPRION

Front 56

BIG-IP 1600

Back 56

1. Allows one additional module beyond BIG-IP LTM

2. Capable of running BIG-IP protocol security Manager, Global Traffic Manager, WAN Optimization Module, & Access Policy Manager

Front 57

BIG-IP 3600

Back 57

1. Allows one additional module beyond BIG-IP LTM

2. Capable of running BIG-IP protocol security Manager, Global Traffic Manager, WAN Optimization Module, & Access Policy Manager, WebAccelerator, Application Security Manager

Front 58

BIG-IP 3900

Back 58

1. Allows one additional module beyond BIG-IP LTM

2. Capable of running BIG-IP protocol security Manager, Global Traffic Manager, WAN Optimization Module, & Access Policy Manager, WebAccelerator, Application Security Manager

Front 59

The unified application delivery series includes what models?

Back 59

6900, 8900, 8950, & 11050

Front 60

What is the unified application Delivery series built for?

Back 60

High throughput, multiple modules, 6 to 12 gigabytes per second of throughput on Layer 7.

Front 61

What is the BIG-IP virtual Edition

Back 61

1. Allows customers to run BIG-IP products on a virtual machine

2. Provides more flexibility to customers

3. ADC deployment can vary with the application

Front 62

What are the 4 type of licenses for BIG-IP LTM VE?

Back 62

1. Trial

2. Lab edition

3. Production 200 mega-byte throughput

4. Production 1 gigabyte throughput

Front 63

HTTP pipelining is what?

Back 63

Opening a connection to the server and then sending multiple requests to the server without waiting for a response.

Front 64

What is the problem with pipelining?

Back 64

The server doesn't actually treat the request any different. HTTP/1.1 specification requires that a "server MUST send its response to those requests in the same order that the requests were received"

Front 65

What is a certificate Chain?

Back 65

A list of certificates used to authenticate an entity

Front 66

SSO?

Back 66

Sign Sign-on Authentication.

The ability to reduce the number of ID's and passwords the user has to remember.

Front 67

What is SAML used for?

Back 67

It is an XML-based framework for exchanging user authentication, entitlement, and attribute information.

Its purpose is to enable Single Sign-On for web applications across various domains.

Front 68

Browser cookies are not transferred between what?

Back 68

DNS domains

Front 69

IPsec is limited because it was not built with what in mind?

Back 69

IPsec solutions were designed for trusted site-to-site connectivity and NOT with a highly-mobile workforce in mind.

Front 70

When compared to IPsec, SSL VPNs are typically what?

Back 70

SSL-VPNs are typically:

1. Less costly to manage

2. Eliminate concerns related to open-by-default tunnels

3. Offer flexible experience for employees and business partners using untrusted end point environments

Front 71

By operating at the application layer, SSL-VPN can provide what?

Back 71

High granular policy and access control required for secure remote access.

Front 72

Because SSL is pair of any web browser, SSL-VPN solutions provide what?

Back 72

Client-less and web-delivered thin client access that significantly increases the number of points from which employees, partners, and customers can access network data

Front 73

BIG-IP VE can be used with what?

Back 73

LTM & APM

Front 74

To overcome packet loss, the acceleration device can implement what?

Back 74

Selective TCP acknowledgements (SACK) and advanced congestion control algorithms to prevent TCP from reducing throughput.

Front 75

One way a BIG-IP reduces server side TCP connections?

Back 75

It aggregates, or pools, TCP server-side connections by combining many separate transactions, potentially from many users, through fewer TCP connections.

Front 76

HTTP compression is done on acceleration devices for what 2 reason?

Back 76

1. Offload compression overhead from web servers

2. Enable the acceleration device to perform other optimization that improves performance

Front 77

Caching?

Back 77

Storing the data close to users and re-using the data during subsequent requests

Front 78

3 forms of caching?

Back 78

1. Web application instructs a browser to cache an object marked as static for a specific time period.

2. Deploy acceleration device in a data center to offload requests for web application content from the server.

3. Symmetric acceleration device caches and serves content to users at the remote site.

Front 79

2 Caching Limitations

Back 79

1. Client side acceleration device MUST implement access control to prevent unauthorized access to an object.

2. Client-side device may serve older, stale version of content

Front 80

What do http request and response headers consist of?

Back 80

1. An initial line

2. Zero or more header lines

3. a blank line

4. an optional message body

Front 81

In an HTTP header, what does an initial request line consist of?

Back 81

1. A method name (GET, POST, HEAD)

2. Local path of the requested resource

3. HTTP version being used (HTTP/x.x)

Front 82

What other name does the initial response line go by?

Back 82

status line

Front 83

What part does the status line consist of?

Back 83

1. The HTTP version (HTTP/x.x)

2. A response status code (200, 404)
3. English Reason Phrase (OK, Not Found)

Front 84

HTTP status code: 1xx

Back 84

Indicates informational messages only

Front 85

HTTP status code: 2xx

Back 85

Indicates success of some kind

Front 86

HTTP status code: 3xx

Back 86

Redirects the client to another URL

Front 87

HTTP status code: 4xx

Back 87

Indicates an error on the client's part

Front 88

HTTP status code: 5xx

Back 88

Indicates an error on the server's part

Front 89

What is the HEAD method and what does it request?

Back 89

Similar to GET, except it asks the server to return the response headers ONLY, and not the actual resource

Front 90

What is the post method and what does it request?

Back 90

Used to send data to the server to be processed in some way

Front 91

In what 3 ways does the POST method differ from the GET method?

Back 91

1. There is a block of data sent with the request. Usually there are extra headers to describe this message body like Content-Type & Content-Length.

2. The request URI is not a resource to retrieve; its usually a program to handle the data you're sending

3. HTTP response is normally program output, not a static file

Front 92

What is multi-homed?

Back 92

The ability for multiple domains to live on the same server.

Front 93

Multi-homed in HTTP/1.1 requests what line to be added to the header?

Back 93

Host line

Get /path/file.html HTTP/1.1

Host: www.host1.com:80

Front 94

What is the term for sending several HTTP requests in a series?

Back 94

HTTP pipelining

Front 95

What must the client include in the header to close the connection after the corresponding response?

Back 95

Connection: close

Front 96

LTM

Back 96

Local Traffic Manager

Full proxy between users and application servers. Creates a layer of abstraction to secure, optimize, and load balance application traffic.

Front 97

GTM

Back 97

Global Traffic Manager

Automatically routes connections to the closest or best performing data center in the event of an outage, overload, or other distruption

Front 98

APM

Back 98

Access Policy Manager

Provides secure, context-aware, and policy-based access control. It centralizes and simplifies AAA management directly on the BIG-IP system

Front 99

ASM

Back 99

Application Security Manager

Advanced web application firewall that protects critical applications and their data by defending against application specific attack that bypass conventional firewalls

Front 100

Edge Gateway

Back 100

Provides SSL VPN remote access security with applications acceleration and optimization services at the edge of the network

Front 101

Link Controller

Back 101

prevents costly downtime due to ISP problems or other link failures by automatically switching traffic to alternate ISP connections and ensuring use of the fastest available connection

Front 102

WOM

Back 102

WAN Optimization Manager

Overcomes network and application issues on the WAN to ensure that application performance data replication, and disaster recovery requirements are met

Front 103

WebAccelerator

Back 103

Gives your users an instant improvement in web application performance and helps reduce costs.

Front 104

ARX series

Back 104

Enable you to dramatically simplify data management and reduce storage costs.

Front 105

FirePass

Back 105

Allows users secure access from anywhere they have an internet connection, while Firepass ensures that connected computers are fully patches and protected

Front 106

3 LTM initial setup steps

Back 106

1. Setup MGMT port IP address via config utility

2. License the system through web interface

3. Run the setup utility

Front 107

Default LTM Management port IP address?

Back 107

192.168.1.245

Front 108

To gain a license, you need to use your registration key to generate what?

Back 108

A dossier and then present the dossier to the license server

Front 109

Base registration key is how many characters?

Back 109

27

Front 110

Systems are shipped with your registration key where?

Back 110

/config/RegKey.license

Front 111

After generating the dossier, where is it located?

Back 111

/config/bigip.license

Front 112

Dedicated?

Back 112

Designed for situations where only one module is functional on the system such as GTM

Front 113

Nominal

Back 113

A module gets the least amount of resources required. After all modules are enabled the modules gets additional resources from the portion of remaining resources

Front 114

Minimum

Back 114

Given the module minimum functional resources. No additional resources are ever allocated to the module

Front 115

None

Back 115

Specifies that a module is not provisioned

Front 116

Lite

Back 116

Available for selected modules granting limited features for trials

Front 117

setup utility includes the following:

Back 117

1. Self-IP addressing and Netmasks for VLANs

2. Assign interfaces to VLANs

3. IP address of the default route

4. Root password for CLI

5. admin password for GUI

6. IP address allowed for SSH

Front 118

Administrative IP access file:

Back 118

/etc/hosts.allow

Front 119

Interface and configuration files

Back 119

/config/bigip.conf

/config/bigip_base.conf

/config/BigDB.dat

Front 120

Default terminal settings for console settings?

Back 120

Bits per second: 19200

Data bits: 8

Parity: None

Stop bit: 1

Flow control: None

Front 121

File extension for backups

Back 121

*.ucs

Front 122

pool members are?

Back 122

Each of the actual servers used for client traffic. Includes IP address & port.

Front 123

The devices represented by the IP address of pool members are called what?

Back 123

Nodes - They may represent multiple pool members

Front 124

A pool is what?

Back 124

A group of pool members

Front 125

System logs

Back 125

/var/log/messages

Front 126

Packet filter logs

Back 126

/var/log/pktfilter

Front 127

local traffic logs

Back 127

/var/log/ltm

Front 128

Audit logs

Back 128

Display system configuration changes by user and time

Front 129

A full proxy maintains how many session tables?

Back 129

2

Front 130

DSR

Back 130

Direct Server Return

Requests are proxied by the device, but the responses do not return through the device. Known as a half proxy because only half the connection is proxied.

Front 131

What is proxy-based design

Back 131

A full proxy completely understands the protocols, and is itself and endpoint and an originator for the protocols.

Front 132

iRules

Back 132

Scripts created using TCL with custom F5 extensions that enables users to create unique functions triggered from TMOS events

Front 133

Single device HA

Back 133

1. Core services being up and running on that device

2. VLANs being able to send and receive traffic

Front 134

Redundant system configuration HA

Back 134

Core system services being up and running on one of the two BIG-IP systems. Connections being available between the BIG-IP system and a pool of routers, and VLANs on the system being able to send/receive traffic.

Front 135

Hard-wired failover

Back 135

Enable failover by using a failover cable to physically connect the two redundant units. This is the default setting.

Front 136

Network failover

Back 136

Enable failover by configuring redundant system to use the network to determine the status of the active unit.

Front 137

What is ConfigSys

Back 137

A process where you replicate one units main config file on the peer unit

Front 138

What does SNAT do?

Back 138

Secure Network Address Translation

Maps the source client IP address in a request to a translated address defined on the BIG-IP device

Front 139

What is intelligent SNAT

Back 139

Mapping of one or more original client IP address to a translated address

Front 140

Auto Last Hop

Back 140

Global setting that is used to track the source MAC address of incoming connections

Front 141

What is a node?

Back 141

The physical server itself that will receive traffic from the load balancer.

Front 142

How is a member different than a node?

Back 142

A member includes the TCP port of the actual application that will receive the traffic

Front 143

Random Algorithm

Back 143

Randomly distributes load across the servers available

Front 144

Round Robin Algorithm

Back 144

Passes each new connection request to the next server in line, eventually distributing connection evenly across the array of machines being load balanced

Front 145

Weighted Round Robin Algorithm

Back 145

The number of connections that each machine receives over time is proportionate to a ratio weight you define for each machine

Front 146

Dynamic round robin (dynamic ratio) algorithm

Back 146

Weights are based on continuous monitoring of the servers and are therefore continually changing. Distributed based on real-time server performance analysis

Front 147

Fastest Algorithm

Back 147

Passes a new connection based on the fastest response time of all servers

Front 148

Least connections algorithm

Back 148

The system passes a new connection to the server that has the least number of current connections. Works best with equipment that all has similar capabilities

Front 149

Observed Algorithm

Back 149

uses a combination of the logic used in the Least connections and fastest algorithms to load balance connections to servers. Servers are ranked based on current connections and response time

Front 150

Predictive Algorithm

Back 150

The system analyzes the trend of the ranking over time, determining whether a servers performance is currently improving or declining

Front 151

What is the primary reason for tracking & storing session data?

Back 151

The ensure the client requests are directed to the same pool member throughout the life of a session, or during subsequent sessions

Front 152

What is persistence profile?

Back 152

A pre-configured object that automatically enables persistence when you assign the profile to a Virtual system

Front 153

Destination address affinity persistence

Back 153

Also known as sticky persistence, destination address affinity persistence supports TCP and UDP protocols, and directs session requests to the same server based solely on the destination IP address of a packet

Front 154

Source address affinity persistence

Back 154

Also known as simple persistence, source address affinity persistence supports TCP and UDP protocols, and directs session requests to the same server based solely on the source IP address of the packet

Front 155

What is positive security model?

Back 155

One that defines what is allowed and rejects everything else

Front 156

What is negative security model?

Back 156

Defines what is not allowed, while implicitly allowing everything else

Front 157

Benefit of the positive security model

Back 157

A new attack, not anticipated by the admin/developer, will be prevented

Front 158

Reset on timeout

Back 158

The system sends a reset (RST) and deletes the TCP connection when the connection exceeds the idle timeout value. If disabled, the system will delete the TCP connection when it exceeds the idle timeout value, but will NOT send an RST to the client.

Front 159

SIP

Back 159

Session Initiated Protocol

Application layer protocol that can establish, modify, and terminate multimedia sessions such as Internet telephony calls

Front 160

HTTP header methods?

Back 160

1. GET

2. POST

3. PUT

4. DELETE

5. HEAD

Front 161

With the GET method, all query parameters are part of what?

Back 161

URI

Front 162

200 OK

Back 162

The request succeeded and the resulting resource is returned in the message body

Front 163

304 Not modified

Back 163

This shows that the resource in question has not changed and the browser should load it from its cache instead.

Front 164

404 Not found

Back 164

The requested resource doesn't exist on the server

Front 165

401 Authorization required

Back 165

This indicates that the resource is protected and requires valid credentials before the server can grant acess

Front 166

500 Internal Error

Back 166

An unexpected server error. The most common cause is a server-side script that has bad syntax, fails, or otherwise can't run correctly

Front 167

IPsec

Back 167

IP layer protocol that enables the sending and receiving of cryptographically protected packets of any size (TCP, UDP, ICMP) without any modifications.

Front 168

What are two cryptographic services that IPsec provides?

Back 168

1. Confidentiality and authenticity (Encapsulated security payload

2. Or Authenticity ONLY. (Authentication header)

Front 169

What is SSL?

Back 169

An application layer protocol, mostly utilized to protect HTTP transactions, and has been used for other purposes like IMAP AND POP3

Only compatible with applications running over TCP

Front 170

IPsec supports the use of Digital signatures and the use of secret key algorithm, where SSL supports only the use of what?

Back 170

Digital Signature

Front 171

200 OK

Back 171

Standard response for successful HTTP request

Front 172

SNAT

Back 172

Security Network address Translation

Maps the source client IP address in a request to the translated address defined on the BIG-IP device

Front 173

301 Moved permanently

Back 173

This and all future requests should be directed to the given URL

Front 174

303 See other

Back 174

The resource has moved to another URL, and it should be automatically retrieved by the client.

Front 175

Buffer-and-stitch Methodology

Back 175

Buffers a connection, often through TCP handshake process and potentially into the first few packets of application data, but then "stitches" a connection to a given server on the back-end using either layer 4 or layer 7 data, perhaps both.