A company runs a critical web application with an SSL certificate that expires in 10 days. The operations team wants to renew the certificate with zero downtime. The certificate is currently installed on a load balancer that routes traffic to multiple backend servers. The team has automated the renewal process, but the load balancer does not support automatic certificate deployment. What is the best approach to ensure zero downtime?

Wait until the certificate expires and then update it, as the load balancer will automatically use the new certificate

Use a script to update the certificate on the load balancer and reload it without dropping existing connections

Generate a new certificate and deploy it to the backend servers only, ignoring the load balancer

Renew the certificate, then manually update the load balancer during a scheduled maintenance window

An administrator is configuring Apache to use a new SSL certificate. The certificate and private key are stored in separate PEM files. The administrator has verified that the files are readable. Which directives must be set in the Apache configuration to enable HTTPS?

SSLCertificateFile and SSLCertificateKeyFile

SSLCertificateChainFile and SSLCACertificateFile

In a certificate chain, what is the role of the root certificate?

It is the certificate issued to the end-user's application server

It is an intermediate certificate that links the server to the root

It is a backup certificate used only during renewal

It is the top-level certificate that is self-signed and trusted by clients

In an Nginx configuration, which directives specify the SSL certificate and private key files?

ssl_certificate and ssl_certificate_key

A user reports that when accessing https://app.example.com, the browser displays a warning that the connection is not private. The administrator checks the certificate and sees that it was issued for www.example.com. What is the most likely cause of this warning?

The certificate chain is incomplete

The server is using an outdated SSL/TLS protocol

The certificate hostname does not match the requested hostname

CiscoCertified DevNet Professional

Domain 4Objective 9

Configure Application Specific SSL Certificates 350-901 Practice Questions (Page 1)

Part of the 4.0 Application Deployment and Security domain, which accounts for 20% of the 350-901 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

8concepts

20%of the exam

Questions 1–5

1expert · hard
A company runs a critical web application with an SSL certificate that expires in 10 days. The operations team wants to renew the certificate with zero downtime. The certificate is currently installed on a load balancer that routes traffic to multiple backend servers. The team has automated the renewal process, but the load balancer does not support automatic certificate deployment. What is the best approach to ensure zero downtime?
Select an answer first
2application · medium
An administrator is configuring Apache to use a new SSL certificate. The certificate and private key are stored in separate PEM files. The administrator has verified that the files are readable. Which directives must be set in the Apache configuration to enable HTTPS?
Select an answer first
3foundation · easy
In a certificate chain, what is the role of the root certificate?
Select an answer first
4foundation · easy
In an Nginx configuration, which directives specify the SSL certificate and private key files?
Select an answer first
5application · medium
A user reports that when accessing https://app.example.com, the browser displays a warning that the connection is not private. The administrator checks the certificate and sees that it was issued for www.example.com. What is the most likely cause of this warning?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-901

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-901” is a trademark of its owner, used for identification only.