Objective 2.12 Explain the Use of Device Certificates in iQuery [SSL Components, Expiration, 3rd Party Certs] 302 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During a security audit, an administrator is asked to explain the SSL components used in the device certificate for iQuery. Which components are essential for the iQuery TLS handshake to succeed?

   • APublic key, private key, and a certificate chain that the peer trusts.
   • BCertificate chain and a shared secret configured on both devices.
   • CPublic key and certificate chain only; the private key is not needed for iQuery.
   • DPrivate key and a certificate signing request (CSR) only.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a benefit of using a third-party certificate authority (CA) for device certificates in iQuery?

   • AIt simplifies certificate management by leveraging an existing enterprise PKI infrastructure
   • BIt eliminates the need for private keys on the BIG-IP devices
   • CIt allows the BIG-IP devices to trust each other without needing to import the CA certificate on each device
   • DIt guarantees that certificates will never expire
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An organization is migrating from self-signed to third-party certificates for iQuery. They have a multi-tier CA hierarchy. During the migration, they want to minimize the risk of iQuery failure. What is the most important step to ensure a smooth transition?

   • AUse the same private key for the new third-party certificate as the old self-signed certificate.
   • BInstall the full certificate chain, including intermediate and root CAs, on each device and ensure peers trust the root.
   • CDisable iQuery during the migration to avoid errors.
   • DInstall only the device certificate on each device; the peer will automatically fetch the chain.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An organization uses third-party certificates for iQuery. The certificate on one BIG-IP DNS device expired yesterday, and iQuery sync has stopped. The administrator has a new certificate ready, but the peer device is in a remote data center and cannot be accessed immediately. What is the best course of action to restore iQuery as quickly as possible?

   • ARevert the device certificate to a previous version that is still valid.
   • BDisable iQuery and use manual DNS configuration until the peer is accessible.
   • CInstall the new certificate on the local device and temporarily configure the peer to trust the new certificate via a secure out-of-band method.
   • DWait until the peer device can be accessed to install the new certificate on both devices.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company uses self-signed device certificates for iQuery between BIG-IP DNS devices. The administrator wants to avoid unexpected outages due to certificate expiration. Which approach should be used to monitor and renew these certificates?

   • AConfigure the certificates to never expire by setting a very long validity period.
   • BReplace self-signed certificates with third-party certificates that automatically renew.
   • CSet up a recurring task to check certificate expiration and manually renew before the expiry date.
   • DUse the BIG-IP automatic certificate renewal feature, which renews self-signed certificates before they expire.
   Reveal Solution Discussion Select an answer first