Objective 2.12 Explain the Use of Device Certificates in iQuery [SSL Components, Expiration, 3rd Party Certs] 302 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the immediate impact on a BIG-IP DNS sync group when a device certificate expires?

   • AOnly new iQuery connections are blocked; existing connections remain active
   • BThe device continues to operate normally but logs a warning about the expired certificate
   • CThe device automatically renews the certificate using the certificate authority
   • DiQuery communication between the affected device and its peers fails, disrupting configuration synchronization
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A BIG-IP DNS device certificate was renewed, but the new certificate has a different subject name than the old one. The peer device still has the old certificate in its trust store. What is the impact on iQuery?

   • AiQuery will work, but the certificate will need to be renewed again immediately.
   • BiQuery will fail because the peer cannot match the new certificate to the expected identity.
   • CiQuery will work, but only for one-way sync.
   • DiQuery will continue to work because the subject name is not used in iQuery.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company has a policy that all certificates must be renewed at least 30 days before expiration. The administrator is setting up a process for BIG-IP DNS device certificates. Which process ensures compliance with this policy and avoids iQuery outages?

   • ASet up an automated script that renews certificates exactly on the expiration date.
   • BSchedule a monthly review of certificate expiration dates and renew any certificate that expires within the next 30 days.
   • CRenew certificates only when iQuery starts to fail.
   • DUse certificates with a 10-year validity and renew them every 5 years.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which method can be used to monitor the expiration of device certificates on a BIG-IP DNS device?

   • AChecking the syslog for certificate expiration warnings
   • BUsing the tmsh command 'show sys crypto cert'
   • CReviewing the certificate expiration date in the Configuration utility under Device Management
   • DMonitoring the iQuery port (4353) for connection failures
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is considering using a public CA-issued certificate for iQuery device certificates instead of self-signed certificates. What is a benefit of using a third-party certificate in this scenario?

   • AIt allows the use of a longer key length than self-signed certificates.
   • BIt eliminates the need to renew the certificate.
   • CIt simplifies trust management because the public CA is already trusted by the BIG-IP devices.
   • DIt automatically configures iQuery to use the certificate without manual steps.
   Reveal Solution Discussion Select an answer first