Objective 2.12 Explain the Use of Device Certificates in iQuery [SSL Components, Expiration, 3rd Party Certs] 302 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company has two BIG-IP DNS devices in a sync-failover group. The iQuery connection between them has been working for months, but after a recent certificate renewal on one device, the other device logs iQuery handshake failures. The certificates were renewed using the same key pair and same subject as before. What is the most likely cause of the failure?

   • AThe certificate renewal reset the device's hostname, causing a mismatch in the iQuery peer configuration.
   • BThe renewed certificate has a different serial number, which breaks the iQuery authentication.
   • CThe renewed certificate was not imported into the trust store on the peer device.
   • DThe private key was not exported along with the certificate, so the device cannot present it during the handshake.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An administrator is troubleshooting an iQuery connection failure between two BIG-IP DNS devices. The devices are in the same sync group and the network connectivity is fine. The administrator checks the device certificates and finds that the certificate on one device is self-signed, while the other device has a certificate signed by an internal CA. What is the most likely issue?

   • AThe devices are in different DNS sync groups, which prevents iQuery.
   • BThe devices have different hostnames, which breaks iQuery.
   • CThe devices are using different key algorithms, which is not supported.
   • DThe devices do not trust each other's certificates because they have different trust anchors.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In a BIG-IP DNS sync group, what is the primary purpose of device certificates in iQuery communication?

   • ATo authenticate the identity of each device and establish a secure, encrypted channel for iQuery traffic
   • BTo encrypt the data payload of every DNS query forwarded between devices
   • CTo allow the BIG-IP DNS to act as a certificate authority for issuing certificates to clients
   • DTo provide a backup copy of the device's configuration in case of hardware failure
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the recommended process for renewing a device certificate on a BIG-IP DNS device?

   • ADelete the old certificate and create a self-signed certificate with the same subject
   • BExtend the expiration date on the existing certificate using the Configuration utility
   • CGenerate a new key pair and certificate signing request (CSR), submit it to a CA, and install the returned certificate
   • DCopy the certificate from another device in the sync group
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A large enterprise has multiple BIG-IP DNS devices across different data centers. They use iQuery for sync. The security team mandates that all certificates be rotated every 90 days. The operations team is concerned about the operational burden and potential for outages. Which approach best balances security requirements and operational reliability?

   • ARenew certificates manually on each device every 90 days.
   • BUse a single certificate for all devices to simplify management.
   • CUse a centralized certificate management system to automate issuance and deployment to all devices, with a pre-staged renewal process.
   • DUse self-signed certificates with a 10-year validity to avoid frequent renewals.
   Reveal Solution Discussion Select an answer first