Online Access Free 6V0-22.25 Exam Questions

An Avi Administrator has just enabled a comprehensive WAF policy on a Virtual Service. The application owners report that overall application latency has increased. The administrator wants to determine how much of this new latency is being introduced specifically by the WAF inspection process. Which two metrics in the Virtual Service logs would be most useful to compare?
(Choose 2.)

• A.Total_Time
• B.App_Response_Time
• C.WAF_Time
• D.Client_RTT
• E.Server_RTT

A Security Administrator is configuring a new WAF Policy and wants to understand the performance implications. Which of the following statements are true regarding the impact of enabling WAF on an Avi Service Engine? (Choose 2.)

• A.Enabling WAF requires a dedicated Service Engine that cannot host other non-WAF Virtual Services.
• B.WAF memory consumption is fixed and does not change based on traffic volume.
• C.WAF processing can decrease the maximum SSL/TLS transactions per second (TPS) on a Service Engine.
• D.The complexity of the WAF Signatures and CRS rules directly affects CPU usage.
• E.Enabling WAF has no impact on Service Engine CPU or memory utilization.

An Avi Administrator enables a WAF policy with a large number of signatures on a high-traffic Virtual Service. Immediately, the administrator notices that the "Max SSL/TLS Transactions Per Second (TPS)" for the Service Engine has decreased. Why does enabling WAF have this effect?
# Service Engine Metrics (Post-WAF enablement)
- se.cpu.usage_average: 85%
- vs.l4.ssl_handshakes_failed: 50
- vs.l4.ssl_handshakes_successful: 1200/sec (previously 2000/sec)

• A.The WAF policy introduces network latency, which slows down the SSL/TLS handshake.
• B.The WAF policy limits the number of allowed SSL/TLS cipher suites.
• C.The WAF policy encrypts the traffic a second time, consuming SSL/TLS resources.
• D.The CPU resources on the Service Engine are now shared between SSL/TLS termination and WAF inspection.

An organization is considering two different WAF profiles for their application. Profile A uses only the basic OWASP Core Rule Set (CRS). Profile B uses the CRS plus advanced features like Threat Intelligence IP reputation filtering and bot detection. How will the capacity impact of these two profiles differ on the Service Engines? (Select all that apply.)

• A.The throughput of the Service Engine will likely be lower with Profile B than with Profile
• B.D. There will be no performance difference between the two profiles.
• C.Profile A will consume more memory than Profile
• D.Profile B will consume more memory than Profile A to hold the additional datasets.
• E.F. Profile B will consume more CPU than Profile A.
• F.Both profiles will have an identical impact on SSL/TLS TPS.

An administrator needs to secure multiple different websites (e.g., www.site-a.com, www.site- b.org, shop.site-c.net) on a single Virtual Service using a single IP address and port (e.g., 443).
How does Avi's certificate management handle this? (Select all that apply.)

• A.It is not possible; each website must have its own Virtual IP address.
• B.The administrator must create a single wildcard certificate (*.*.*) to cover all domains.
• C.The administrator can create separate certificates for each website and bind all of them to the same Virtual Service.
• D.The client's browser uses the Server Name Indication (SNI) TLS extension to specify which website it wants to connect to.
• E.The administrator can create a single certificate with multiple Subject Alternative Names (SANs) for each FQDN.
• F.The Virtual Service must be configured with an L4 Application Profile.