Riverbed Riverstone Certification 101-01 Questions & Answers

• Question 1:

  With a server-side Interceptor deployment, once a TCP handshake has been completed between the server-side SteelHead and the server, how will data packets sent from the server get forwarded to the server-side SteelHead?

  A. Destination NAT is performed on the Interceptor, changing the destination IP adress from the client IP to the SteelHead's IP.

  B. The server sees the IP address of the SteelHeads in-path interface as its client, so there is no need for the Interceptor to forward it.

  C. They are GRE-encapsulated by the Interceptor, and forwarded using the SteelHead IP.

  D. The Interceptor tunnels them over the connection using port 7850 to the SteelHeads.

  E. The Interceptor applies the MAC address of the SteelHead's in-path interface and forwards at layer 2.

  Correct Answer: A

  Once the initial handshake is completed, the interceptor use destination NATs packets to the steelhead so you will not see this traffic if you are filtering on the original client and server address. References: https://splash.riverbed.com/thread/5512

• Question 2:

  What does enabling "Out-of-Path Support" do on the General Service Settings page?

  A. It allows for Interceptor and VVCCP working.

  B. It allows the Primary interface to listen on port 7810.

  C. It disables the LAN Interface.

  D. It disables optimization on all in-path interfaces.

  E. It allows the Primary interface to listen on ports 7800 and 7810.

  Correct Answer: B

  If you have a backup, out-of-path Steelhead appliance in your system (that is, failover support), for Backup

  Appliance IP Address, specify the IP address and port for the backup appliance in

  the Backup IP and Port text boxes.

  Use the format 0.0.0.0/0. The default port is 7810.

  Note: Out-of-Path - The SteelHead isn't in the direct path between the client and the server. Servers see

  the IP address of the server-side SteelHead rather than the client IP address, which might impact security

  policies. An out-of-path configuration is suitable for data center locations where physically in-path or

  virtually in-path configurations aren't possible.

  References: Steelhead Appliance Installation and Configuration Guide, Version 7.0.3, May 2012, page 44

  https://support.riverbed.com/bin/support/download?did=614

• Question 3:

  Which policy types make up the configuration for a SteelHead Mobile client?

  A. Acceleration policy

  B. Endpoint policy

  C. Security policy

  D. A single policy for all the above

  Correct Answer: B

  Configuring Endpoint Settings for Policies

  You configure endpoint settings for SteelHead Mobile clients on the Endpoint Settings tab of the Manage >

  Policies page.

  Note: A policy is a set of optimization, security, location awareness, storage, and other configuration

  settings that determine the optimization rules for the SteelHead Mobile clients. SteelHead Mobile clients

  must have a policy and other endpoint-specific settings for optimization.

  References: SteelCentral Controller for SteelHead, Mobile User's Guide, Version 4.8, April 2016, page 143

  https://support.riverbed.com/bin/support/download?did=ponkltmr1vg9mv23ok2fmtgkj4

• Question 4:

  Which endpoint operations can you perform from the SteelCentral Controller for SteelHead Mobile web interface? (Choose four.)

  A. Reset Client-Server Connection

  B. Request System Dump

  C. Request TCP Dump

  D. Reset Client-Controller Connection

  E. Request Memory Dump

  Correct Answer: ABCE

  Reset Client-SMC Connection: Select the check box next to one or more endpoint user names, and click Reset ClientSMC Connection to reset the connection between the Mobile Controller and the endpoint client.

  Request System Dump: Select the check box next to one or more endpoint user names and click Request System Dump to upload the files.

  Request TCP Dump: Select the check box next to one or more endpoint user names and click Request TCP Dump to upload the files.

  Request Memory Dump: Uploads the memory dump files.

  References: Steelhead Mobile Controller User's Guide, Version 4.0.2, May 2013, Page 150 https:// support.riverbed.com/download.htm?did=874

• Question 5:

  When the SteelHead SaaS optimization service is correctly configured, how does the SteelHead identify the SaaS traffic that needs to be optimized?

  A. The SteelHead recognized the URL of the SaaS traffic using the DPI engine.

  B. The SteelHead must be configured with appropriate in-path rules on the cloud SteelHead.

  C. The SteelHead must be configured with appropriate in-path rules on the data center side.

  D. As part of the configuration, the SteelHead downloads a list of IP addresses that correspond to SaaS servers.

  E. The SteelHead must be configured with appropriate in-path rules on the client side.

  Correct Answer: E

  You can configure what traffic a Steelhead appliance optimizes and what other actions it performs, using the following:

  * In-Path rules - In-path rules determine the action a Steelhead appliance takes when a connection is

  initiated, usually by a client.

  *Peering rules - Peering rules determine how a Steelhead appliance reacts when it detects a probe

  query.

  In-path rules are used only when a connection is initiated. Because connections are typically initiated by clients, in-path rules are configured for the initiating, or client-side, Steelhead appliance.

  References: Steelhead Appliance Deployment Guide, Including the Steelhead Mobile Controller, December 2013 , page 26 https://support.riverbed.com/bin/support/download?did=a53locljdv9s5oc0agjp851iol

• Question 6:

  When examining SMB connections which are SteelHead optimized, you notice that for each IP client and server pair, there are often two connections created ?one on destination port 139 and one on destination port 445. What is the reason for this?

  A. This is because SMB2 and CIFS optimization are both enabled on the SteelHeads.

  B. The server must be ignoring or resetting connections on port 139, so the client tries again on port 445.

  C. The server must be ignoring or resetting connections on port 445, so the client again on port 139.

  D. Clients often try to connect on port 139 and 445 simultaneously for compatibility reasons. Once one connection is accepted, the other gets reset.

  Correct Answer: D

  Clients try to connect to 139 and 445 at the same time. Whatever ports gets the first response will be used for communications.

  References: https://support.riverbed.com/bin/support/static/lrj6rq1evg0fnm7pekuq3j2md1/html/vte4p5uj 2dkg9k1ukjv82835ci/sh_9.2_dg_protocols_html/index.html#page/sh_9.2_dg_protocols/cifs.html

• Question 7:

  When optimizing protocols such as signed SMB or encrypted MAPI, which of the following is true?

  A. Special configuration is always necessary on the Domain Controller.

  B. The server-side StealHead must be joined to the domain.

  C. The domain administrator password must be made available to the SteelHead.

  D. The client-side SteelHead must be joined to the domain.

  Correct Answer: B

  The server-side Stealhead appliance must be joined to the Windows Domain in order to Enable SMB Signing or to enable encrypted MAPI.

  Incorrect: Not A: No special configuration of the Domain Controller is necessary. Not C: SteelHead does not need the domain administrator password. Not D: No changes are required on the client-side Steelhead appliances

  References: Optimization in a Secure Windows Environment, White Paper , pages 35-36 https:// support.riverbed.com/download.htm?filename=public/doc/technotes/Windows_secur ity_guide.pdf

• Question 8:

  The SteelHead Admission Control feature activates when: (choose two)

  A. The data store has reached full capacity

  B. Throughput exceeds the licensed limit of the appliance

  C. Total connections exceeds the licensed limit of the appliance

  D. Optimization service memory exceeds the limit of the appliance

  E. Optimized connections exceed the licensed limit of the appliance

  Correct Answer: BE

  Note: Admission Control is a validation process in communication systems where a check is performed before a connection is established to see if current resources are sufficient for the proposed connection.

  References: http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=mmr_kc- 0125647

• Question 9:

  The SteelHead makes a connection to its peers using the Out of Band splice. What does the OOB splice do?

  A. All optimized connections flow over the OOB splice.

  B. The OBB splice is only used by SteelHead mobile clients.

  C. The OBB splice is only used to check the peer SteelHead is available.

  D. It is control channel that is used to exchange version and feature information between SteelHeads.

  Correct Answer: D

  An OOB splice is an independent, separate TCP connection made on the first connection between two peer Steelhead appliances used to transfer version, licensing and other OOB data between peer Steelhead appliances. An OOB connection must exist between two peers for connections between these peers to be optimized. If the OOB splice dies all optimized connections on the peer Steelhead appliances will be terminated.

  References: http://ccie11440.blogspot.se/2009/12/out-of-band-oob-splice.html

• Question 10:

  Which of the possible Simplified Routing modes should be used when installing the SteelHead on an 802.1Q trunk? (Choose three.)

  A. All

  B. None

  C. Destination and Source

  D. Destination Only

  Correct Answer: ACD

  In All mode the SteelHead collects mappings for destination and source IP, destination and source MAC, VLAN tag, and Steelhead appliance inner connection traffic and auto- discovery options. This option has the advantage of learning simplified entries faster than the destination only. option Riverbed recommends that you use in topologies when you deploy the Steelhead appliance a 802.1q trunk.

  In Destination and source mode the SteelHead collects mappings from destination and source IP, destination and source MAC, and VLAN tag (when deployed on 802.1q trunk).

  In Destination only mode the SteelHead collects mappings from destination IP, destination MAC, and VLAN tag (when deployed on 802.1q trunk).

  References:SteelheadAppliance Deployment Guide, Including the Steelhead Mobile Controller, December 2013, page 194