830-01 Sample Questions & Answers

The correct procedure for upgrading an HA pair is to upgrade the backup (standby) unit first. Once it has successfully rebooted with the new software version, you can initiate a manual failover. This makes the newly upgraded appliance the active primary. You can then proceed to upgrade the other appliance (now the backup) with minimal interruption to traffic, as one unit remains active throughout the process.

In a cloud environment like AWS, routing is controlled by VPC route tables. For a SteelHead-c to intercept traffic, the route tables for the relevant subnets must be explicitly configured to send traffic destined for the on-premises network (or other targets) to the Elastic Network Interface (ENI) of the SteelHead-c instance. If this routing is incorrect, traffic will bypass the appliance entirely.

The enabled parameter configures the SteelHead to perform SMB signing on behalf of the server if the client requests it, even if the server itself does not support or require signing. This allows optimization to proceed while still satisfying the client's security requirement. required would force signing always, and passthrough would disable signing optimization.

The Top Talkers report provides a breakdown of traffic by application, source/destination IP, and port. This allows an administrator to quickly identify which specific flows are generating the most traffic and, by extension, likely consuming the most CPU for optimization processing. This is more granular and actionable for this scenario than a general traffic summary.

This is a classic use case for server-side private key SSL optimization. By installing the actual private key of the POS server onto the SteelHead, the appliance can decrypt the traffic for optimization without needing to forge a proxy certificate. Since the client (POS terminal) sees the original, unaltered server certificate, there is no need to install a new trusted CA on the client side, thus satisfying the security team's constraint.

Path Selection rules use Application Groups (or individual applications) to classify traffic. Riverbed provides pre-defined application signatures for common SaaS applications like Office 365. The administrator would select the 'Microsoft Office 365' application group as the match criteria in the path selection rule to direct this specific traffic.

Connection Forwarding is the mechanism that allows for stateful failover. When enabled, the primary SteelHead synchronizes connection state information with the backup appliance. If the primary fails, the backup can take over and continue optimizing these existing connections without forcing them to be re-established, which minimizes disruption.

SCPS is a TCP variant specifically designed for links with high latency and significant packet loss, such as satellite connections. It uses a more robust mechanism for handling packet loss than standard TCP, allowing it to maintain higher throughput in lossy environments. Given the scenario of a satellite link with known packet drop issues, SCPS is the optimal choice.

The SteelHead Interceptor's primary role is to act as a traffic redirector and load balancer. It intercepts traffic and distributes it to a cluster of SteelHead appliances for optimization. The Interceptor itself does not perform the optimization (SDR, compression, protocol-specific optimizations); that is the job of the SteelHead appliances it manages.

SteelHeads use a proprietary, optimized connection between them, known as the inner channel. By default, MAPI optimization traffic is encapsulated and sent over TCP port 7810 between the peering appliances.

During the initial TCP handshake, SteelHeads insert special TCP options (probe options) to discover each other and negotiate optimization capabilities. The presence of these options is a key indicator that the SteelHeads are communicating for optimization purposes.