The following decoded TCPDump capture shows the trace of a failing health monitor.

00:00:13.245104 IP 10.29.29.60.51947 > 10.0.0.12.http: P 1:59(58) ack 1 win 46 <nop,nop,timestamp
2494782300 238063789> out slot1/tmm3 lis=
0x0000: 4500 006e 3b19 4000 4006 ce0c 0a1d 1d3c E..n;.@.@……<
0x0010: 0a00 000c caeb 0050 8be5 aca3 dd65 e3e1 …….P…..e..
0x0020: 8018 002e 1b41 0000 0101 080a 94b3 5b5c …..A……..[\\
0x0030: 0e30 90ad 4745 5420 2f74 6573 745f 7061 .0..GET./test_pa
0x0040: 6765 2e68 746d 6c20 4854 5450 312e 310d ge.html.HTTP1.1.
0x0050: 0a48 6f73 743a 200d 0a43 6f6e 6e65 6374 .Host:…Connect
0x0060: 696f 6e3a 2043 6c6f 7365 0d0a 0d0a 0105 ion:.Close……
0x0070: 0100 0003 00 …..
00:00:13.245284 IP 10.0.0.12.http > 10.29.29.60.51947: . ack 59 win 362 <nop,nop,timestamp 238063789
2494782300> in slot1/tmm3 lis=
0x0000 0ffd 0800 4500 00c9 6f68 4000 8006 755d ….E…oh@…u]
0x0010 0a29 0015 0a29 0103 0050 e0d6 4929 90eb .)…)…P..I)..0x0020 6f12 d83c 8019 fab3 9b31 0000 0101 080a o..<…..1……
0x0030 0068 4e10 5240 6150 4854 5450 2f31 2e31 .hN.R@aPHTTP/1.1
0x0040 2034 3030 2042 6164 2052 6571 7565 7374 .400.Bad.Request
0x0050 0d0a 436f 6e74 656e 742d 5479 7065 3a20 ..Content-Type:.
0x0060 7465 7874 2f68 746d 6c0d 0a44 6174 653a text/html..Date:
0x0070 2054 6875 2c20 3231 204a 616e 2032 3031 .Mon,.01.Jan.201
0x0080 3020 3138 3a35 383a 3537 2047 4d54 0d0a 2.00:00:01.GMT..
0x0090 436f 6e6e 6563 7469 6f6e 3a20 636c 6f73 Connection:.clos
0x00a0 650d 0a43 6f6e 7465 6e74 2d4c 656e 6774 e..Content-Lengt
0x00b0 683a 2032 300d 0a0d 0a3c 6831 3e42 6164 h:.20….<h1>Bad
0x00c0 2052 6571 7565 7374 3c2f 6831 3e .Request</h1>
The health monitor is sending the string shown in the capture; however, the server response is NOT as
expected. The correct response should be an HTML page including the string ‘SERVER IS UP’.
What is the issue?

An LTM Specialist configures an HTTP monitor as follows:ltm monitor http stats_http_monitor {
defaults-from http
destination *:*
interval 5
recv “Health check: OK”
send “GET /stats/stats.html HTTP/1.1\\\\r\\\\nHost: www.example.com\\\\r\\\\nAccept-EncodinG. gzip, deflate\\\\r
\\\\nConnection: close\\\\r\\\\n\\\\r\\\\n”
time-until-up 0
timeout 16
}
The monitor is marking all nodes as down. A trace of the HTTP conversation shows the following:
GET /stats/stats.html HTTP/1.1
Host: www.example.com
Accept-EncodinG. gzip, deflate
Connection: close
HTTP/1.1 401 Authorization Required
DatE. Tue, 23 Oct 2012 19:38:56 GMT
Server: Apache/2.2.15 (Unix)
WWW-AuthenticatE. Basic realm=”Please enter your credentials” Content-LengtH. 480
Connection: close
Content-TypE. text/html; charset=iso-8859-1
Which action will resolve the problem?

The LTM Specialist is writing a custom HTTP monitor for a web application and has viewed the content by
accessing the site directly via their browser. The monitor continually fails. The monitor configuration is:
ltm monitor http /Common/exampleComMonitor {
defaults-from /Common/http
destination *:*
interval 5
recv “Recent Searches”
send “GET /app/feed/current\\?uid=20145 HTTP/1.1\\\\r\\\\nHost:
www.example.com\\\\r\\\\nAccept-EncodinG. gzip, deflate\\\\r\\\\nConnection: close\\\\r\\\\n\\\\r\\\\n” time-until-up 0
timeout 16
}
A trace shows the following request and response:
Request:
GET /app/feed/current?uid=20145 HTTP/1.1
Host www.example.com
Accept-Encoding gzip, deflate
Connection: close
Response:
HTTP/1.1 302 Moved Temporarily
Date Wed, 17 Oct 2012 18:45:52 GMT
Server Apache
Location https://example.com/login.jsp
Content-Encoding gzip
Content-Type text/html;charset=UTF-8
Set-CookiE. JSESSIONID=261EFFBDA8EC3036FBCC22D991AC6835; Path=/app/feed/current?
uid=20145
What is the problem?

An LTM Specialist configures a new HTTP virtual server on an LTM device external VLAN. The web
servers are connected to the LTM device internal VLAN. Clients trying to connect to the virtual server are
unable to establish a connection. A packet capture shows an HTTP response from a web server to the
client and then a reset from the client to the web server.
From which two locations could the packet capture have been collected? (Choose two.)

An LTM device is deployed in a one-armed topology. The virtual server, clients, and web servers are
connected on the LTM device internal VLAN. A client tries to connect to the virtual server and is unable to
establish a connection. A packet capture from the LTM device internal VLAN shows that the HTTP request
is being forwarded to the web server.
From which two additional locations should protocol analyzer data be collected? (Choose two.)

A client (10.10.1.30) connecting to an HTTPS virtual server (10.10.1.100) with a clientssl profile is getting
an SSL error.
Which options will trace this issue?

An application owner claims an LTM device is delaying delivery of an HTTP application. The LTM device
has two VLANs, an internal and an external. The application servers reside on the internal VLAN. The
virtual server and clients reside on the external VLAN.
With appropriate filters applied, which solution is most efficient for obtaining packet captures in order to
investigate the claim of delayed delivery?

A user is having issues with connectivity to an HTTPS virtual server. The virtual server is on the LTM
device’s external vlan, and the pools associated with the virtual server are on the internal vlan. An LTM
Specialist does a tcpdump on the external interface and notices that the host header is incomplete.
In which location should the LTM Specialist put a traffic analyzer to gather the most pertinent data?

An LTM Specialist has a single HTTPS virtual server doing SSL termination. No server SSL profile is
defined. The pool members are on the internal VLAN answering on HTTP port 80. Users with certain
browsers are experiencing issues.
Which two locations are most appropriate to gather packets needed to determine the SSL issue? (Choose
two.)

Users in a branch office are reporting a website is always slow. No other users are experiencing the
problem. The LTM Specialist tests the website from the external VLAN along with testing the servers
directly. All tests indicate normal behavior. The environment is a single HTTP virtual server on the external
VLAN with a single pool containing three HTTP pool members on the internal VLAN.
Which two locations are most appropriate to collect additional protocol analyzer data? (Choose two.)