Come back more Elby questions what types of security policies are supported by the elastic load balancer
for and negotiations between the Albi and clients choose to.
And I think from the previous lecture this is obvious.
So a custom security policies be ill be pre-define security policies see security groups D none of the
above.
OK so this is not right.
This is not right.
And this one is correct this one is correct.
Now if they mentioned to you what types of security policies are supported by the classic look balancer
for SS in negotiations between the Elby and the two instances so that becomes the back and you know
be inclined is front and Elby and easy two instances or back in two instances or four back end listeners
than it would have been only the predefined security policy because this one doesn't apply for the backend.
OK.
So in the US the correct answer is C and D are not correct and Argerich and those are inby.
Here is another question.
So our user has configured Elby with a TZP listener and they'll be as well as on the back end instances.
So TZP listeners on the beat and the back end if you do instances the user wants to enable a proxy protocol
so the user wants to enable a proxy protocol.
Of course that is only Elby to capture the source and destination IP information in the header.
So who's going to capture that.
This is the application right here.
When the packet is sent through with the proxy there in added into the packet to instance we'll be able
to read the header and find out the actual exactly the actual client that sent that request.
Which of the below mentioned statements helps.
OK.
This is where I get irritated.
This is where the attention has to be.
Is it help or does not help.
Here it says help.
So that's fine.
So I shouldn't be worried about getting answers and all that understand what does enabling proxy protocol
with DCP configuration on the BE do.
So we need one statement because we don't have multiple choices here.
One statement that would help the user understand the effect or the impact of enabling the proxy protocol
with DCB configurations on the LP.
So the answers are A If the end user is requesting behind a proxy server then they use that should not
enable a proxy protocol on the A B B B does not support a proxy protocol except with the DP listeners
configured at the front and C to enable proxy protocol they'll be must have SSL both for front and back
and listeners the you can enable proxy protocol disregarding whether the user is behind a proxy the
back in instances can read more than one proxy header in the packet.
Let's look at the analysis.
So a if the end user.
Which indeed are we talking about you're talking about the clients the ones who are connected through
the Internet through it enabling us to the Elby.
So these are the end users if they are behind a proxy.
So if they have the traffic that comes from the user machine or the laptop or handheld or whatever.
If it passes through a proxy if there is a proxy server then the user should not enable a proxy protocol.
So which user here we're talking about the end user or the client.
Here we're talking about the administrator.
Whoever runs the will be should not enable a proxy protocol on the Albi so you should not enable proxy
protocol and they will be if that traffic would arrive at the Elby already had passed through a proxy.
Is this one correct or wrong.
What do you think we are looking for one that would help the user understand or to understand.
Not sure.
So let's leave it for now.
Be be does not support a proxy protocol except to have HDTV as listeners configured at the front.
And this is like obviously wrong.
Why.
Because to enable proxy protocol we have to deal with these TZP and SSL H.T. to be an entity to be has
are not in the picture at all.
We are talking about proxy protocol.
So this one is wrong.
To enable proxy protocol there will be must have SSL both for front end and back end listeners.
This is wrong.
And in fact that proxy protocol is only supported if you have DCP DCP front end and back end or SSL
front end and DCP back and will cover that in one of the next questions.
The you can enable proxy protocol disregarding whether the user is behind a proxy the back end instances
can read more than one proxy header in the packet.
And this is obviously wrong.
So we are left with this one.
This one is the correct one.
I just left it.
I knew what the answer was but I just left it because I wanted to make sure that you guys can kind of
trigger your memory and remember the critical part of a b and this was explicitly mentioned.
One of the sleights.
So the application that you are using or the web server the Apache the etch a proxy or whatever you
are using here it can if it can support proxy headers it will it will expect to see one proxy header
in the packet not multiple proxy headers because that could cause errors the application would be confused
as which one it reads and if it reads the wrong one then it may do actions based on how you have configured
and scripted the application made to actions based on our own input.
So if the packet comes through a proxy don't enable proxy on the Albi.
Now one would ask me OK so how can the application then find about the source.
The ones who sent the request.
How can that be conveyed.
You have another option.
I remember in HDTV HTB as you have the x will forward the for right.
So we have another option to do that.
So the answers are is correct B is incorrect C is incorrect and the is incorrect as well.
So the correct answer is A.
OK so take a quick break and we'll pick it up again in the next lecture and see the.