VMware Certified Professional - VMware Avi Load Balancer Administrator Advanced Practice Exam: Hard Questions 2025

You are designing an Avi Load Balancer deployment for a large enterprise with strict separation between management and data planes. The security team requires that Service Engines (SEs) have no inbound management access from user networks, while operators must still be able to manage the system centrally. Which architecture best satisfies this requirement while maintaining full feature support? Assume multi-tenant is used and some tenants will be on isolated VRFs/segments.

A multi-site deployment uses GSLB for two data centers (DC1 and DC2). The application is active/active, but the database is local to each site. Requirements: - If DC1 becomes unreachable from the Internet, users should be steered to DC2. - If DC1 is reachable but the DC1 app pool is unhealthy, users should be steered to DC2. - If the app is healthy in both sites, prefer the site with lower latency. Which GSLB design most accurately meets these requirements with minimal false positives?

You are deploying Avi in VMware vSphere with a requirement that new Service Engines be automatically placed across clusters while preventing placement in a specific DR cluster that shares the same vCenter. The operations team wants to avoid manual SE placement and ensure capacity-based scaling still works. Which configuration best achieves this outcome?

After enabling VLAN-backed VIP networks, a newly created virtual service remains DOWN with the error indicating 'VIP unreachable' while pool members are UP. The VIP is on a tagged VLAN (VLAN 200). The SEs have a data interface connected to a trunk port group that carries VLANs 100-300. The upstream gateway for VLAN 200 is reachable from other VMs on that VLAN. What is the MOST likely misconfiguration in Avi causing the VIP to be unreachable?

You are migrating from an external hardware load balancer to Avi. The application uses long-lived WebSocket connections and requires client IP persistence. The backend servers must see the real client IP and the application team refuses to accept X-Forwarded-For headers. SNAT cannot be used because it breaks geo-based logic on the servers. Which Avi configuration best meets these requirements while maintaining stability for long-lived connections?

An HTTP application has these requirements: - /api requests must go to Pool A - /admin requests must go to Pool B - All other paths must go to Pool C - Requests to /admin must be blocked unless the client is in a specific IP allowlist Which Avi construct combination is the MOST appropriate and maintainable?

A pool has 20 servers. During a partial outage, 8 servers intermittently fail health checks due to slow responses. Users report sporadic failures and high latency, but the pool never fully goes down. You need to minimize user impact while avoiding complete removal of servers that are just temporarily slow. Which approach best balances availability and user experience?

A security audit requires that: - Only modern cipher suites are allowed. - TLS must be terminated at Avi. - Client certificates must be validated for a subset of URLs (/partners/*) only. - Other URLs must not require a client certificate. How should this be implemented in Avi with the least operational overhead?

An application team complains that after you rotated an intermediate CA in the certificate chain, some clients began failing TLS handshakes intermittently while others succeed. The server certificate and private key are correct, and the new intermediate is valid. No changes were made on clients. Which Avi-side issue is the MOST likely cause, and what is the best fix?

A production virtual service periodically experiences brief traffic drops during peak load, but pool health remains UP and CPU on SEs is moderate. Logs show frequent SE->Controller reconnects and configuration resyncs. The network team confirms no packet loss on the VIP subnet. You suspect control-plane instability affecting the data plane. Which troubleshooting action is MOST likely to isolate the root cause efficiently?