F5CABR: F5 Certified Administrator, BIG-IP RecertificationDemo

SSL Offload requires the BIG-IP to terminate the client-facing TLS session, which is the function of a Client SSL profile (a Server SSL profile only governs the optional re-encrypted connection to the pool members). To guarantee that only TLSv1.2 is negotiated with clients, the administrator builds a custom cipher string on the Client SSL profile that includes only cipher suites available under TLSv1.2 (such as the AES-GCM/SHA384 AEAD suites introduced with that protocol version). Because clients attempting to negotiate over TLSv1.0 or TLSv1.1 will not offer any cipher suite that matches this restricted list, the handshake fails for those older protocol versions, effectively forcing all successful negotiations to occur over TLSv1.2. Simply disabling 'No TLSv1' in the Options list (as in the other choices) leaves TLSv1.1 enabled and therefore does not satisfy a strict TLSv1.2-only requirement.