I85PREP
⌘ K
A10 ACOS study materials
A10 ACOS study resources

A10 ACOS practice questions

One question at a time. Build your A10 ACOS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1ACOS Architecture and Initial Access

What does the acronym ACOS stand for in A10 Networks terminology?

  1. Advanced Core Operating System Correct answer.
  2. Advanced Cluster Operating Software
  3. A10 Cloud Orchestration Suite
  4. Application Control Operating System

Explanation

ACOS is the network operating system developed by A10 Networks for its Thunder appliances and vThunder virtual editions. It supplies the control plane, data plane, and management functions used by features such as server load balancing, GSLB, and aFleX.

Question 2ACOS Architecture and Initial Access

Which IPv4 address is preconfigured on a factory-default A10 Thunder appliance for initial management access?

  1. 192.168.1.1/24
  2. 10.0.0.1/24
  3. 192.168.0.1/24 Correct answer.
  4. 172.16.0.1/24

Explanation

Factory-default Thunder appliances ship with 192.168.0.1/24 on the management interface so an administrator can reach the GUI or CLI from a directly connected laptop. This address should be changed before the device is attached to a production network.

Question 3ACOS Architecture and Initial Access

Which username and password pair is the factory default for administrative access to ACOS?

  1. user / admin
  2. admin / a10 Correct answer.
  3. root / a10
  4. admin / password

Explanation

The factory-default administrative account is admin with the password a10. Replacing this password is part of basic hardening immediately after initial access.

Question 4ACOS Architecture and Initial Access

Which serial settings must a terminal emulator use to reach the ACOS console port?

  1. 9600 baud, 8 data bits, no parity, 1 stop bit Correct answer.
  2. 38400 baud, 8 data bits, no parity, 1 stop bit
  3. 57600 baud, 7 data bits, even parity, 1 stop bit
  4. 115200 baud, 8 data bits, no parity, 1 stop bit

Explanation

The ACOS console port uses 9600 baud, 8 data bits, no parity, and 1 stop bit, with no flow control. These settings let the terminal emulator reach the CLI during boot.

Question 5ACOS Architecture and Initial Access

After you run the enable command, which prompt indicates that the CLI is in Privileged EXEC mode?

  1. Thunder(config)#
  2. Thunder# Correct answer.
  3. Thunder>
  4. Thunder(config-if)#

Explanation

User EXEC mode uses the > prompt, while Privileged EXEC mode uses the # prompt. Configuration modes add qualifiers such as (config) or (config-if) inside the prompt.

Question 6ACOS Architecture and Initial Access

Which command moves the CLI from Privileged EXEC mode into Global Configuration mode?

  1. interface terminal
  2. configure terminal Correct answer.
  3. set terminal config
  4. enable configure

Explanation

configure terminal, often abbreviated conf t, enters Global Configuration mode from Privileged EXEC mode. The prompt changes to (config)# after the command succeeds.

Question 7ACOS Architecture and Initial Access

Which command saves the running configuration so that it persists across a reload?

  1. write memory Correct answer.
  2. copy startup-config running-config
  3. show running-config
  4. reload save

Explanation

write memory copies the running configuration into the startup configuration held in non-volatile memory, so the settings survive a reload. The reverse copy from startup to running is used to discard unsaved changes.

Question 8ACOS Architecture and Initial Access

What is a vThunder in A10 Networks deployments?

  1. A virtual appliance running ACOS on a hypervisor Correct answer.
  2. A cloud-based licensing portal for ACOS features
  3. A hardware acceleration card installed in a Thunder appliance
  4. A high-availability pair of physical Thunder devices

Explanation

vThunder is the virtual edition of the ACOS appliance and runs on hypervisors such as VMware ESXi or KVM. It offers the same feature set as hardware Thunder platforms, subject to licensing.

Question 9ACOS Architecture and Initial Access

Which command sequence assigns the address 10.1.1.1/24 to Ethernet interface 1 in ACOS?

  1. interface ethernet 1 followed by setting address 10.1.1.1 with mask 255.255.255.0
  2. interface ethernet 1 then ip address 10.1.1.1 255.255.255.0 Correct answer.
  3. ethernet 1 ip 10.1.1.1 255.255.255.0
  4. ip interface ethernet 1 10.1.1.1 255.255.255.0

Explanation

In ACOS you enter interface context with interface ethernet 1 and then assign the address with ip address 10.1.1.1 255.255.255.0. The subnet mask is written in dotted decimal form rather than CIDR notation.

Question 10ACOS Architecture and Initial Access

Which ACOS command creates a default route through the next hop 192.168.0.254?

  1. ip route 0.0.0.0 /0 192.168.0.254 Correct answer.
  2. route 0.0.0.0 0.0.0.0 192.168.0.254
  3. default-router 192.168.0.254
  4. ip default-gateway 192.168.0.254

Explanation

ACOS uses CIDR notation in static routes, so the default route is entered as ip route 0.0.0.0 /0 192.168.0.254 in Global Configuration mode. The /0 prefix identifies the route as a default.

Question 11ACOS Architecture and Initial Access

At which CLI mode is the hostname command issued?

  1. Interface Configuration mode
  2. Global Configuration mode Correct answer.
  3. User EXEC mode
  4. Privileged EXEC mode

Explanation

The hostname command changes a system-level setting, so it is entered in Global Configuration mode. After it is applied, the CLI prompt reflects the new device name.

Question 12ACOS Architecture and Initial Access

Which command displays the configuration that is currently active in memory?

  1. show startup-config
  2. show config-file
  3. show memory-config
  4. show running-config Correct answer.

Explanation

show running-config displays the configuration currently in effect, including changes that have not yet been saved. show startup-config shows the configuration that will be loaded after the next reload.

Question 13ACOS Architecture and Initial Access

What is the main function of the Flexible Traffic Accelerator (FTA) in ACOS?

  1. Providing the web-based graphical management interface
  2. Storing the startup configuration in non-volatile memory
  3. Synchronizing configuration between chassis members
  4. Hardware-accelerating data-plane packet forwarding Correct answer.

Explanation

The FTA is a hardware subsystem that accelerates packet forwarding so the main CPU is freed for control-plane and feature processing. It works together with ACOS flow distribution to keep traffic moving at high throughput.

Question 14ACOS Architecture and Initial Access

Which statement best describes the separation of the control plane and data plane in ACOS?

  1. Control plane handles management and protocol tasks; data plane forwards traffic Correct answer.
  2. Both planes run only on the FTA hardware
  3. The control plane forwards packets while the data plane manages routing protocols
  4. The data plane stores configuration and the control plane forwards traffic

Explanation

ACOS separates management and protocol processing from packet forwarding. The control plane runs routing, health checks, and CLI or API tasks, while the data plane forwards user traffic, often with FTA assistance.

Question 15ACOS Architecture and Initial Access

Which scripting language is used to write aFleX policies in ACOS?

  1. Python
  2. Lua
  3. Tcl Correct answer.
  4. JavaScript

Explanation

aFleX policies are written in Tcl, which ACOS embeds for traffic manipulation. Scripts can inspect and modify requests and responses at the virtual server.

Question 16ACOS Architecture and Initial Access

In ACOS server load balancing, which object binds a virtual server port to a group of real servers?

  1. Service group Correct answer.
  2. Health monitor
  3. SSL template
  4. Source NAT pool

Explanation

A virtual server port references a service group, which in turn contains the real servers and their ports. Health monitors are then bound to the service group or to individual real servers to verify availability.

Question 17ACOS Architecture and Initial Access

What is the purpose of a health monitor in an ACOS SLB configuration?

  1. To record billing data for each real server
  2. To limit the number of concurrent connections per client
  3. To encrypt traffic between clients and the virtual server
  4. To verify real-server availability before sending traffic Correct answer.

Explanation

A health monitor periodically probes a real server using a method such as TCP, HTTP, or ICMP. If the probe fails, ACOS removes the server from the service group so traffic goes only to healthy members.

Question 18ACOS Architecture and Initial Access

Which command displays the ACOS software version and build information?

  1. show image
  2. show version Correct answer.
  3. show release
  4. show system

Explanation

show version reports the ACOS software release, build, and platform information. Administrators use it to confirm which image is running before an upgrade or when opening a support case.

Question 19ACOS Architecture and Initial Access

What does VRRP-A provide in an ACOS deployment?

  1. High availability through a shared floating IP address Correct answer.
  2. Encryption of administrative sessions
  3. Automatic firmware upgrades for chassis members
  4. Load balancing across global data centers

Explanation

VRRP-A is A10's enhanced VRRP implementation, providing a floating virtual IP address shared by ACOS devices for high availability. If the active device fails, the floating address moves to the standby device.

Question 20ACOS Architecture and Initial Access

Why would an administrator create Application Delivery Partitions (ADPs) on one ACOS device?

  1. To give tenants isolated configurations on shared hardware Correct answer.
  2. To share a single configuration among multiple tenants
  3. To bypass the need for a license
  4. To increase the physical port count of the appliance

Explanation

ADPs let a single ACOS device host multiple independent configuration and management contexts, which is useful for service providers and multi-tenant deployments. Each partition keeps its own objects while sharing the underlying hardware.

Question 21ACOS Architecture and Initial Access

Why does ACOS distribute traffic flows across multiple CPU cores using a hash of each flow?

  1. To ensure every packet is inspected by every core
  2. To encrypt each flow with a different key
  3. To keep each flow on a single core Correct answer.
  4. To reduce the number of physical interfaces required

Explanation

ACOS hashes each flow to a CPU core so all packets belonging to that flow are processed by the same core. This preserves per-flow state and avoids out-of-order processing or state replication between cores.

Question 22ACOS Architecture and Initial Access

In an aVCS cluster, which role owns the management IP address and coordinates configuration across members?

  1. vMaster Correct answer.
  2. vBlade
  3. FTA
  4. VRRP-A master

Explanation

In an aVCS cluster the vMaster holds the management address and acts as the configuration authority, while vBlades serve as member data-plane devices. Administrators manage the whole cluster through the vMaster.

Question 23ACOS Architecture and Initial Access

An administrator cannot reach a new Thunder at 192.168.0.1 because that subnet is already in use. What is the most appropriate way to change the management IP?

  1. Use a browser to the default address and choose a new subnet
  2. Connect to the console and change the address in the CLI Correct answer.
  3. Reset the appliance to factory defaults by power cycling it
  4. Use the cloud portal to reassign the address

Explanation

When the default management address cannot be used, the console port provides out-of-band access to change the IP before the device joins the network. A browser session cannot begin until a reachable address exists, and a power cycle does not change the address.

Question 24ACOS Architecture and Initial Access

After assigning a management IP by console, an administrator on a remote subnet still cannot reach the appliance, although same-subnet access works. What is the most likely cause?

  1. The admin account is locked out
  2. The console baud rate is wrong
  3. The FTA is disabled
  4. No default route is configured Correct answer.

Explanation

Remote management from another subnet requires a default route pointing to the local gateway. Same-subnet access succeeds because no routing is needed, which points to the missing route rather than to credentials or hardware.

Question 25ACOS Architecture and Initial Access

Which statement describes the enable password in ACOS?

  1. It is the factory default password for the admin account
  2. It replaces the need for a login user account
  3. It is the password used by the web UI only
  4. It guards Privileged EXEC mode, separate from login credentials Correct answer.

Explanation

The enable password guards the transition from User EXEC to Privileged EXEC, independently of the login account used at connect time. This allows a shared operational password while individual users keep their own login credentials.

Question 26ACOS Architecture and Initial Access

A technician connects a laptop to the console port of a factory-default Thunder appliance. Which terminal settings allow the CLI to be displayed correctly?

  1. 9600 baud, 7 data bits, no parity, 2 stop bits, XON/XOFF flow control
  2. 38400 baud, 8 data bits, odd parity, 1 stop bit, no flow control
  3. 115200 baud, 8 data bits, even parity, 1 stop bit, hardware flow control
  4. 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control Correct answer.

Explanation

ACOS console access expects a standard serial connection of 9600 baud, 8 data bits, no parity, 1 stop bit and no flow control. Any other combination produces garbled or missing output at the login prompt. These parameters match the factory default and only change if an administrator alters them.

Question 27ACOS Architecture and Initial Access

Which credentials are preconfigured on a factory-default ACOS appliance for the administrative account?

  1. admin / password
  2. root / a10
  3. admin / a10 Correct answer.
  4. user / admin

Explanation

A new appliance ships with the administrative account admin and the password a10. The password should be replaced immediately after the first successful login. No root or user CLI account is enabled by default.

Question 28ACOS Architecture and Initial Access

Which command displays the configuration that is stored in the startup configuration file and is loaded when the device boots?

  1. show interface configuration
  2. show memory-config
  3. show running-config
  4. show startup-config Correct answer.

Explanation

The startup configuration is the saved file that is read during boot, while the running configuration is the active copy held in memory. show startup-config prints the saved version only. Changes made in the current session appear in the running configuration until they are saved.

Question 29ACOS Architecture and Initial Access

Which ACOS interface type is a routed interface that is tied to a VLAN and can be assigned an IP address?

  1. A trunk port that carries multiple tagged VLANs between switches
  2. A physical Ethernet port that carries a single untagged VLAN
  3. A virtual Ethernet (VE) interface tied to a VLAN and assigned an IP address Correct answer.
  4. A loopback interface that is used for management reachability and never forwards user traffic

Explanation

A virtual Ethernet interface is the routed construct in ACOS: it is associated with a VLAN number, carries an IP address, and can terminate traffic or act as a gateway. Physical ports and trunks are Layer 2 constructs that carry VLANs but do not hold routed addresses themselves. Loopback interfaces are not bound to a VLAN.

Question 30ACOS Architecture and Initial Access

Which statement accurately describes the ACOS software platform?

  1. A proprietary real-time operating system that requires a separate management server to provide the CLI
  2. A 64-bit, Linux-based operating system available on purpose-built appliances and as a virtual appliance Correct answer.
  3. A hypervisor layer that hosts third-party virtual machines alongside the load balancing functions it exposes to them
  4. A 32-bit, BSD-based operating system that runs only on dedicated hardware with custom ASICs

Explanation

ACOS is a 64-bit, Linux-based network operating system that is delivered both on A10 hardware appliances and as virtual platforms such as vThunder. Its core functions are implemented in software rather than depending on dedicated ASICs for packet processing. It is not a hypervisor and does not need an external server to offer a CLI.

Question 31ACOS Architecture and Initial Access

Which interface provides a dedicated out-of-band network path for administrative access over SSH and HTTPS?

  1. The console port, used with a serial cable and terminal emulator
  2. A VE interface created on the default VLAN
  3. The first data interface, Ethernet 1, when it is placed in VLAN 1
  4. The dedicated management interface Correct answer.

Explanation

Appliance hardware includes a dedicated management port that is separate from the data interfaces, giving administrators an out-of-band path for SSH and HTTPS. Data ports and VE interfaces carry production traffic and are not the intended management path. The console port is out-of-band but is a serial connection, not a network path.

Question 32ACOS Architecture and Initial Access

Which command configures 10.0.0.5 as the NTP time source in ACOS?

  1. ntp server 10.0.0.5 Correct answer.
  2. clock source 10.0.0.5
  3. snmp-server host 10.0.0.5
  4. time-server 10.0.0.5

Explanation

The global configuration command ntp server <address> defines an external time source for the appliance. Accurate time matters because log timestamps, certificates and scheduled operations depend on the system clock. Multiple servers can be defined for redundancy.

Question 33ACOS Architecture and Initial Access

Which command enables read-only SNMP access using the community string monitor?

  1. snmp community monitor read-only
  2. snmp-server host monitor ro
  3. snmp-server community monitor ro Correct answer.
  4. snmp-server enable traps monitor

Explanation

The snmp-server community command defines a community string and its access level, where ro grants read-only and rw grants read-write. The community string behaves as a shared credential, so it should be treated as sensitive and changed from common defaults. Trap destinations are defined separately with snmp-server host.

Question 34ACOS Architecture and Initial Access

Which command forwards ACOS log messages to a syslog server at 10.0.0.9?

  1. log-server 10.0.0.9
  2. logging host 10.0.0.9 Correct answer.
  3. syslog server 10.0.0.9
  4. logging 10.0.0.9 severity info

Explanation

The logging host command under global configuration sends system log messages to an external syslog server. Severity filtering and facility selection are configured with separate logging keywords. Defining the host does not by itself guarantee that all message levels are forwarded.

Question 35ACOS Architecture and Initial Access

An administrator is in Global Configuration mode on a device that already contains a partition named tenantA. Which command changes the CLI context so that subsequent configuration commands apply to that partition?

  1. partition tenantA activate
  2. active-partition tenantA Correct answer.
  3. switch-partition tenantA
  4. context tenantA

Explanation

The active-partition command moves the CLI context into the named partition so that objects created afterwards belong to it. The partition must already exist before it can be activated. Commands issued before activation belong to the partition that was previously active.

Question 36ACOS Architecture and Initial Access

Why is a console connection normally used to perform the first configuration of a factory-default ACOS appliance?

  1. The console port is the only interface that supports encrypted management traffic.
  2. The appliance cannot obtain a license until the console port has been used.
  3. No management IP address is reachable until one has been assigned. Correct answer.
  4. SSH and HTTPS are permanently disabled whenever the console port is in use.

Explanation

A device that has never been configured has no usable management address, so remote access is impossible until an address is applied. The console port provides local access for that initial addressing step. Once the management interface is addressed, SSH or HTTPS can carry the rest of the build.

Question 37ACOS Architecture and Initial Access

An administrator can ping the management IP address of a Thunder appliance from a workstation, but the page at https://<management-ip> never returns a login prompt. Which cause is most likely?

  1. The workstation has not been added to the appliance's partition.
  2. The administrator's password has expired.
  3. The appliance is missing a default route to the workstation's subnet.
  4. The HTTPS management service has been disabled on the appliance. Correct answer.

Explanation

A successful ping proves the address is reachable and the network path works, so the fault lies in the service layer above IP. If the web service is disabled, the TCP connection to port 443 is refused or times out even though ICMP succeeds. Authentication problems alone would still present the login page.

Question 38ACOS Architecture and Initial Access

Which command creates a new partition named tenantB with partition ID 3?

  1. partition tenantB id 3 Correct answer.
  2. partition id 3 name tenantB
  3. create partition tenantB 3
  4. active-partition tenantB id 3

Explanation

The partition command takes the partition name first, followed by the id keyword and the numeric identifier. After creation, active-partition switches the CLI into that partition for object configuration. Partition IDs must be unique on the device.

Question 39ACOS Architecture and Initial Access

A Thunder is deployed in one-arm mode with real servers in the same subnet as the clients. Which configuration ensures that responses from the real servers return through the appliance?

  1. Assign the virtual server an IP address in a different subnet from the real servers.
  2. Configure the real servers to use the client-side router as their default gateway.
  3. Bind the virtual server port to a single real server so the path stays symmetric.
  4. Enable source NAT on the virtual server so responses return through the ADC. Correct answer.

Explanation

In a one-arm deployment the servers see the client's original address unless the ADC rewrites it, so their replies go straight to the client-side router and bypass the appliance. Source NAT on the virtual server makes the ADC's address the source, forcing return traffic back through it. Pointing the servers at the client-side router preserves the asymmetric path.

Question 40ACOS Architecture and Initial Access

A new Thunder appliance must be brought into service. Which sequence reflects the correct order of initial tasks?

  1. Configure the virtual servers, assign the management IP address, then apply the licenses.
  2. Enable VRRP-A, assign the management IP address from the peer, then connect through the console port.
  3. Create a partition, assign the management IP address, then connect through the console port.
  4. Connect through the console, assign the management IP, then configure over SSH or HTTPS. Correct answer.

Explanation

Initial setup follows the access path that becomes available in stages: console first, then a management address, then remote SSH or HTTPS for the full build. Partitions, licenses, service objects and high availability only make sense once basic reachability exists. This ordering avoids configuring objects that cannot yet be reached or verified.

Question 41Virtual Servers, Service Groups, and Load Balancing

In A10 ACOS, what is the primary role of a virtual server?

  1. It monitors power supplies in the chassis.
  2. It receives client traffic on a VIP and forwards it to a service group. Correct answer.
  3. It stores SSL certificates for the management interface.
  4. It assigns IP addresses to back-end servers.

Explanation

A virtual server binds a virtual IP address and port, accepts client connections, and selects a service group to handle the traffic. It is the client-facing object in ACOS load balancing. Address assignment, certificate storage, and hardware monitoring are handled by other functions.

Question 42Virtual Servers, Service Groups, and Load Balancing

What does a service group in ACOS primarily contain?

  1. Virtual IP addresses used by clients.
  2. Routing entries for static networks.
  3. Real servers and their service ports. Correct answer.
  4. User accounts for administrative access.

Explanation

A service group is a collection of real servers, each with an address and service port, that can receive traffic from a virtual server. It defines the back-end pool and the health-check relationship. Virtual IPs belong to virtual servers, while routes and user accounts are separate objects.

Question 43Virtual Servers, Service Groups, and Load Balancing

Which load-balancing method sends each new request to the next member in a fixed sequence?

  1. Weighted least connections
  2. Source IP hash
  3. Least connections
  4. Round robin Correct answer.

Explanation

Round robin distributes new connections to service group members in a repeating order. It does not consider current connection counts or client addresses. Least connections and weighted least connections use active connection counts, while source IP hash uses the client address.

Question 44Virtual Servers, Service Groups, and Load Balancing

What is the purpose of a health monitor attached to a service group?

  1. To encrypt traffic between the ADC and clients.
  2. To log every HTTP request header.
  3. To cache static content for faster delivery.
  4. To test member availability and mark it up or down. Correct answer.

Explanation

A health monitor periodically probes service group members and updates their operational state based on the results. Members that fail the monitor are removed from selection until they recover. Encryption, caching, and header logging are separate features.

Question 45Virtual Servers, Service Groups, and Load Balancing

By default, which port does an HTTP virtual server use when only HTTP is specified?

  1. 80 Correct answer.
  2. 443
  3. 8080
  4. 22

Explanation

HTTP uses TCP port 80 by convention, and an HTTP virtual server is normally configured to listen on that port. Port 443 is associated with HTTPS, while 8080 is an alternate HTTP port and 22 is used by SSH.

Question 46Virtual Servers, Service Groups, and Load Balancing

What is a VIP in ACOS?

  1. A backup copy of the running configuration.
  2. A physical port on the ADC appliance.
  3. The virtual IP address clients connect to for a virtual server. Correct answer.
  4. A VLAN interface used for management.

Explanation

A VIP is the virtual IP address configured on a virtual server, and clients direct their connections to that address. The ADC then forwards the traffic to a selected service group member. A VLAN interface, physical port, and configuration backup are different object types.

Question 47Virtual Servers, Service Groups, and Load Balancing

Which persistence method keeps a client on the same member based on the client's IP address?

  1. SSL session ID persistence
  2. Source IP persistence Correct answer.
  3. Round robin
  4. Cookie persistence

Explanation

Source IP persistence uses the client's source address to select a service group member and keeps subsequent connections from that address on the same member. Cookie persistence relies on an HTTP cookie, and SSL session ID persistence uses the TLS session identifier. Round robin is a load-balancing method, not a persistence method.

Question 48Virtual Servers, Service Groups, and Load Balancing

What is the role of a backup server in an ACOS service group?

  1. It handles all traffic while primary members are healthy.
  2. It replaces the service group when a monitor fails.
  3. It receives traffic when all primary members are unavailable. Correct answer.
  4. It stores configuration backups for the ADC.

Explanation

A backup server is held in reserve and is selected only when the primary service group members are unavailable. It does not receive normal traffic while healthy primaries exist. It is a traffic-handling member, not a configuration backup mechanism.

Question 49Virtual Servers, Service Groups, and Load Balancing

A virtual server uses least-connections load balancing. Which service group member receives the next new connection?

  1. The member with the fewest active connections. Correct answer.
  2. The member with the lowest IP address.
  3. The member with the highest configured weight.
  4. The member that has been up the longest.

Explanation

Least connections selects the available member with the smallest number of active connections at that moment. It is intended to balance load based on current session counts. Configured weight matters in weighted methods, and neither IP address nor uptime is used by plain least connections.

Question 50Virtual Servers, Service Groups, and Load Balancing

What is the main effect of source IP hash load balancing?

  1. It sends all requests to the member with the most available CPU.
  2. It encrypts the source IP before forwarding.
  3. It distributes requests in strict rotation regardless of client.
  4. It maps the same client IP consistently to the same member. Correct answer.

Explanation

Source IP hash calculates a hash from the client IP address and uses it to choose a member, so the same client address tends to reach the same member. This can provide a form of session affinity without a cookie. It does not measure CPU, encrypt addresses, or rotate requests sequentially.