F5CAB3 BIG-IP Administration Data Plane Configuration (F5CAB3) exam Questions and Answers

Application-specific health checks must validate application responses, which requires HTTP monitors with custom send/receive strings.

When clients connect through a single source IP (NAT) — such as a corporate proxy or carrier-grade NAT — Source Address Affinity persistence becomes entirely ineffective because all clients share an identical source IP address. This would force every client session to the same pool member, completely eliminating even distribution and defeating the purpose of load balancing.

Cookie Persistence is the optimal solution in this scenario because it operates at Layer 7 , inserting a unique cookie into each client ' s HTTP/HTTPS response. Each individual browser session carries its own distinct cookie value, allowing the BIG-IP to identify and persist individual clients to specific pool members — regardless of whether they share a common source IP address. This guarantees both session persistence and even load distribution across pool members.

The remaining options are unsuitable because:

Destination Address Affinity persists based on destination IP, irrelevant for client-to-server session stickiness.

SSL Persistence uses the SSL Session ID for persistence, but SSL session IDs are frequently renegotiated and are unreliable for long-term persistence across modern TLS implementations.

Source Address Affinity fails entirely under NAT conditions as described.

Cookie persistence is the industry-standard method for HTTPS application load balancing requiring per-client session affinity.

SSH (Secure Shell) operates over TCP port 22 , making the TCP health monitor the appropriate and correct choice for monitoring pool members in an SSH pool. The TCP monitor establishes a basic Layer 4 connection to each pool member on the designated port, verifying that the server is reachable and actively accepting TCP connections. A successful three-way handshake confirms the pool member is available; a failure marks it down and removes it from load balancing rotation.

The remaining monitor types are inappropriate for this use case:

UDP monitor operates at Layer 4 but uses the connectionless UDP protocol, which is incompatible with SSH since SSH exclusively uses TCP as its transport.

HTTP monitor sends a Layer 7 GET request expecting an HTTP response — irrelevant for an SSH service that does not speak the HTTP protocol.

HTTPS monitor functions identically to HTTP but over TLS — again, completely misaligned with SSH traffic and port behaviour.

For application-specific SSH validation beyond basic TCP connectivity, an external monitor or custom monitor could be used; however, TCP remains the standard and correct built-in monitor for SSH pool verification within the BIG-IP platform.

To fulfill the requirement of " SSL Offload " limited to " TLSv1.2 only, " the administrator must focus on the client-side of the connection. SSL Offload means the BIG-IP terminates the encrypted connection from the user, processes the traffic (often as plain text internally), and optionally sends it to the backend. The profile responsible for this termination and the initial negotiation with the client ' s browser is the Client SSL Profile.

A custom Client SSL Profile must be created because the default clientssl profile typically allows a broad range of protocols for compatibility (including TLS 1.0, 1.1, and 1.2). To restrict communication specifically to TLS 1.2, the administrator modifies the Ciphers string within the profile. Using a string such as DEFAULT:!SSLv3:!TLSv1:!TLSv1.1 or specifically defining TLSv1.2-only suites ensures that the BIG-IP will reject any handshake attempts from older, less secure protocols.

Server SSL Profiles (Options B and C) are used for the encryption between the BIG-IP and the backend nodes, which is not what is requested here. Simply selecting " no TLSv1 " in an options list (Option D) is insufficient and often refers to older versions of the software; the modern and standard way to control protocol negotiation on a BIG-IP is through the precise application of Cipher Strings within the Client SSL profile. This ensures compliance with security standards like PCI-DSS while providing the offloading benefits to the backend infrastructure.

When dealing with heterogeneous server hardware where some servers are more powerful than others, a dynamic load balancing method that accounts for both current load and server capacity is required. The Weighted Least Connections (member) method is the most appropriate choice. This method works by tracking the number of active connections to each pool member and then " weighting " that number based on a user-defined Ratio value assigned to the member. For example, the administrator can assign a higher Ratio to the three newer, more powerful servers and a lower Ratio to the two older servers. The BIG-IP then uses a formula to calculate which server should receive the next connection, ensuring that the newer servers handle a proportionately larger share of the total concurrent connections.

Standard Round Robin (Option C) would be ineffective because it distributes connections strictly sequentially (1, 2, 3, 4, 5) without regard for the servers ' capacity or current load, which would eventually overwhelm the older servers. Least Connections (member) (Option D) is better than Round Robin because it picks the server with the fewest active connections, but it still assumes all servers are equal; it would try to keep the connection counts identical across all 5 servers, which would still stress the older hardware more than the new. Global Availability (Option B) is a GSLB (DNS-based) method used for multi-site redundancy, not for local pool member load balancing. By using Weighted Least Connections, the administrator achieves a balance where the more capable servers take the brunt of the work while the older servers are utilized only to their specific safe capacity.

The Local Traffic > Network Map provides a single consolidated view within the BIG-IP Configuration Utility that displays the full relationship hierarchy of all application delivery objects simultaneously. This includes Virtual Servers, their associated Pools, individual Pool Members, applied iRules, profiles, and the health status of each object — all rendered in a single topological screen.

This view is specifically designed for administrators and users who need rapid situational awareness across the data plane without navigating multiple menu screens. Each object is colour-coded to reflect its current availability state (green = available, red = unavailable, yellow = degraded).

The alternative options do not satisfy all requirements:

Local Traffic > Monitors only displays health monitor configurations, not virtual server or pool member relationships.

Statistics provides performance counters and throughput data, not object relationship mapping.

Local Traffic > Virtual Servers lists virtual server configurations individually but does not provide a unified topology view inclusive of pool members and iRules in a single screen.

The Network Map is the authoritative single-pane-of-glass tool for application object visibility on BIG-IP.

When multiple hostnames resolve to the same IP address and encrypted communication is required, the BIG-IP must be able to present the correct SSL certificate based on the hostname requested by the client. This is accomplished using Server Name Indication (SNI).

According to BIG-IP Administration: Data Plane Configuration documentation:

SNI is a client-side TLS extension, where the client includes the requested hostname during the SSL handshake.

BIG-IP evaluates this hostname using the Client SSL profile, not the Server SSL profile.

The “Server Name” setting in the Client SSL profile enables BIG-IP to select the appropriate SSL certificate for the requested hostname.

Why option C is correct:

Client SSL profile handles inbound (client-side) encryption.

Server Name enables SNI-based certificate selection when multiple DNS names share the same virtual server IP.

Why the other options are incorrect:

A. Client SSL, Client NameThere is no Client SSL setting called Client Name for SNI certificate selection.

B. Server SSL, Server NameServer SSL is used for encryption between BIG-IP and backend servers, not for client-side hostname identification.

D. Server SSL, Client NameServer SSL does not process client-requested hostnames during TLS negotiation.

Correct Resolution:

Configure a Client SSL profile and enable the Server Name (SNI) setting to support multiple encrypted hostnames on the same virtual server IP.

In the F5 BIG-IP ecosystem, a standard ICMP health monitor functions by sending an ICMP echo request to a target node and expecting an ICMP echo reply within a specified timeout period. When a node is marked " DOWN " despite the backend server being configured to respond to ICMP, the issue typically lies in the network path or the specific packet exchange between the BIG-IP ' s self IP and the node ' s IP. Running a tcpdump is the most effective next step because it provides a real-time packet capture of the actual monitor traffic leaving the BIG-IP and any return traffic coming back from the server. This allows the administrator to verify if the BIG-IP is actually sending the echo request, if the request is reaching the server, and if the server is indeed replying or if the reply is being dropped by an intermediate firewall or a security policy.

While other tools have their place, they are inappropriate for this specific layer 3/4 connectivity issue. A qkview is a comprehensive diagnostic file used primarily for F5 Support to analyze the entire system ' s state but is overkill for initial connectivity troubleshooting. An ssldump is used for inspecting SSL/TLS handshakes and encrypted payloads, which is irrelevant for a non-encrypted ICMP monitor. A curl command is a tool for testing HTTP/HTTPS application-level responses; it cannot be used to troubleshoot ICMP (ping) connectivity directly. By using tcpdump -ni < vlan_name > host < node_ip > , the administrator can see the ICMP " type 8 " (request) and " type 0 " (reply) packets, immediately identifying if the monitor failure is due to a " Destination Unreachable " message or a simple lack of response, thereby pinpointing the root cause in the data plane.

The log message “Intercept exhaustion” indicates that the BIG-IP system has exhausted the available source port translations for one or more SNAT addresses. This occurs when too many concurrent client connections are being translated through a limited number of SNAT IP addresses, and all ephemeral source ports (typically ~64,000 per SNAT IP) are in use.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Each SNAT IP address provides a finite number of available source ports.

When the number of concurrent connections exceeds the available port space, the BIG-IP logs an Intercept exhaustion error and new connections fail.

The recommended resolution is to increase the available SNAT resources by adding additional IP addresses to the SNAT pool.

Why the other options are incorrect:

A. Increase the timeout of the SNAT addressesIncreasing timeouts may actually worsen the problem by keeping ports allocated longer, accelerating port exhaustion.

B. Remove the SNAT pool and apply SNAT AutomapSNAT Automap uses the Self IP addresses on the egress VLAN, which may not provide additional capacity and can introduce routing or design issues. This is not a direct or recommended fix for SNAT exhaustion.

C. Remove an IP address from the SNAT poolThis would reduce the number of available source ports and further exacerbate the intercept exhaustion condition.

Correct Resolution:

By adding an IP address to the SNAT pool, the BIG-IP increases the total number of available source ports, alleviating intercept exhaustion and restoring successful client connections.

When a failover occurs in a standard BIG-IP High Availability (HA) pair, the newly active device takes over the floating IP addresses (Virtual Servers, Self IPs). By default, the new active device sends Gratuitous ARP (GARP) messages to the local network switch to inform it that these IP addresses are now associated with its own physical MAC addresses. However, network switches and intermediate routers often have ARP aging timers or security features that may delay the updating of their ARP tables, leading to " black-holed " traffic or dropped packets for several seconds or minutes until the network infrastructure correctly relearns the new path.

To eliminate this delay and ensure a seamless transition, a BIG-IP Administrator should Configure MAC Masquerade. MAC Masquerade allows the administrator to assign a unique, " virtual " MAC address to a specific traffic group. Instead of using the hardware-burned MAC address of the individual appliance, the active device uses this shared virtual MAC address for all communication involving floating IPs. When a failover occurs, the standby device assumes control of the traffic group and begins using the exact same virtual MAC address. Because the MAC address associated with the VIPs never changes from the switch ' s perspective, there is no need for the switch to update its MAC address table or for the surrounding infrastructure to update its ARP caches. This effectively eliminates the " stabilization period " reported by users, as the data plane transition happens almost instantaneously at Layer 2, maintaining continuous traffic flow without being hindered by external network re-convergence times.

This question addresses the critical architectural distinction between " member-based " and " node-based " load balancing in environments where servers are multi-homed or host multiple virtualized services. On a BIG-IP, a node represents the underlying IP address of a physical or virtual server, while a pool member represents a specific combination of that IP and a service port (e.g., 10.1.1.10:80).

When multiple pools reference the same IP address across different ports or Virtual Servers, using Least Connections (member) (Option D) only balances connections relative to that specific pool. For example, if Pool_A and Pool_B both use Server_X, and Pool_A has 100 connections while Pool_B has only 5, a member-based algorithm for Pool_B only sees the 5 connections and may continue to send traffic there even if Server_X is CPU-saturated by Pool_A.

The Least Connections (node) algorithm (Option B) solves this by tracking the aggregate total of all active connections directed to that specific node (IP address) across every pool on the system. By selecting the node with the absolute lowest total connection count, the BIG-IP ensures a more equitable distribution of work at the hardware resource level. Predictive methods (Options A and C) use a ranking system based on the trend of connection counts over time, but for the specific requirement of maintaining an equal number of current connections on multi-service servers, the direct Least Connections (node) calculation is the standard and most effective procedural choice.

This scenario describes a classic case of asymmetric routing in a " one-arm " or non-gateway deployment. When a BIG-IP system is configured for SSL offloading, the following traffic flow occurs:

Client-Side: The client establishes a successful SSL/TLS handshake with the Virtual Server. This explains why the user can " successfully establish an SSL connection. "

Server-Side: The BIG-IP decrypts the traffic and forwards it as plain HTTP to the backend server. The packet trace confirms the server receives the HTTP GET request and responds with the content.

The Routing Failure: By default, the BIG-IP system preserves the client ' s original source IP address. If the backend server ' s default gateway is not the BIG-IP system (or if the server is on the same subnet as the client), the server will attempt to send the response directly back to the client ' s IP address, bypassing the BIG-IP.

Stateful Drop: Because the BIG-IP is a Full Proxy, it expects the response to return through its own internal state table to be encrypted and sent back to the client. Since the response bypasses the BIG-IP, the BIG-IP connection eventually times out, and the client receives no data despite the server having sent it.

Solution (SNAT): Enabling Secure Network Address Translation (SNAT), specifically SNAT Auto Map, ensures that the BIG-IP replaces the client ' s source IP with its own internal self-IP before sending the request to the server. This forces the server to send the response back to the BIG-IP, allowing the BIG-IP to complete the transaction and deliver the content to the user.

This question tests precise knowledge of both TMSH command syntax and BIG-IP object namespace hierarchy . Two critical distinctions must be correctly identified:

1. create vs. modify: Since the Trunk already exists and the administrator is adding interfaces to it, the correct verb is modify — not create . Using create on an existing object would either throw an error or attempt to overwrite the object entirely, neither of which is the desired outcome.

2. /sys vs. /net namespace: Trunk objects in BIG-IP reside within the /net namespace, which encompasses network-layer constructs including Trunks, VLANs, Self IPs, and Routes. The /sys namespace is reserved for system-level objects such as management settings, software, and licensing — it does not contain Trunk objects.

Therefore, the only syntactically and functionally correct command is:

tmsh modify /net trunk trunk_A interfaces add {1.3 1.4}

This command appends interfaces 1.3 and 1.4 to the existing trunk_A object without disrupting currently assigned interfaces, increasing aggregated bandwidth accordingly.

Options A and C use the incorrect /sys namespace, and options A and B incorrectly use the create verb for an existing object.

A red diamond indicates the Virtual Server is enabled but unavailable due to all pool members being down.

Fallback persistence is used when the primary persistence method fails. Source Address Affinity is a Layer 4 persistence method and is fully supported as a fallback option for most virtual server types.

When multiple users share one source IP, source-address persistence fails. Cookie persistence uniquely identifies users at Layer 7 and ensures correct session handling.

An F5 iApp is a template-driven system used to deploy complex applications by grouping all necessary BIG-IP objects (Virtual Servers, Pools, Profiles) into a single management entity. Objects created by an iApp are distinguished by their naming convention and metadata. In the provided exhibit, the Virtual Server configuration in Option A is clearly identified as an iApp-managed object through two primary indicators. First, the object resides within a sub-directory or partition ending in .app (/Common/vmware_test.app/). Second, the configuration explicitly includes the attribute app-service /Common/vmware_test.app/vmware_test, which serves as the system ' s internal pointer linking the LTM object back to the parent iApp Application Service. Furthermore, several profiles associated with this virtual server also reside within the same .app container, such as /Common/vmware_test.app/vmware_test_http.

In contrast, Options B, C, and D represent standard, manually created Virtual Servers. While they may have complex configurations (such as the APM profiles in app2_vs and app1_vs), they lack the folder-based naming hierarchy and the app-service metadata attribute that denotes iApp ownership. Standard objects like app1_vs are managed individually, whereas the objects within vmware_test.app are typically protected by " Strict Updates. " This means their configuration is controlled by the iApp ' s template logic; any manual attempt to modify these specific parameters directly via the Virtual Server menu would result in an error message stating the service must be updated via the application management interface. Identifying these objects is a critical procedural step for administrators to determine whether a configuration should be edited through the standard LTM menus or through the iApp ' s " Reconfigure " tab to ensure consistency and prevent manual changes from being overwritten by the template.

In F5 BIG-IP systems, an iApp is a template-driven framework used to deploy and manage application-specific configurations. When an iApp is deployed, the system creates a specialized folder or " Application Service " container to hold all the resulting Local Traffic Manager (LTM) objects, such as virtual servers, pools, and profiles. This container is visually and programmatically identified by the .app extension in its path name.

The naming convention for these objects follows a specific hierarchical structure: / < partition > / < iapp_name > .app/ < object_name > . For example, if an administrator creates an iApp named " testhttp " in the " /Common " partition, the virtual server created by that iApp would be identified in the configuration (TMSH) and the GUI as /Common/testhttp.app/testhttp. This structure allows the BIG-IP system to distinguish between manually created objects and those managed by the iApp ' s automation logic.

This identification is crucial because iApp-managed objects typically have Strict Updates enabled, which prevents administrators from making direct manual changes to the object settings outside of the iApp ' s reconfigure interface. Attempting to modify such an object directly will result in an error message stating that the application service must be updated using an application management interface. By recognizing the .app path and the repeated name within the structure, an administrator can immediately identify that the object belongs to an iApp and should be managed through the iApp ' s specific management screen rather than standard LTM configuration menus.

The X-Forwarded-For header preserves the original client IP when SNAT is enabled.

By default, BIG-IP load balancing algorithms (such as Round Robin) distribute connections evenly across all available pool members. However, persistence profiles override normal load balancing decisions by forcing subsequent connections from a client to be sent to the same pool member.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Persistence creates a client-to-server mapping that is honored before load balancing algorithms are applied.

When persistence is enabled, BIG-IP may repeatedly select the same pool member even if others are available.

This directly alters load balancing behavior.

Why the other options are incorrect:

A. Adding a OneConnect profileOneConnect optimizes server-side TCP connections but does not change which pool member is selected.

B. Enabling SNAT automapSNAT affects source address translation, not pool member selection.

C. Enabling a fallback host in the HTTP profileA fallback host is only used when no pool members are available.

Correct Resolution:

Adding a persistence profile alters load balancing behavior by maintaining client affinity to a specific pool member.

When the connection limit is reached, BIG-IP resets new connections, even if pool members are healthy.