F5CAB3 BIG-IP Administration Data Plane Configuration (F5CAB3) exam Questions and Answers

Standard BIG-IP administration dictates that hardware-level physical attributes are managed within the Network section of the configuration. When a network switch and a BIG-IP fail to successfully negotiate speed and duplex settings (Auto-Negotiation), it can result in CRC errors, late collisions, or a total lack of link. To resolve this manually, the administrator must navigate to the Configuration Utility (GUI) and go to Network > Interfaces.

Within the Interfaces list, the administrator can select the specific physical port (e.g., 1.1 or 1.2) and modify its properties. By default, the media speed is set to " Auto, " but the drop-down menu allows for manual selection of specific speeds (e.g., 100Mb/s, 1Gb/s, 10Gb/s) and duplex settings (Full or Half). While these changes can also be made via the TMOS Shell (TMSH) (Option B) using the modify net interface command, the question asks for the standard location, which in most administrative contexts refers to the primary GUI path. System > Configuration (Option D) is used for global device settings like NTP, DNS, and licensing, not for interface-specific physical layer parameters. The Front Console (Option A), referring to the LCD panel on physical appliances, is primarily used for initial management IP setup and viewing system alerts, but does not provide the granular interface configuration required for media speed adjustments.

When clients connect through a single source IP (NAT) — such as a corporate proxy or carrier-grade NAT — Source Address Affinity persistence becomes entirely ineffective because all clients share an identical source IP address. This would force every client session to the same pool member, completely eliminating even distribution and defeating the purpose of load balancing.

Cookie Persistence is the optimal solution in this scenario because it operates at Layer 7 , inserting a unique cookie into each client ' s HTTP/HTTPS response. Each individual browser session carries its own distinct cookie value, allowing the BIG-IP to identify and persist individual clients to specific pool members — regardless of whether they share a common source IP address. This guarantees both session persistence and even load distribution across pool members.

The remaining options are unsuitable because:

Destination Address Affinity persists based on destination IP, irrelevant for client-to-server session stickiness.

SSL Persistence uses the SSL Session ID for persistence, but SSL session IDs are frequently renegotiated and are unreliable for long-term persistence across modern TLS implementations.

Source Address Affinity fails entirely under NAT conditions as described.

Cookie persistence is the industry-standard method for HTTPS application load balancing requiring per-client session affinity.

The virtual server is intended to process SSH traffic on TCP port 22 , but the exhibit shows that the standard http HTTP profile is assigned. This is the configuration error. An HTTP profile enables BIG-IP Layer 7 HTTP processing and is appropriate only when the virtual server is expected to process HTTP protocol traffic. F5 documentation defines its purpose directly: “An HTTP profile defines the way that you want the BIG-IP system to manage HTTP traffic.”

SSH is not HTTP. It is an independent application protocol transported over TCP , conventionally using port 22 . Therefore, an ordinary SSH load-balancing virtual server should retain the TCP protocol/profile while having HTTP Profile set to None . F5 ' s SSH virtual-server configuration guidance specifically uses service port 22 for SSH and does not require an HTTP profile.

Options B, C, and D do not address the fault. The destination address 10.1.1.2 correctly identifies the virtual server, while source 0.0.0.0/0 appropriately permits clients from any source. Changing the protocol to UDP would be incorrect because SSH requires TCP.

Reference Topics: Virtual Server configuration; HTTP profiles; TCP profiles; application-protocol profile assignment; SSH traffic handling.

In F5 BIG-IP architecture, a Trunk is a logical aggregation of physical interfaces designed to increase bandwidth and provide link redundancy through 802.3ad Link Aggregation Control Protocol (LACP). When creating a Trunk object within the BIG-IP configuration, the administrator must assign physical Interfaces to it — these are the underlying hardware ports (e.g., 1.1, 1.2, 1.3) that will be bundled together to form the aggregated logical link.

It is critical to understand the layered object hierarchy on the BIG-IP platform:

Interfaces → assigned to Trunks

Trunks (or individual Interfaces) → assigned to VLANs (as tagged or untagged members)

VLANs → assigned Self IP addresses

Self IPs / Routes → configured at the network layer above

VLANs are not added to a Trunk; rather, a Trunk is added as a member of a VLAN. IP addresses and network routes are configured independently at a higher abstraction layer and have no direct association with Trunk creation.

This layered design ensures proper separation of concerns across the data plane. Misunderstanding this hierarchy is a common configuration error that can result in traffic forwarding failures.

The issue of " lost shopping carts " in an ecommerce environment is a classic symptom of a missing or improperly configured Persistence Profile. In modern web applications, session data—such as items added to a cart—is often stored locally on the specific web server that initially handled the user ' s request. If the BIG-IP system load balances a user ' s subsequent request (like clicking " Checkout " ) to a different server among the 50 webservers, the new server will not have the session data, and the user will appear to have an empty cart.

While Least Connections (node) is an efficient load balancing algorithm, it makes a new decision for every connection unless persistence is enabled. To resolve this, the administrator must implement a persistence mechanism. HTTP Cookie Persistence (Option A) is the industry standard for web applications. By assigning a cookie persistence profile to the Virtual Server, the BIG-IP inserts a unique cookie into the HTTP response. When the user ' s browser returns that cookie in future requests, the BIG-IP identifies the specific server that handled the first request and c onsistently directs the user back to that same server for the duration of their session.

Sip_info (Option B) is a persistence method for VOIP traffic and is not applicable to web traffic. Ratio load balancing (Options C and D) merely changes the distribution frequency but still does not guarantee that a specific user will stay on the same server across multiple requests. Therefore, adding a cookie persistence profile is the direct procedural fix to maintain session state and ensure ecommerce functionality.

WAN TCP profiles are optimized for high latency and packet loss typical of Internet clients, while LAN profiles are ideal for backend servers.

The BIG-IP Configuration Utility (GUI) organizes information hierarchically to allow for granular management of application objects. A Pool is a collection of backend servers (pool members) that provide the same service. To verify the specific network parameters—such as the IP address and the service port—of the servers within a pool, the administrator must navigate to the specific pool ' s configuration.

The standard procedural path to verify this is Local Traffic > Pools: Pool List, where the administrator selects the specific pool name. Once inside the pool ' s configuration, the Members tab displays a list of all IP addresses and service ports associated with that pool. Under the " Service Port " column, the administrator can confirm if the member is listening on port 80 (HTTP).

Options A and B are incorrect for this specific verification task. While Nodes (Option A) show the health of a physical server, a node represents only an IP address and does not have a " Service Port " associated with it until it is defined as a pool member. Verifying the Health Monitor (Option B) would tell the administrator how the system is checking the member ' s status, but it does not definitively show the port on which the member is actually receiving application traffic. In a BIG-IP environment, a pool member is uniquely identified by the combination of its Node IP and its Service Port, and the Members tab is the primary interface for managing and auditing these specific member attributes.

SSH is a TCP-based service. A TCP monitor validates service availability without requiring application-layer inspection.

SSH is a TCP Layer 4 protocol. Applying an HTTP profile causes BIG-IP to expect HTTP headers, breaking SSH sessions. Removing the HTTP profile allows raw TCP forwarding.

BIG-IP provides several built-in TCP profiles optimized for different traffic patterns and network conditions. When attempting to improve general TCP performance, the recommended starting point is f5-tcp-progressive.

According to the BIG-IP Administration: Data Plane Configuration documentation:

f5-tcp-progressive is designed as a balanced, general-purpose TCP optimization profile.

It dynamically adjusts TCP behavior to improve throughput and latency for most enterprise applications.

It is the recommended first-choice profile when tuning TCP performance before moving to more specialized profiles.

Why the other options are incorrect:

A. f5-tcp-legacyThis profile exists for backward compatibility and does not include modern TCP optimizations.

C. f5-tcp-mobileThis profile is optimized specifically for high-latency, lossy mobile networks and is not suitable for general-purpose environments.

D. No optionBIG-IP explicitly provides built-in TCP profiles for performance tuning; using none would forgo optimization opportunities.

Correct Resolution:

The administrator should first apply f5-tcp-progressive to evaluate potential TCP performance improvements before considering more specialized profiles.

The log message " aggressive mode activated " indicates that the BIG-IP ' s adaptive connection management system (the " Sweeper " ) has detected that the system ' s memory or connection limits are reaching a critical threshold. To protect the system from crashing due to memory exhaustion (OOM), the BIG-IP enters Aggressive Mode, where it begins to proactively and rapidly reap (close) idle connections to free up resources for new incoming traffic.

To mitigate this and return the system to a healthy state, the administrator needs to reduce the overall resource footprint of existing connections. Decreasing the TCP profile Idle Timeout value (Option B) is the most effective administrative action. In many environments, the default idle timeout is 300 seconds (5 minutes). If a large number of connections remain " open " in the BIG-IP connection table long after the clients have stopped sending data, they consume valuable TMM (Traffic Management Microkernel) memory. By lowering the timeout (e.g., to 60 or 120 seconds), the BIG-IP can expire and remove these inactive entries much sooner, preventing the connection table from bloating and triggering the Sweeper ' s aggressive mode.

Conversely, increasing the timeout (Option C) would exacerbate the problem by keeping " dead " connections in memory even longer. Connection Mirroring (Option D) actually increases memory usage because every connection must be duplicated on the standby peer. An active-active configuration (Option A) might spread the load but does not address the underlying resource management issue on the individual units. Therefore, tightening the idle timers is the standard procedural fix for memory pressure caused by high connection volumes.

Comprehensive and Detailed Explanation From BIG-IP Administration Data Plane Configuration/Course Guide/topics:

The monitor is explicitly sending an HTTP/1.1 request. For HTTP/1.1, the request must contain a valid Host header identifying the intended virtual host. The configured monitor sends the URI and Connection: Close header but omits Host: www.f5.com. A web server using name-based virtual hosting can therefore reject the request with HTTP 400 Bad Request , which explains why every pool member is marked down.

F5 ' s official BIG-IP monitor documentation gives the HTTP/1.1 convention in the form " GET / HTTP/1.1\r\nHost: server.com\r\nConnection: close\r\n\r\n " .

Option A follows that required structure: the request line identifies HTTP/1.1, Host: www.f5.com selects the correct hosted site, Connection: Close requests connection termination after the response, and the final \r\n\r\n properly terminates the HTTP header section. F5 also specifies that when HTTP/1.0 or HTTP/1.1 is used, the monitor evaluates the HTTP status code; a non-200 response such as 400 causes the monitored resource to be considered unavailable.

Reference Topics: BIG-IP LTM Monitors Reference → HTTP Monitor Send String , HTTP/1.1 request formatting , pool-member health monitoring .

When dealing with heterogeneous server hardware where some servers are more powerful than others, a dynamic load balancing method that accounts for both current load and server capacity is required. The Weighted Least Connections (member) method is the most appropriate choice. This method works by tracking the number of active connections to each pool member and then " weighting " that number based on a user-defined Ratio value assigned to the member. For example, the administrator can assign a higher Ratio to the three newer, more powerful servers and a lower Ratio to the two older servers. The BIG-IP then uses a formula to calculate which server should receive the next connection, ensuring that the newer servers handle a proportionately larger share of the total concurrent connections.

Standard Round Robin (Option C) would be ineffective because it distributes connections strictly sequentially (1, 2, 3, 4, 5) without regard for the servers ' capacity or current load, which would eventually overwhelm the older servers. Least Connections (member) (Option D) is better than Round Robin because it picks the server with the fewest active connections, but it still assumes all servers are equal; it would try to keep the connection counts identical across all 5 servers, which would still stress the older hardware more than the new. Global Availability (Option B) is a GSLB (DNS-based) method used for multi-site redundancy, not for local pool member load balancing. By using Weighted Least Connections, the administrator achieves a balance where the more capable servers take the brunt of the work while the older servers are utilized only to their specific safe capacity.

When a single IP address (Virtual Server) must host multiple hostnames (e.g., site1.com, site2.com) over HTTPS, the BIG-IP must be able to present the correct SSL certificate for each site during the initial handshake. This requirement is handled by a technology called Server Name Indication (SNI).

To implement this on the BIG-IP, the administrator must use a Client SSL profile because the encryption is occurring between the user (Client) and the Virtual Server. Within the Client SSL profile settings, there is a field called Server Name. By creating multiple Client SSL profiles—each with a different " Server Name " (the hostname) and its corresponding certificate—and attaching them all to the same Virtual Server, the BIG-IP can inspect the SNI extension in the client ' s " Client Hello " packet. It then selects the specific profile that matches the requested hostname.

Option A is incorrect because " Client Name " is not the standard field name used for SNI hostname matching in the profile. Options B and C refer to Server SSL profiles, which manage the connection between the BIG-IP and the backend servers. While Server SSL profiles also have a " Server Name " field (used to send SNI to a backend server), the requirement here is to provide encrypted communication for " users " accessing the virtual server, which definitively requires a Client-side SSL configuration.

URI-based traffic steering requires inspection of the HTTP request. BIG-IP processes HTTP headers and URIs in the HTTP_REQUEST event. Pool member selection based on URI must occur before the request is sent to the server, making HTTP_REQUEST the correct event.

By default, BIG-IP load balancing algorithms (such as Round Robin) distribute connections evenly across all available pool members. However, persistence profiles override normal load balancing decisions by forcing subsequent connections from a client to be sent to the same pool member.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Persistence creates a client-to-server mapping that is honored before load balancing algorithms are applied.

When persistence is enabled, BIG-IP may repeatedly select the same pool member even if others are available.

This directly alters load balancing behavior.

Why the other options are incorrect:

A. Adding a OneConnect profileOneConnect optimizes server-side TCP connections but does not change which pool member is selected.

B. Enabling SNAT automapSNAT affects source address translation, not pool member selection.

C. Enabling a fallback host in the HTTP profileA fallback host is only used when no pool members are available.

Correct Resolution:

Adding a persistence profile alters load balancing behavior by maintaining client affinity to a specific pool member.

In BIG-IP systems, iRules influence traffic only when they are attached to a Virtual Server. If application traffic is being sent to nodes or pool members that are not defined in the pool, this typically indicates that an iRule is overriding the default load-balancing behavior by explicitly selecting a pool or node.

According to BIG-IP Administration: Data Plane Configuration and official F5 guidance:

iRules are associated with Virtual Servers, not directly with pools or nodes.

To determine whether an iRule is actively affecting traffic, the administrator must inspect the Virtual Server configuration.

Explanation of the correct answers:

B. Via the GUI at the Resources tab for the virtual serverThe Resources tab in the Configuration Utility displays all traffic-handling objects applied to the Virtual Server, including assigned iRules. This is the primary GUI location to verify whether an iRule is influencing data plane traffic.

C. Via TMSH with the list /ltm virtual < virtual_server > commandThis TMSH command displays the full Virtual Server configuration, including any iRules listed under the rules section. It is the authoritative CLI method to confirm iRule usage.

Why the other options are incorrect:

A. Via TMSH with the list /ltm rule < irule > commandThis command only shows the contents of an iRule and does not indicate whether the iRule is attached to or used by any Virtual Server.

D. Via the GUI at the iRule tab for the virtual serverBIG-IP does not provide a dedicated “iRule” tab on Virtual Servers. iRules are viewed and managed under the Resources tab.

Correct Conclusion:

To verify whether an iRule is responsible for unexpected node selection, the BIG-IP Administrator must examine the Virtual Server configuration, either through the Resources tab in the GUI or by using TMSH to list the Virtual Server configuration.

When multiple hostnames resolve to the same IP address and encrypted communication is required, the BIG-IP must be able to present the correct SSL certificate based on the hostname requested by the client. This is accomplished using Server Name Indication (SNI).

According to BIG-IP Administration: Data Plane Configuration documentation:

SNI is a client-side TLS extension, where the client includes the requested hostname during the SSL handshake.

BIG-IP evaluates this hostname using the Client SSL profile, not the Server SSL profile.

The “Server Name” setting in the Client SSL profile enables BIG-IP to select the appropriate SSL certificate for the requested hostname.

Why option C is correct:

Client SSL profile handles inbound (client-side) encryption.

Server Name enables SNI-based certificate selection when multiple DNS names share the same virtual server IP.

Why the other options are incorrect:

A. Client SSL, Client NameThere is no Client SSL setting called Client Name for SNI certificate selection.

B. Server SSL, Server NameServer SSL is used for encryption between BIG-IP and backend servers, not for client-side hostname identification.

D. Server SSL, Client NameServer SSL does not process client-requested hostnames during TLS negotiation.

Correct Resolution:

Configure a Client SSL profile and enable the Server Name (SNI) setting to support multiple encrypted hostnames on the same virtual server IP.

Application-specific health checks must validate application responses, which requires HTTP monitors with custom send/receive strings.

Similar to the logic required for managing multi-service backend environments, the issue described—where servers hosting multiple protocols like FTP and HTTP are experiencing uneven distribution—stems from the BIG-IP ' s default behavior of treating each pool independently. If the administrator uses a member-based load balancing method, the BIG-IP distributes HTTP traffic regardless of how much FTP traffic that same physical server is currently processing.

To resolve this, the administrator must utilize the Least Connections (Node) method. By switching both the HTTP and FTP pools to this algorithm, the BIG-IP begins to make load balancing decisions based on the total combined connection count for the IP address of each server. When a new HTTP request arrives, the BIG-IP checks which server has the fewest total connections (including existing FTP sessions). This prevents a server that is already busy with long-lived FTP transfers from being overwhelmed by a sudden burst of HTTP requests.

Ratio methods (Options A and C) are static and rely on the administrator manually assigning weights to servers based on their perceived capacity; they do not adapt to real-time fluctuations in traffic volume across different pools. Least Connections (Member) (Option B) remains blind to the " cross-pool " traffic on the same hardware. Only the Node-based Least Connections approach provides the global visibility necessary to " even out " the total resource utilization across servers supporting multiple distinct applications.

To determine if an iRule is influencing traffic for a specific Virtual Server, the administrator must verify the association between the Virtual Server object and any applied scripts. In the BIG-IP Configuration Utility (GUI), this association is found under the Resources tab of the specific Virtual Server. While there is an " iRules " sub-menu under Local Traffic, checking the Virtual Server ' s Resources tab is the definitive way to see which specific rules are currently active and in what order they are being processed for that particular traffic flow.

From the Command Line Interface (CLI), the tmsh list /ltm virtual < virtual_server > command provides a full text-based output of the virtual server ' s configuration. If iRules are applied, they will appear within a " rules { ... } " block in the command output. This is more effective than Option A, which only lists the contents of the iRule itself but does not show if or where it is applied. Option C is a common misconception; while some versions of the GUI have reorganized menus, the standard location for managing the association of profiles, policies, and iRules to a Virtual Server remains the " Resources " section. By identifying the applied iRule, an administrator can then review the script logic—often containing commands like pool or node—to see if it is overriding the default pool selection based on specific HTTP headers, URI paths, or client IP addresses.

In F5 BIG-IP administration, iApps are designed to manage complex application configurations as a single unit. When an iApp is deployed, it creates an " Application Service " object that owns all the associated LTM objects, such as Virtual Servers, Pools, and Nodes. By default, these iApps are created with Strict Updates enabled. Strict Updates is a safety mechanism that prevents administrators from making manual " out-of-band " changes to the individual objects created by the iApp. The system enforces this because manual changes would be overwritten the next time the iApp template is updated or re-entered.

When the administrator attempts to change the destination IP address directly on the Virtual Server object, the BIG-IP system checks the " Strict Updates " flag. If it is set to " Enabled, " the system blocks the modification and generates the error message stating the service must be updated via the application management interface. To resolve this, the administrator must navigate to the iApp > > Application Services menu, select the specific application service, and go to the " Reconfigure " tab. Within the iApp configuration form, the destination IP can be safely changed. Alternatively, if the administrator specifically wants to manage the objects manually and forgo the benefits of the iApp template management, they could disable " Strict Updates " in the iApp properties, though this is generally discouraged as it breaks the template ' s logic. The error is not related to subnetting or duplicate IPs, but strictly to the configuration authority assigned to the iApp service.