F5CAB2 Sample Questions Answers

In an Active/Standby BIG-IP design, application availability during failover depends on both units having equivalent data-plane connectivity for the networks that carry application traffic. Specifically:

VLANs are bound to specific interfaces (and optionally VLAN tags).

Floating self IPs / traffic groups move to the new Active device during failover.

For traffic to continue flowing after failover, the new Active device must have the same VLANs available on the correct interfaces that connect to the upstream/downstream networks.

What the symptom tells you:

Traffic works when Device A is Active

Traffic fails when Device B becomes Active

Failback immediately restores traffic

This pattern strongly indicates the Standby unit does not have the VLAN connected the same way (wrong physical interface assignment), so when it becomes Active, it owns the floating addresses but cannot actually pass traffic on the correct network segment.

Why Interface mismatch is the best match:

If the Active unit is already working, its interface mapping is correct.

The fix is to make the Standby unit’s VLAN/interface assignment match the Active unit.

That corresponds to changing the Standby device interface to 1.1.

Why the Tag options are less likely here (given the choices and the exhibit intent):

Tag issues can also break failover traffic, but the question/options are clearly driving toward the classic HA requirement: consistent VLAN-to-interface mapping on both devices so the data plane remains functional after the traffic group moves.

Conclusion: To avoid an outage on the next failover, the BIG-IP Administrator must ensure the Standby device uses the same interface (1.1) for the relevant VLAN(s) that carry the application traffic, so when it becomes Active it can forward/receive traffic normally.

BIG-IP virtual server types define how traffic is handled at the data plane when it matches a virtual server’s destination address and service port.

According to BIG-IP Administration Data Plane Concepts:

Standard virtual server

The default and most commonly used type

Accepts client connections and forwards traffic to pool members

Supports both TCP and UDP traffic

Allows full use of profiles (UDP, FastL4, persistence, etc.) and iRules

Required when the goal is to process and pass traffic through BIG-IP

Drop virtual server

Silently discards matching traffic

No response is sent to the client

Reject virtual server

Actively rejects traffic by sending an error response

For UDP, BIG-IP may send an ICMP unreachable message

Block virtual server

Used to block traffic at the virtual server level

Traffic is neither forwarded nor processed by pools

In this scenario:

The administrator explicitly wants the UDP traffic to be forwarded

Only a Standard virtual server forwards traffic to a pool or next-hop destination

Why the Other Options Are Incorrect:

A. Drop – Traffic is silently discarded

B. Reject – Traffic is actively rejected

C. Block – Traffic is blocked and not forwarded

Key Data Plane Concept Reinforced:

When traffic must be accepted and forwarded—regardless of whether it is TCP or UDP—the BIG-IP administrator must use a Standard virtual server, which is the only virtual server type designed for normal application traffic processing.

===========

The BIG-IP system uses a specific precedence algorithm to determine which virtual server (listener) should process an incoming packet when multiple virtual servers might match the criteria. Since BIG-IP version 11.3.0, the system evaluates three primary factors in a fixed order of importance:

Destination Address: The system first looks for the most specific destination match. A "Host" address (mask /32) is preferred over a "Network" address (mask /24, /16, etc.), which is preferred over a "Wildcard" (0.0.0.0/0).

Source Address: If multiple virtual servers have identical destination masks, the system then evaluates the source address criteria. Again, a specific source host match is preferred over a source network or a wildcard source.

Service Port: Finally, if both destination and source specifications are equal, the system checks the port. A specific port match (e.g., 80) is preferred over a wildcard port (e.g., or 0).

Following this logic, a virtual server configured with a specific destination host, a specific source host, and a specific service port represents the highest level of specificity and thus the highest preference.

The F5 BIG-IP upgrade process for HA pairs requires a specific "staggered" approach to maintain uptime.

Version Mismatch: When one unit is upgraded to a newer version of TMOS (e.g., from 15.1 to 16.1), it enters a26 "Version Mismatch" 27state with its peer.

Configuration Sync: Because the configuration schemas between different versions are often incompatible, ConfigSync should not be performed. Attempting to sync a newer configuration to an older system (or vice-versa) can cause configuration corruption or system instability.

Failover Capability: Generally, a pair with a version mismatch can still fail over to ensure traffic continuity during the upgrade window, but administrative changes and syncs must be paused until both units are on the same version.

In a BIG-IP high availability (HA) configuration, Auto-Sync is a device trust feature that automatically synchronizes configuration changes from the Active device to the Standby device within a Sync-Failover device group.

Key principles from BIG-IP Administration Data Plane Concepts:

The Active device is always the authoritative source of configuration

Configuration changes are intended to be made only on the Active device

With Auto-Sync enabled, any time the Active device configuration changes, the system automatically pushes the configuration to all Standby members of the device group

Configuration changes made directly on a Standby device are not preserved

In this scenario:

The administrator modifies a Virtual Server on the Standby device

That change is local only and does not alter the device group’s synchronized configuration

When Auto-Sync next runs (triggered by a change on the Active device or an internal sync event), the Active device configuration overwrites the Standby configuration

As a result, the configuration change made on the Standby device is undone.

Why the Other Options Are Incorrect:

A – The change is not undone only when another change is made; it is undone during the next Auto-Sync operation

B – Changes made on the Standby device are never propagated to the Active device

D – Auto-Sync does not merge or promote Standby changes into the HA pair configuration

Best Practice Reinforced:

Always perform configuration changes on the Active BIG-IP device when Auto-Sync is enabled to ensure consistent and predictable HA behavior.

===========

6

The End7 User Diagnostics (EUD) utility is a software tool designed to test the hardware components of a BIG-IP system. Because the EUD must run when the standard Traffic Management Microkernel (TMM) and Operating System (TMOS) are not fully loaded (especially in "fail to boot" scenarios), it is accessed at the boot level.

Access Requirements: To run the EUD, the administrator must reboot the BIG-IP system and select the EUD option from the GRUB boot menu. Because the network interfaces (Internal, External, and Management) require a running operating system and drivers to function, they are unavailable during this pre-boot phase.

The Console Port: The Console Port provides a direct out-of-band serial connection to the hardware's BIOS and bootloader. This is the only interface that allows an administrator to interact with the system during the early stages of the power-on self-test (POST) and boot sequence to initiate diagnostic tests.

Purpose: The EUD performs a series of tests on the CPU, memory, hard drives, and physical interfaces to identify hardware-level failures before the data plane is even initialized.

This question focuses on connection behavior when pool members transition from down to up, which is a classic data plane consideration in BIG-IP environments.

What problem is being solved?

When a pool member:

Recovers from a failure

Is enabled after maintenance

Transitions from inactive to active

…it can suddenly receive a large burst of new connections, especially when using load-balancing methods such as Least Connections. This sudden surge can overload the server.

Why Slow Ramp Time is the correct solution:

Slow Ramp Time is a pool-level setting that:

Gradually increases the number of connections sent to a newly available pool member

Prevents sudden spikes in traffic

Allows the server to warm up (application cache, JVM, DB connections, etc.)

From BIG-IP Administration Data Plane Concepts:

Slow Ramp Time controls the rate at which BIG-IP increases load to a pool member that has just become available

During the ramp period, BIG-IP artificially increases the member’s connection count, making it appear “busier” and therefore less attractive for new connections

This directly satisfies the requirement to avoid overloading pool members when they become active.

Why the Other Options Are Incorrect:

B. Different Ratio for each member

Ratios control relative distribution under normal operation

They do not prevent a sudden surge when a member becomes active

C. Action On Service Down to Reselect

Controls persistence behavior when a member goes down

Has no impact on connection ramp-up when a member comes back online

D. Same Priority Group to each member

Affects failover logic between priority groups

Does not control connection rate or ramp-up behavior

Key Data Plane Concept Reinforced:

To protect backend servers during recovery events, BIG-IP provides Slow Ramp Time, ensuring graceful reintroduction of traffic and preventing connection storms that can occur during high-load scenarios.

===========

To meet the requirement of fault tolerance when one interface goes down, BIG-IP must use link aggregation so that loss of a single physical link does not isolate the VLAN(s).

How the objects relate (data plane view)

Interfaces = physical links.

Trunk (LACP) = bundles multiple interfaces into one logical link that provides redundancy (and possibly bandwidth aggregation).

VLANs are assigned to interfaces or trunks. If you need multiple VLANs on the same trunk, they must use 802.1Q tagging (because you can only have one untagged VLAN per interface/trunk).

Self IPs are then placed on the VLANs to provide BIG-IP presence and routing/ARP functions, but self IPs are not what provides link resiliency—the trunk does.

Why Option D is correct

You have two physical interfaces and you want resiliency if one fails → put both interfaces into one trunk with LACP enabled.

You need both external and internal VLANs on those same two links → both VLANs should be configured as tagged on that trunk, so they can coexist on the same aggregated link.

If either physical interface fails, the trunk remains up via the remaining interface, keeping both VLANs operational.

Why the other options are incorrect

A: Two VLANs cannot both be untagged on the same trunk/interface. Only one untagged VLAN is possible; additional VLANs must be tagged.

B: Two trunks “each with one VLAN” would typically mean splitting VLANs across separate trunks. With only two interfaces total, that becomes one interface per trunk—if one interface goes down, the VLAN on that interface is down (no redundancy for that VLAN).

C: Same redundancy problem as B, and disabling LACP removes the negotiated aggregation behavior expected when the switch engineer specifically requested LACP.

===========