F5CAB2 Sample Questions Answers

This scenario combines session continuity , multiple protocols (HTTP and FTP) , and HA failover behavior , which directly implicates persistence handling across devices and services .

Key Requirements Breakdown

Same pool member for entire session

Session must survive failover

Session must span multiple services (HTTP and FTP)

Why Persistence Mirroring + Match Across Services Is Required

Persistence Mirroring

Ensures persistence records are synchronized from the active BIG-IP to the standby BIG-IP.

Without mirroring:

After failover, the standby device has no persistence table

Clients are load-balanced again

Sessions break, forcing users to restart

Persistence mirroring is essential for session continuity during failover

Match Across Services

Allows a single persistence record to be shared across multiple virtual servers / protocols

Required when:

HTTP and FTP must use the same pool member

Multiple services are part of a single application session

Together, these settings ensure:

Persistence survives device failover

Persistence is honored across HTTP and FTP

Why the Other Options Are Incorrect

A. Cookie persistence and session timeout Cookie persistence only applies to HTTP and does not address FTP or failover synchronization.

B. Stateful failover and Network Failover detection Stateful failover applies to connection state , not persistence records , and does not link HTTP and FTP sessions.

D. SYN-cookie insertion threshold and connection low-water mark These are DoS / SYN flood protection settings, unrelated to persistence or HA behavior.

Managing the lifecycle of a pool member requires understanding the difference between " Disabled " and " Forced Offline " states, especially when persistence is involved.

Disabled (User-Disabled) : This state allows existing connections and persistent sessions to continue until they naturally time out or are closed by the client/server. It only prevents new sessions from being established.

Forced Offline : This state is more restrictive; it allows existing connections to complete but rejects all new connections, including those with existing persistence records.

Immediate Removal : Neither " Disabled " nor " Forced Offline " will instantly kill currently active, established TCP connections. To meet the requirement of " immediately " removing all connections, the administrator must first set the member to Forced Offline (to prevent persistence from bringing in new traffic) and then use the command line (e.g., tmsh delete sys connection ss-server-addr [IP]) to clear the current connection table entries.

A Self IP is an IP address on the BIG-IP system that you associate with a specific VLAN .

VLAN Association: A Self IP cannot exist independently; it must be bound to a VLAN to define which network segment the BIG-IP can communicate with.

Layer 2 to Layer 3 Mapping: While a VLAN is associated with physical interfaces or trunks (Layer 2), the Self IP provides the Layer 3 identity for the BIG-IP on that VLAN.

Traffic Processing: Self IPs are used by the BIG-IP for health checking backend servers, acting as a default gateway for servers, and for HA heartbeat communication.

The BIG-IP system supports various remote authentication methods like LDAP, Active Directory, and RADIUS.

Fallback to Local: This is a specific security and availability feature within the System > Users > Authentication configuration.

Redundancy: When " Fallback to Local " is enabled, the BIG-IP will first attempt to authenticate a user against the configured remote server. If that remote server is unreachable or fails to respond, the system will then check its internal Local User database for credentials.

Administrative Access: This is standard practice for the " admin " or emergency accounts to ensure the system remains accessible even if the corporate directory service (e.g., AD) is offline.

In BIG-IP traffic management, persistence profiles cause existing client connections (and subsequent requests) to be repeatedly sent to the same pool member. When persistence is enabled, simply preventing new connections is not sufficient if the requirement is to immediately remove all existing connections .

Key behavior of pool member states:

Forced Offline

Immediately removes the pool member from load balancing.

Terminates all existing connections , regardless of persistence.

Prevents new connections from being established.

This is the correct state when urgent maintenance or troubleshooting is required.

Disabled

Prevents new connections from being sent to the pool member.

Allows existing connections to continue , which is not acceptable when persistence is configured and connections must be cleared immediately.

Offline (non-forced)

Similar to Disabled behavior depending on context.

Does not guarantee immediate termination of existing connections.

Manually deleting connections via the command line

Is unnecessary and operationally inefficient.

BIG-IP already provides a supported mechanism ( Forced Offline ) to cleanly and immediately remove traffic.

Conclusion:

To immediately remove all existing connections , including those maintained by persistence, the BIG-IP Administrator must set the pool member to a Forced Offline state. This directly satisfies the requirement without additional manual steps.

In the BIG-IP system, VLANs are the logical entities that group physical interfaces or trunks together. To modify how a VLAN interacts with an interface, the administrator must navigate to the specific VLAN configuration object.

VLAN List: This section displays all existing VLANs configured on the system.

Interface Association: Within the properties of a specific VLAN (in this case, " external " ), there is an Interfaces section. This is where physical ports or trunks are assigned to the VLAN.

Tagging Status: For each associated interface, the administrator can choose between Tagged (802.1Q) or Untagged .

Untagged: The interface will treat incoming traffic without a VLAN header as part of this VLAN, and outgoing traffic will not have a VLAN tag added. An interface can only be " Untagged " for one VLAN.

Tagged: Allows an interface to carry traffic for multiple VLANs simultaneously by using 802.1Q headers.

F5 BIG-IP uses a ConfigSync mechanism to ensure that all members of a Device Service Cluster (DSC) share the same configuration.

Manual Synchronization: By default, configuration changes made on one device (the " source " ) do not automatically propagate to other members.

Direction of Sync: Once a Virtual Server is created on device 1, that device ' s configuration is now " newer " than the rest of the group. The administrator must initiate a synchronization from the modified device (device 1) to the Sync-Failover group .

Consistency: This ensures that if a failover occurs, device 2 (the standby) will have the exact same Virtual Server configuration and can take over traffic immediately without interruption.

For BIG-IP to send or receive traffic on a VLAN, that VLAN must be bound to a physical interface or a trunk . Creating a VLAN object and a Self IP alone is not sufficient to establish data-plane connectivity.

From the exhibit:

The VLAN ( vlan_1033 ) exists and has a tag defined.

A Self IP is configured and associated with the VLAN.

However, traffic cannot reach servers on that VLAN.

This indicates a Layer 2 connectivity issue , not a Layer 3 or HA issue.

Why assigning a physical interface fixes the problem:

BIG-IP VLANs do not carry traffic unless they are explicitly attached to:

A physical interface (e.g., 1.1), or

A trunk

Without an interface assignment, the VLAN is effectively isolated and cannot transmit or receive frames, making servers unreachable regardless of correct IP addressing.

Why the other options are incorrect:

A. Set Port Lockdown to Allow All Port Lockdown controls which services can be accessed on the Self IP (management-plane access), not whether BIG-IP can reach servers on that VLAN.

B. Change Auto Last Hop to enabled Auto Last Hop affects return traffic routing for asymmetric paths. It does not fix missing Layer 2 connectivity.

D. Create a Floating Self IP address Floating Self IPs are used for HA failover. They do not resolve reachability issues on a single device when the VLAN itself is not connected to an interface.

Conclusion:

The servers are unreachable because the VLAN has no physical interface assigned . To restore connectivity, the BIG-IP Administrator must assign a physical interface (or trunk) to the VLAN , enabling Layer 2 traffic flow.

In a BIG-IP environment, load balancing and persistence work together but serve different purposes. While a load balancing method like Least Connections attempts to distribute traffic based on current connection counts, a persistence profile overrides this logic for returning clients.

Persistence Overrides Load Balancing: When a persistence profile (such as Source Address or Cookie persistence) is applied to a Virtual Server, the BIG-IP system tracks which client was sent to which backend member.

Sticky Sessions: If a client with a valid persistence record returns, the BIG-IP will send that client to the same pool member it was previously assigned to, regardless of the load balancing algorithm ' s current preference.

Uneven Distribution: If certain clients generate significantly more traffic or stay connected longer than others, the persistence table will " lock " those high-volume flows to specific members, resulting in an uneven distribution of connections across the pool.

12

In the BIG-IP system, pool selection must occur on the client-side of the connection, before the system attempts to connect to a pool 3 member. The events listed 4 are the primary entry points for making these decisions:

CLIENT_ACCEPTED (E): This is a Layer 4 event triggered when the BIG-IP accepts a TCP connection. It is the earliest point where a pool can be assigned based on the client ' s source IP address or the destination port.

CLIENT_DATA (A): This event is triggered when the system receives a " chunk " of data on the client-side. It is often used for non-HTTP protocols (like custom TCP protocols) to inspect the payload and select a pool based on its contents.

HTTP_REQUEST (C): This is a Layer 7 event. It occurs once the BIG-IP has fully parsed the HTTP headers. This is the most common event for pool selection, allowing the administrator to route traffic based on the URI, Host header, or cookies.

Events like SERVER_SELECTED or SERVER_CONNECTED occur after the load balancing decision has already been made, and HTTP_RESPONSE or SERVER_DATA occur after the server has already started communicating back, making them too late for initial pool selection.

By default, when a pool member is marked " down " by a monitor, the BIG-IP system stops sending new connections to that member, but it typically allows existing connections to time out naturally (or resets them depending on profile settings).

Action on Service Down: This setting is configured at the Pool level.

Reselect: When set to Reselect , if a pool member is marked down, the BIG-IP system will immediately attempt to pick a different available pool member for any existing, active connections associated with the failed member.

Client Experience: This is used to maintain the user session by transparently moving the traffic to a healthy server without the client needing to re-establish the connection to the Virtual Server.

With Least Connections (member) , BIG-IP attempts to send new connections to the pool member with the fewest current connections. In a perfectly “stateless” scenario (no affinity), this often trends toward a fairly even distribution over time.

However, persistence overrides load balancing :

When a persistence profile is applied, BIG-IP will continue sending a client (or client group) to the same pool member based on the persistence record (cookie / source address / SSL session ID, etc.).

This means even if another pool member has fewer connections, BIG-IP may still select the persisted member to honor session affinity.

The result can be uneven active connection counts , even though the configured load balancing method is Least Connections.

Why the other options are not the best cause:

A. Priority Group Activation is disabled Priority Group Activation only affects selection when priority groups are configured; disabling it does not inherently create uneven distribution under Least Connections.

B. SSL Profile Server is applied A server-side SSL profile affects encryption to pool members, but it does not by itself cause skewed selection across pool members. (Skew could happen indirectly if members have different performance/latency, but that’s not the primary, expected exam answer.)

D. Incorrect load balancing method Least Connections is a valid method and does not itself explain unevenness unless something is overriding it (like persistence) or pool members are not all eligible.

Conclusion:

A persistence profile is the most common and expected reason that active connections become unevenly distributed , because persistence takes precedence over the Least Connections load-balancing decision.

In BIG-IP LTM, a Wildcard virtual server is defined by using a destination IP address of 0.0.0.0. These virtual servers are designed to handle traffic that does not match any more specific Virtual Server destination address.

0.0.0.0 Destination: This address acts as a " catch-all " for IP traffic.

VLAN Specificity: While the destination address is generic, a Wildcard virtual server is typically restricted to a specific VLAN (such as the Internal VLAN) to process outbound traffic from backend servers.

Service Ports: A wildcard virtual server can be configured for a specific port (e.g., 0.0.0.0:80) or for all ports (0.0.0.0:0).

Data Plane Usage: It is commonly used for transparently intercepting outbound traffic for the purpose of Source NAT (SNAT), bandwidth shaping, or directing traffic to a gateway pool.

The primary distinction between Activ 41 e and Standby units revolves around which unit is currently processing traffic.

Traffic Objects (C & E): The unit in the 43 Active state is the only one that answers ARP requests for Virtual Server addresses and Floating Self-IPs . The Standby unit remains " quiet " for these addresses to avoid IP conflicts on the network.

Monitors (A - False): Both the Active and Standby units perform health monitors on pool members by default. This ensures that the Standby unit is ready to take over with an up-to-date view of the pool ' s health.

Failover (B - False): A failover trigger (like a VLAN fail-safe) causes the Active unit to go Standby and the Standby unit to go Active; it affects both.

Management (D - False): Configuration changes can technically be made on either unit (though it is best practice to make them on the Active unit) and then synchronized to the peer.

To select the correct virtual server type, an administrator must balance the need for L7 intelligence versus raw throughput and hardware offloading:

Performance (Layer 4) Virtual Server: This type is designed for maximum speed. It uses the fastL4 profile, which allows the BIG-IP system to leverage the ePVA (Embedded Packet Velocity Accelerator) hardware chip. When a Performance (L4) virtual server is used, the system processes packets at the network layer (L4) without looking into the application payload (L7). This fulfills the requirement for hardware acceleration and avoids the overhead of HTTP optimization features, which are not needed in this scenario.

Performance (HTTP) Virtual Server: While fast, this type uses the fasthttp profile to provide some L7 awareness and optimization (like header insertion or small-scale multiplexing). Since the requirement specifically states HTTP optimization is not required, the L4 variant is more efficient.

Standard Virtual Server: This is a full-proxy type. While it offers the most features (SSL offload, iRules, Compression), it processes traffic primarily in the TMOS software layer (or via high-level hardware assistance), which is " slower " than the pure hardware switching path of the Performance (L4) type.

Stateless Virtual Server: This is typically used for specific UDP/ICMP traffic where the system does not need to maintain a connection table. It is not appropriate for standard HTTP (TCP) applications requiring persistent sessions or stateful load balancing.

By choosing Performance (Layer 4) with the fastL4 profile, the organization ensures that the traffic is handled by the hardware acceleration chips, providing the lowest latency and highest throughput possible for their HTTP application.

In a BIG-IP device service cluster , configuration objects such as virtual servers, pools, profiles, and iRules are maintained through configuration synchronization (config-sync) .

Key BIG-IP concepts involved:

Device Service Cluster (DSC) A cluster is a group of BIG-IP devices that share configuration data. One device is typically used to make changes, which are then synchronized to the rest of the group.

Config-Sync Direction Matters

Changes are made on a local device

Those changes must be pushed to the group

The correct operation is “Sync Device to Group”

Why C is correct:

The virtual server was created only on device 1

Other devices in the cluster do not yet have this object

To propagate the new virtual server to all cluster members, the administrator must synchronize device 1 to the group

Why the other options are incorrect:

A. Synchronize the settings of the group to device 1 This would overwrite device 1’s configuration with the group’s existing configuration and may remove the newly created virtual server .

B. Create a new cluster on device 1 The cluster already exists. Creating a new cluster is unnecessary and disruptive.

D. Create a new virtual server on device 2 This defeats the purpose of centralized configuration management and risks configuration drift.

Conclusion:

After creating a new virtual server on a BIG-IP device that is part of a cluster, the administrator must synchronize the configuration from that device to the group so all devices share the same ADC application objects.

Comprehensive and Detailed Explanation From BIG-IP Administration Data Plane Concepts/Course Guide/topics:

BIG-IP evaluates a new connection against eligible virtual servers using increasingly specific traffic-matching criteria. F5 ' s certification material states that, for BIG-IP 11.3 and later, virtual-server precedence considers destination address first, source address second, and service port third , with the most specific applicable listener taking precedence. F5, Inc.

Option B initially appears attractive because it specifies the exact destination 10.16.2.100:445. However, its source 192.168.5.1/32 restricts that virtual server to traffic originating from that single source. The actual packet originates from 10.10.1.1 , so B is not an eligible match. F5 explicitly documents that the source address setting can restrict a virtual server to packets originating from a defined address or range.

Option C is eliminated because its destination is 10.120.6.10, not 10.16.2.100. Option D is the broad catch-all forwarding virtual (0.0.0.0:any, protocol any). Option A , however, is an applicable TCP forwarding virtual for the requested traffic and is preferred over the generic catch-all forwarding listener.

Study Guide References/Topics: Virtual Server Order of Precedence; Source Address Matching; Forwarding (IP) Virtual Servers; FastL4 Processing; Virtual Server Traffic Matching.

Redundant BIG-IP systems (HA pairs) must maintain constant communication to monitor the health of the peer and synchr 15 onize states. 16

Heartbeats: By default, even with a serial cable, th 17 e BIG-IP systems exchange " heartbeat " packets over the network to determine if the peer is still alive.

Network Failover: This involves the exchange of UDP packets (typically on port 1026) at regular intervals.

Device Service Clustering (DSC): Modern BIG-IP versions use the Central Management (cm) infrastructure to communicate configuration status and sync status constantly.

Clarification on others: Port lockdown does affect HA communication if misconfigured (A is false). Mirroring uses separate channels (B is false). Mirroring is never sent over the serial cable because it requires high bandwidth (D is false).