F5CAB2 Sample Questions Answers

In BIG-IP LTM, apool member statedirectly affects how traffic is handled at the data plane level. When a pool member ismanually disabled, BIG-IP changes the member’s availability state todisabled, which has specific and predictable traffic-handling consequences.

According to BIG-IP Administration Data Plane Concepts:

Adisabled pool member:

Doesnot accept new connections

Continues to processexisting non-persistent connectionsuntil they naturally close

Isremoved from load-balancing decisions, including persistence lookups

Most importantly for this question:

Persistent connections(such as those created using source-address persistence, cookie persistence, or SSL persistence) arenot honoredfor a disabled pool member

BIG-IP willnot send new persistent trafficto a disabled member, even if persistence records exist

Therefore, when a pool member is manually disabled, itstops processing persistent connections, while allowing existing non-persistent flows to drain gracefully.

Why the Other Options Are Incorrect:

B– Persistent connections are not honored for a disabled pool member

C– Existing connections are not immediately terminated when a pool member is disabled

D– Only the disabled pool member stops accepting new connections, not all pool members

Key Data Plane Concept Reinforced:

Manually disabling a pool member is agraceful administrative actionthat prevents new and persistent traffic from reaching the member while allowing existing connections to complete, which is critical for maintenance and troubleshooting scenarios.

===========

The behavior of a health monitor is determined by itsSend StringandReceive String.

Default HTTP Monitor:The pre-configured default HTTP monitor on a BIG-IP system has an emptyReceive String.

Success Criteria:When the Receive String is blank, the BIG-IP system considers the health check successful if it receivesany valid HTTP responsefrom the server.

Status Code Interpretation:Because a 404 Not Found is a valid HTTP status code (it is a properly formatted response from a running web server process), the BIG-IP interprets this as the application being "alive".

Result:All three members (including the two returning 404s and the one returning 200) will be marked asUP/Available(Green).

F5 BIG-IP uses aConfigSyncmechanism to ensure that all members of a Device Service Cluster (DSC) share the same configuration.

Manual Synchronization:By default, configuration changes made on one device (the "source") do not automatically propagate to other members.

Direction of Sync:Once a Virtual Server is created on device 1, that device's configuration is now "newer" than the rest of the group. The administrator must initiate a synchronization from themodified device (device 1) to the Sync-Failover group.

Consistency:This ensures that if a failover occurs, device 2 (the standby) will have the exact same Virtual Server configuration and can take over traffic immediately without interruption.

In BIG-IP, atrunkis a Layer 2 network object used to aggregate multiple physicalinterfacesinto a single logical link. This aggregation providesincreased bandwidthandlink resiliency, commonly in conjunction with LACP.

Key concepts that apply here:

Trunks are managed under the/net trunktmsh hierarchy

Physical interfaces are added or removed using themodifycommand

Thecreatecommand is used only when defining a brand-new trunk, not when updating an existing one

Because the trunk already exists and the goal is toadd interfaces, the correct operation is:

tmsh modify /net trunk trunk_A interfaces add {1.3 1.4}

This command:

Modifies the existing trunk named trunk_A

Adds interfaces 1.3 and 1.4 to the trunk

Immediately increases available bandwidth and redundancy

Why the Other Options Are Incorrect

Buses the /sys hierarchy, which is not used for trunks

Cattempts to create a trunk that already exists

Duses an incorrect hierarchy and an incorrect operation

When managing a large environment with hundreds of Virtual Servers, the most efficient way to identify the relationship between an iRule and the objects it manages is to view the properties of the iRule itself.

iRule Properties:Within the BIG-IP Configuration Utility, navigating toLocal Traffic > iRulesand selecting a specific iRule provides a "Statistics" or "Usage" tab (depending on the version). This view explicitly lists all Virtual Servers currently associated with that specific iRule.

Centralized Management:Instead of manually checking 235 individual Virtual Servers under the "Virtual Servers" menu, the iRules menu acts as a central point of reference for that specific logic.

Data Plane Impact:Because iRules can modify traffic flow, headers, and load balancing decisions, seeing the full list of affected Virtual Servers is critical before making adjustments to avoid unintended side effects across the application portfolio.

In BIG-IP terminology, aTrunkis the object used to implement Link Aggregation (IEEE 802.3ad/802.1AX). When a network engineer refers to "interface binding" or "EtherChannel" with LACP, the BIG-IP equivalent is a Trunk.

LACP (Link Aggregation Control Protocol):This is a protocol that allows the BIG-IP system to communicate with the upstream switches to negotiate the bundling of multiple physical links into a single logical link.

Resilience and Redundancy:By creating a trunk that includes interfaces connected to two different switches (typically configured as a VPC, VSS, or MLAG cluster on the switch side), the administrator ensures that the BIG-IP remains reachable even if one physical interface or one switch fails.

Data Plane Logic:The BIG-IP treats the trunk as a single Layer 2 interface. VLANs are then associated with the trunk rather than individual physical ports.

Why the other options are incorrect:

Option B:Trunks aggregate physical interfaces. While VLANs are associated with trunks, the trunk configuration itself does not "list" MAC addresses of the switches; it uses LACP to negotiate the connection.

Options C & D:Virtual Servers are Layer 4-7 objects used for traffic processing and load balancing. They do not possess "LACP profiles," nor are physical interfaces or management IPs treated as pool members for the purpose of link aggregation.

In a BIG-IP environment, load balancing and persistence work together but serve different purposes. While a load balancing method likeLeast Connectionsattempts to distribute traffic based on current connection counts, apersistence profileoverrides this logic for returning clients.

Persistence Overrides Load Balancing:When a persistence profile (such as Source Address or Cookie persistence) is applied to a Virtual Server, the BIG-IP system tracks which client was sent to which backend member.

Sticky Sessions:If a client with a valid persistence record returns, the BIG-IP will send that client to thesame pool memberit was previously assigned to, regardless of the load balancing algorithm's current preference.

Uneven Distribution:If certain clients generate significantly more traffic or stay connected longer than others, the persistence table will "lock" those high-volume flows to specific members, resulting in an uneven distribution of connections across the pool.

In the F5 BIG-IP system, virtual servers are categorized based on their destination address and mask. The system distinguishes between three primary destination scopes:

Host Virtual Server:A virtual server that has a specific IP address (e.g., 10.10.10.50) and a /32 mask.

Network Virtual Server:A virtual server that has a destination address representing a subnet (e.g., 192.168.10.0) and a specific mask (e.g., /24).

Wildcard Virtual Server:A virtual server that has a destination address of0.0.0.0(or :: for IPv6) and a mask of 0.0.0.0 (or /0).

While a "Forwarding (IP)" virtual server (Option D) is theType(behavioral configuration) often used to route traffic without load balancing, the termWildcard(Option C) is the specific administrative term used to define the "type" of virtual server based on the0.0.0.0 destination address.

A common architectural use case is to create aWildcard Virtual Serverthat listens only on an internal VLAN to act as a default gateway for outbound traffic (Internet access) for back-end servers. This ensures the BIG-IP system can process and forward traffic that does not match any other specific virtual server configuration.

SNAT Automapis a feature that automatically selects a self-IP address to use as the source address for translated packets. The selection logic follows a strict hierarchy to ensure that traffic is routable back to the BIG-IP:

Egress VLAN Priority:The BIG-IP first looks at the VLAN through which the traffic is exiting toward the pool member (the egress VLAN).

Floating Self-IP Preference:If the egress VLAN has afloating self-IP address, the BIG-IP will always prefer it for SNAT Automap. This is critical for High Availability (HA) because, during a failover, the floating IP moves to the new active device, allowing existing connections to be maintained or correctly timed out.

Non-Floating Fallback:If no floating self-IP is available on the egress VLAN, the system will use a floating self-IP from a different VLAN. If no floating IPs exist at all, it will then fall back to the non-floating self-IP.

Key Data Plane Concept:

The management IP is never used for data plane traffic. In this scenario, since the administrator has configured a floating self-IP, that specific address becomes the source for all SNAT Automap traffic leaving that VLAN to ensure symmetric routing during HA events.

BIG-IP uses avirtual server matching and precedence algorithmto determine which virtual server processes an incoming connection. This decision is made entirely in thedata planeand is based on how specifically a virtual server matches the destination IP address and port.

BIG-IP Virtual Server Selection Rules (Simplified):

When multiple virtual servers could match a packet, BIG-IP selects themost specific match, using the following precedence:

Exact IP address and exact port

Exact IP address with wildcard port (port 0 / any)

Wildcard IP address with exact port

Wildcard IP address and wildcard port

Applying the Rules to This Scenario:

Incoming traffic destination:1.0.0.10:8080

Option C: 1.0.0.10:8080

Exact IP match

Exact port match

Highest possible specificity

If the virtual server is available (green), itwins the match

Option B: 1.0.0.10:any

Exact IP match, but wildcard port

Lower priority than an exact IP + exact port match

Option D: 0.0.0.0:8080

Wildcard IP, exact port

Lower priority than an exact IP match

Option A: 0.0.0.0:any

Wildcard IP and wildcard port

Lowest priority, used only if no more specific virtual server exists

Final Determination:

Because a virtual server configured withdestination 1.0.0.10:8080exactly matches both the IP address and port of the incoming connection—and is available—it willalwaysbe selected to process the traffic.

Key Data Plane Concept Reinforced:

BIG-IP always processes traffic using themost specific matching virtual server. Exact destination IP and port matches take precedence over any wildcard or forwarding virtual server definitions.

===========

This question focuses onconnection behavior when pool members transition from down to up, which is a classic data plane consideration in BIG-IP environments.

What problem is being solved?

When a pool member:

Recovers from a failure

Is enabled after maintenance

Transitions frominactivetoactive

…it can suddenly receive alarge burst of new connections, especially when using load-balancing methods such asLeast Connections. This sudden surge can overload the server.

Why Slow Ramp Time is the correct solution:

Slow Ramp Timeis a pool-level setting that:

Gradually increases the number of connections sent to a newly available pool member

Prevents sudden spikes in traffic

Allows the server to warm up (application cache, JVM, DB connections, etc.)

From BIG-IP Administration Data Plane Concepts:

Slow Ramp Time controls therate at which BIG-IP increases loadto a pool member that has just become available

During the ramp period, BIG-IP artificially increases the member’s connection count, making it appear “busier” and therefore less attractive for new connections

This directly satisfies the requirement toavoid overloading pool members when they become active.

Why the Other Options Are Incorrect:

B. Different Ratio for each member

Ratios controlrelative distributionunder normal operation

They do not prevent a sudden surge when a member becomes active

C. Action On Service Down to Reselect

Controls persistence behavior when a member goes down

Has no impact on connection ramp-up when a member comes back online

D. Same Priority Group to each member

Affects failover logic between priority groups

Does not control connection rate or ramp-up behavior

Key Data Plane Concept Reinforced:

To protect backend servers during recovery events, BIG-IP providesSlow Ramp Time, ensuringgraceful reintroduction of trafficand preventing connection storms that can occur during high-load scenarios.

===========

6

TheEnd7User Diagnostics (EUD)utility is a software tool designed to test the hardware components of a BIG-IP system. Because the EUD must run when the standard Traffic Management Microkernel (TMM) and Operating System (TMOS) are not fully loaded (especially in "fail to boot" scenarios), it is accessed at the boot level.

Access Requirements:To run the EUD, the administrator must reboot the BIG-IP system and select the EUD option from theGRUB boot menu. Because the network interfaces (Internal, External, and Management) require a running operating system and drivers to function, they are unavailable during this pre-boot phase.

The Console Port:TheConsole Portprovides a direct out-of-band serial connection to the hardware's BIOS and bootloader. This is the only interface that allows an administrator to interact with the system during the early stages of the power-on self-test (POST) and boot sequence to initiate diagnostic tests.

Purpose:The EUD performs a series of tests on the CPU, memory, hard drives, and physical interfaces to identify hardware-level failures before the data plane is even initialized.

The configuration shown matches aPerformance Layer 4virtual server because it is explicitly using aFastL4profile:

The screenshot showsProtocol: TCPandProtocol Profile (Client): fastL4.In BIG-IP data plane terms,FastL4is the hallmark of aPerformance (Layer 4)virtual server, designed to process connections at Layer 4 with minimal overhead (high throughput/low latency) compared to full proxy L7 processing.

The screenshot also showsHTTP Profile (Client): None(and HTTP server profile effectively not in use).AStandardvirtual server commonly usesfull-proxyfeatures and frequently includesL7 profiles(like HTTP) when doing HTTP-aware load balancing, header manipulation, cookie persistence, etc. In contrast, aPerformance L4virtual server typically doesnotuse an HTTP profile because it is not doing HTTP-aware (Layer 7) processing.

It isnotaForwarding IPvirtual server:AForwarding (IP)virtual server is used toroute/forward packets(often without load balancing to pool members in the same way as Standard/Performance VS) and is selected by choosing a forwarding type. The presence of aTCP protocol with a FastL4 client profilealigns with aLayer 4 load-balancing stylevirtual server, not a packet-forwarding virtual server type.

Conclusion:Because the configuration is TCP-based and explicitly usesfastL4with no HTTP profile, the expected BIG-IP virtual server type isPerformance Layer 4 (Option C).

AForwarding (IP)virtual server is unique because it does not perform load balancing in the traditional sense.

No Pool Members:Unlike a Standard virtual server, which requires a pool to direct traffic, a Forwarding (IP) virtual server typically hasno pool assigned.

Destination-Based Routing:The BIG-IP system looks at thedestination IP addressin the original packet header sent by the client. It then consults the BIG-IP system's local routing table to determine where to send the packet.

Transparency:It acts as a high-performance router/gateway, often used to forward traffic from internal servers to the internet or across different subnets while still allowing the BIG-IP to apply features like SNAT or bandwidth controllers.

Stateful Tracking:While it forwards traffic based on the routing table, it still creates an entry in the connection table to track the flow (unless it is a Stateless virtual server).

The BIG-IP system supports various remote authentication methods like LDAP, Active Directory, and RADIUS.

Fallback to Local:This is a specific security and availability feature within theSystem > Users > Authenticationconfiguration.

Redundancy:When "Fallback to Local" is enabled, the BIG-IP will first attempt to authenticate a user against the configured remote server. If that remote server is unreachable or fails to respond, the system will then check its internalLocal User databasefor credentials.

Administrative Access:This is standard practice for the "admin" or emergency accounts to ensure the system remains accessible even if the corporate directory service (e.g., AD) is offline.

This scenario combinessession continuity,multiple protocols (HTTP and FTP), andHA failover behavior, which directly implicatespersistence handling across devices and services.

Key Requirements Breakdown

Samepool member for entire session

Session must survivefailover

Session must spanmultiple services (HTTP and FTP)

Why Persistence Mirroring + Match Across Services Is Required

Persistence Mirroring

Ensurespersistence records are synchronizedfrom the active BIG-IP to the standby BIG-IP.

Without mirroring:

After failover, the standby device hasno persistence table

Clients are load-balanced again

Sessions break, forcing users to restart

Persistence mirroring is essential forsession continuity during failover

Match Across Services

Allows asingle persistence recordto be shared acrossmultiple virtual servers / protocols

Required when:

HTTP and FTP must use thesame pool member

Multiple services are part of a single application session

Together, these settings ensure:

Persistence survivesdevice failover

Persistence is honoredacross HTTP and FTP

Why the Other Options Are Incorrect

A. Cookie persistence and session timeoutCookie persistence only applies to HTTP and does not address FTP or failover synchronization.

B. Stateful failover and Network Failover detectionStateful failover applies toconnection state, notpersistence records, and does not link HTTP and FTP sessions.

D. SYN-cookie insertion threshold and connection low-water markThese are DoS / SYN flood protection settings, unrelated to persistence or HA behavior.