F5 F5CAB3 BIG-IP Administration Data Plane Configuration (F5CAB3) exam Exam Practice Test

Slow Ramp Time prevents new pool members from receiving full traffic immediately, avoiding overload.

The log message “Intercept exhaustion” indicates that the BIG-IP system has exhausted the available source port translations for one or more SNAT addresses. This occurs when too many concurrent client connections are being translated through a limited number of SNAT IP addresses, and all ephemeral source ports (typically ~64,000 per SNAT IP) are in use.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Each SNAT IP address provides a finite number of available source ports.

When the number of concurrent connections exceeds the available port space, the BIG-IP logs an Intercept exhaustion error and new connections fail.

The recommended resolution is to increase the available SNAT resources by adding additional IP addresses to the SNAT pool.

Why the other options are incorrect:

A. Increase the timeout of the SNAT addressesIncreasing timeouts may actually worsen the problem by keeping ports allocated longer, accelerating port exhaustion.

B. Remove the SNAT pool and apply SNAT AutomapSNAT Automap uses the Self IP addresses on the egress VLAN, which may not provide additional capacity and can introduce routing or design issues. This is not a direct or recommended fix for SNAT exhaustion.

C. Remove an IP address from the SNAT poolThis would reduce the number of available source ports and further exacerbate the intercept exhaustion condition.

Correct Resolution:

By adding an IP address to the SNAT pool, the BIG-IP increases the total number of available source ports, alleviating intercept exhaustion and restoring successful client connections.

The configuration error is the HTTP Profile = http setting. The virtual server is intended to load balance SSH , which operates over TCP port 22 and is not an HTTP application protocol. The configured TCP protocol and TCP profile are therefore appropriate, but an HTTP profile should not be attached to this SSH virtual server.

F5 documentation states that an HTTP profile defines how BIG-IP manages HTTP traffic . The standard http profile operates in Reverse proxy mode by default and invokes BIG-IP ' s HTTP protocol processing. F5 separately documents Transparent HTTP proxy mode as the mode that can forward invalid HTTP traffic instead of dropping it. This distinction is important because an SSH protocol exchange is not syntactically valid HTTP traffic.

Setting HTTP Profile to None removes unnecessary Layer 7 HTTP parsing and leaves the virtual server handling the SSH connection through its TCP profile. The other changes are inappropriate: SSH requires TCP rather than UDP; the source address does not need to equal the virtual server ' s destination IP; and changing the destination to 0.0.0.0/0 is unrelated to the application-protocol mismatch.

Reference Topics: Local Traffic Profiles → HTTP Profiles , Proxy Mode , TCP profiles , Virtual Server profile assignment .

Application-level monitors ensure that only the affected service is marked down, not the entire node.

When many users share one source IP, source-address persistence fails. Cookie persistence uniquely identifies clients at Layer 7.

The requirement states that load balancing decisions must be based on the number of active connections on each pool member. This directly maps to the Least Connections (member) load balancing method.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Least Connections (member) selects the pool member with the fewest active connections at the time of the request.

This method dynamically adapts to real-time traffic patterns and ensures that more heavily loaded pool members receive fewer new connections.

It is especially effective for web servers where connection duration may vary and equal distribution of active sessions is desired.

Why the other options are incorrect:

B. Round RobinDistributes connections sequentially without considering current load or active connections.

C. Ratio (member)Distributes traffic based on static ratios, not real-time connection counts.

D. Ratio (node)Uses predefined ratios at the node level and does not account for active connection counts.

Correct Resolution:

Using Least Connections (member) ensures that new connections are directed to the pool member currently handling the fewest active connections, meeting the stated requirement.

In this scenario, each backend node (server) hosts multiple services and is referenced by multiple pools and virtual servers. The goal is to ensure an equal number of total connections per backend server, regardless of how many pool members (services/ports) exist on that server.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Least Connections (node) tracks the total number of active connections to a node across all pool members and services.

This algorithm ensures load distribution is balanced at the server level, not just at the individual service (member) level.

It is specifically recommended when:

Multiple pool members exist on the same backend server

Multiple virtual servers reference the same backend servers

Why the other options are incorrect:

B. Predictive (member)Predictive algorithms are advanced and traffic-pattern based, but they operate at the member level and do not guarantee equal connections per server.

C. Least Connections (member)This balances connections per pool member, which can overload a server hosting multiple members while still appearing “balanced” per member.

D. Predictive (node)Although node-aware, predictive algorithms are less deterministic and not the best choice when strict equality of connections is required.

Correct Resolution:

Using Least Connections (node) ensures that each backend server carries an equal connection load across all services and pools.

A red diamond indicates that the Virtual Server is enabled but unavailable, typically due to all pool members being down.

The virtual server is intended to process SSH traffic on TCP port 22 , but the exhibit shows that the standard http HTTP profile is assigned. This is the configuration error. An HTTP profile enables BIG-IP Layer 7 HTTP processing and is appropriate only when the virtual server is expected to process HTTP protocol traffic. F5 documentation defines its purpose directly: “An HTTP profile defines the way that you want the BIG-IP system to manage HTTP traffic.”

SSH is not HTTP. It is an independent application protocol transported over TCP , conventionally using port 22 . Therefore, an ordinary SSH load-balancing virtual server should retain the TCP protocol/profile while having HTTP Profile set to None . F5 ' s SSH virtual-server configuration guidance specifically uses service port 22 for SSH and does not require an HTTP profile.

Options B, C, and D do not address the fault. The destination address 10.1.1.2 correctly identifies the virtual server, while source 0.0.0.0/0 appropriately permits clients from any source. Changing the protocol to UDP would be incorrect because SSH requires TCP.

Reference Topics: Virtual Server configuration; HTTP profiles; TCP profiles; application-protocol profile assignment; SSH traffic handling.

When a single IP address (Virtual Server) must host multiple hostnames (e.g., site1.com, site2.com) over HTTPS, the BIG-IP must be able to present the correct SSL certificate for each site during the initial handshake. This requirement is handled by a technology called Server Name Indication (SNI).

To implement this on the BIG-IP, the administrator must use a Client SSL profile because the encryption is occurring between the user (Client) and the Virtual Server. Within the Client SSL profile settings, there is a field called Server Name. By creating multiple Client SSL profiles—each with a different " Server Name " (the hostname) and its corresponding certificate—and attaching them all to the same Virtual Server, the BIG-IP can inspect the SNI extension in the client ' s " Client Hello " packet. It then selects the specific profile that matches the requested hostname.

Option A is incorrect because " Client Name " is not the standard field name used for SNI hostname matching in the profile. Options B and C refer to Server SSL profiles, which manage the connection between the BIG-IP and the backend servers. While Server SSL profiles also have a " Server Name " field (used to send SNI to a backend server), the requirement here is to provide encrypted communication for " users " accessing the virtual server, which definitively requires a Client-side SSL configuration.

The Local Traffic > Network Map provides a single consolidated view within the BIG-IP Configuration Utility that displays the full relationship hierarchy of all application delivery objects simultaneously. This includes Virtual Servers, their associated Pools, individual Pool Members, applied iRules, profiles, and the health status of each object — all rendered in a single topological screen.

This view is specifically designed for administrators and users who need rapid situational awareness across the data plane without navigating multiple menu screens. Each object is colour-coded to reflect its current availability state (green = available, red = unavailable, yellow = degraded).

The alternative options do not satisfy all requirements:

Local Traffic > Monitors only displays health monitor configurations, not virtual server or pool member relationships.

Statistics provides performance counters and throughput data, not object relationship mapping.

Local Traffic > Virtual Servers lists virtual server configurations individually but does not provide a unified topology view inclusive of pool members and iRules in a single screen.

The Network Map is the authoritative single-pane-of-glass tool for application object visibility on BIG-IP.

X-Forwarded-For inserts the original client IP into HTTP headers while SNAT is enabled.

The configuration provided utilizes Priority Group Activation in conjunction with the min_active_members setting. Priority groups allow an administrator to define primary servers and " backup " servers within the same pool. The BIG-IP prioritizes traffic based on the assigned priority number, with the highest number receiving traffic first.

In this specific configuration, the priority 3 group is the primary group. Therefore, connections are first distributed to all pool members with priority 3 as long as they are available. The system will continue to use only the priority 3 group unless the number of available members in that group falls below the min_active_members value, which is set to 2.

If the priority 3 group has fewer than two active members, the BIG-IP " activates " the next available priority group (priority 2) and distributes traffic among the remaining members of priority 3 and all members of priority 2. This cascading logic continues down the list. Consequently, if both the priority 3 group and the priority 2 group have fewer than two members available, traffic is directed to the priority 1 group. This ensures that even in a multi-server failure scenario, the system has a last-resort group of servers to handle the traffic.

Option D is incorrect because if only one member of priority 3 goes down, there are still two members active (10.12.10.8 and 10.12.10.9). Since 2 is not less than the min_active_members threshold of 2, the priority 2 group will not yet be activated. Option B is incorrect because traffic flows from high priority to low priority, not the other way around.

This scenario describes a classic routing issue often encountered during SSL offload deployments. The fact that an SSL connection is established indicates the Client SSL profile is working correctly. The packet trace showing the server " receives and responds " to the request is the most critical diagnostic clue.

When a BIG-IP receives traffic, it typically passes the client ' s original source IP address to the backend server. If the backend server ' s default gateway is not the BIG-IP (a common " one-arm " network topology), the server will attempt to send its response directly back to the client ' s IP via its own default router. The client ' s browser will reject this response because it expects traffic to come from the Virtual Server ' s IP, not the backend server ' s IP.

To resolve this, the administrator must enable SNAT (Source Address Translation), typically using SNAT Automap. When SNAT is enabled, the BIG-IP replaces the client ' s original source IP with one of its own Self IPs before forwarding the request to the server. Because the source of the packet is now the BIG-IP, the backend server is forced to send its response back to the BIG-IP. The BIG-IP then receives the response, translates it back, and delivers the content to the user. Option A is unnecessary if the servers are expecting plain-text traffic after the BIG-IP performs offload. Option D would only worsen the existing routing discrepancy.

To fulfill the requirement of " SSL Offload " limited to " TLSv1.2 only, " the administrator must focus on the client-side of the connection. SSL Offload means the BIG-IP terminates the encrypted connection from the user, processes the traffic (often as plain text internally), and optionally sends it to the backend. The profile responsible for this termination and the initial negotiation with the client ' s browser is the Client SSL Profile.

A custom Client SSL Profile must be created because the default clientssl profile typically allows a broad range of protocols for compatibility (including TLS 1.0, 1.1, and 1.2). To restrict communication specifically to TLS 1.2, the administrator modifies the Ciphers string within the profile. Using a string such as DEFAULT:!SSLv3:!TLSv1:!TLSv1.1 or specifically defining TLSv1.2-only suites ensures that the BIG-IP will reject any handshake attempts from older, less secure protocols.

Server SSL Profiles (Options B and C) are used for the encryption between the BIG-IP and the backend nodes, which is not what is requested here. Simply selecting " no TLSv1 " in an options list (Option D) is insufficient and often refers to older versions of the software; the modern and standard way to control protocol negotiation on a BIG-IP is through the precise application of Cipher Strings within the Client SSL profile. This ensures compliance with security standards like PCI-DSS while providing the offloading benefits to the backend infrastructure.

HTTP Compression on a BIG-IP system is an optimization feature that reduces the size of HTTP responses sent to clients, thereby saving bandwidth and improving page load times for end-users. To implement this functionality on a Virtual Server, the system requires two specific profiles to work in tandem: an HTTP profile and a Compression profile.

The HTTP profile (Option E) is a prerequisite because compression is an application-layer (Layer 7) operation. The BIG-IP must be " HTTP-aware " to parse the incoming requests and outgoing responses. The HTTP profile allows the BIG-IP to inspect the Accept-Encoding header from the client (to see if the client supports gzip or deflate) and to modify the Content-Encoding and Vary headers in the server ' s response. Without the HTTP profile, the Virtual Server operates at Layer 4 (TCP) and sees the traffic only as an opaque stream of bytes, making compression impossible.

The Compression profile (Option B) contains the actual settings and engine for the task. It defines which content types should be compressed (e.g., text/html, application/javascript), the compression level, and the minimum content length required before compression is applied. While a Stream profile (Option D) is used for data replacement (search and replace) and SSL profiles (Option C) are used for encryption, they do not provide compression logic. By applying both the HTTP and Compression profiles, the BIG-IP can successfully intercept server responses, compress the payload according to the configured policy, and deliver the optimized data to the user, effectively offloading the CPU-intensive compression work from the backend web servers.

In F5 BIG-IP systems, an iApp is a template-driven framework used to deploy and manage application-specific configurations. When an iApp is deployed, the system creates a specialized folder or " Application Service " container to hold all the resulting Local Traffic Manager (LTM) objects, such as virtual servers, pools, and profiles. This container is visually and programmatically identified by the .app extension in its path name.

The naming convention for these objects follows a specific hierarchical structure: / < partition > / < iapp_name > .app/ < object_name > . For example, if an administrator creates an iApp named " testhttp " in the " /Common " partition, the virtual server created by that iApp would be identified in the configuration (TMSH) and the GUI as /Common/testhttp.app/testhttp. This structure allows the BIG-IP system to distinguish between manually created objects and those managed by the iApp ' s automation logic.

This identification is crucial because iApp-managed objects typically have Strict Updates enabled, which prevents administrators from making direct manual changes to the object settings outside of the iApp ' s reconfigure interface. Attempting to modify such an object directly will result in an error message stating that the application service must be updated using an application management interface. By recognizing the .app path and the repeated name within the structure, an administrator can immediately identify that the object belongs to an iApp and should be managed through the iApp ' s specific management screen rather than standard LTM configuration menus.

In the BIG-IP object hierarchy, a Pool Member is a child object of a Node . A pool member represents a specific IP:Port combination, while the parent node represents the underlying server IP address. When a node is disabled , all pool members that are children of that node are rendered unavailable — regardless of the individual pool member ' s own health or enabled state.

The Network Map depicted shows the pool member (192.168.212.30:80) with its Parent Node (192.168.212.30) disabled. This parent-child dependency means that even if the pool member itself is healthy and enabled, the disabled node cascades its unavailable state downward, causing the pool to have no available members and rendering VS_HTTP unresponsive to incoming connections.

The other options can be eliminated as follows:

Pool member monitor failed — the monitor status is not indicated as failed in the Network Map display.

Pool member is disabled — the pool member itself is not shown as disabled; the parent node is.

Node monitor failed — no monitor failure is indicated; the node ' s administrative state is explicitly disabled.

Understanding the node-to-member inheritance of availability state is fundamental to accurate BIG-IP traffic troubleshooting.

SSH (Secure Shell) operates over TCP port 22 , making the TCP health monitor the appropriate and correct choice for monitoring pool members in an SSH pool. The TCP monitor establishes a basic Layer 4 connection to each pool member on the designated port, verifying that the server is reachable and actively accepting TCP connections. A successful three-way handshake confirms the pool member is available; a failure marks it down and removes it from load balancing rotation.

The remaining monitor types are inappropriate for this use case:

UDP monitor operates at Layer 4 but uses the connectionless UDP protocol, which is incompatible with SSH since SSH exclusively uses TCP as its transport.

HTTP monitor sends a Layer 7 GET request expecting an HTTP response — irrelevant for an SSH service that does not speak the HTTP protocol.

HTTPS monitor functions identically to HTTP but over TLS — again, completely misaligned with SSH traffic and port behaviour.

For application-specific SSH validation beyond basic TCP connectivity, an external monitor or custom monitor could be used; however, TCP remains the standard and correct built-in monitor for SSH pool verification within the BIG-IP platform.

In a BIG-IP environment, a Fallback Persistence Profile is utilized as a secondary " stickiness " mechanism when the primary (Default) persistence method fails to provide a valid persistence record. For example, if a Virtual Server uses HTTP Cookie Persistence as its primary method, but a client’s browser has cookies disabled, the BIG-IP will be unable to find a persistence cookie in the request. Without a fallback method, the system would treat every request from that client as a new, independent connection, potentially breaking the application session.

Source Address Affinity (also known as Source Address Persistence) is the most common and standard choice for a fallback profile. It operates at the network layer (Layer 3) by tracking the client’s source IP address. Because every IP packet contains a source address, this method is virtually guaranteed to work even when application-layer data (like Cookies or SSL Session IDs) is missing or encrypted beyond the BIG-IP ' s visibility. While Universal (Option A) and Hash (Option D) profiles are highly flexible and can use iRules to persist on almost any data, they require specific configuration and logic that may not always be present or valid. SSL persistence (Option C) relies on the SSL Session ID, which frequently changes due to modern browser security practices (session renegotiation), making it less reliable than Source Address Affinity. By configuring Source Address Affinity as the fallback, the administrator ensures that the BIG-IP has a " safety net " to maintain session integrity based on the client ' s IP address when the more granular cookie-based persistence is unavailable.

Slow Ramp Time prevents new members from being overwhelmed immediately after activation.

In a BIG-IP High Availability (HA) environment, most configuration objects (Virtual Servers, Pools, iRules) are considered " shared " and are synchronized automatically between devices. However, network-level objects—specifically VLANs and Self IPs—are unique to the hardware and are generally not synchronized by the ConfigSync process.

This is intentional because two devices in a cluster may have different physical cabling or interface assignments. For example, Cluster Member A might use interface 1.1 for a specific VLAN, while Cluster Member B might use interface 1.2. Because the BIG-IP system cannot assume that the physical network topology is identical for both appliances, the administrator must Configure the new VLAN manually on Cluster Member B.

Once the VLAN is created manually on both devices with the exact same name, it can then be used to host " shared " floating Self IP addresses or traffic groups that will synchronize. Failing to create the VLAN on the peer device will prevent the traffic group from failing over correctly, as the peer will not have the necessary Layer 2 broadcast domain defined to take over the traffic. Resetting Device Trust (Option D) is a drastic step for fix sync communication issues but will not change the fact that VLANs are non-syncable objects. Enabling the interface (Option B) only affects the link status of Member A and has no impact on the configuration of Member B.

In F5 BIG-IP architecture, a Trunk is a logical aggregation of physical interfaces designed to increase bandwidth and provide link redundancy through 802.3ad Link Aggregation Control Protocol (LACP). When creating a Trunk object within the BIG-IP configuration, the administrator must assign physical Interfaces to it — these are the underlying hardware ports (e.g., 1.1, 1.2, 1.3) that will be bundled together to form the aggregated logical link.

It is critical to understand the layered object hierarchy on the BIG-IP platform:

Interfaces → assigned to Trunks

Trunks (or individual Interfaces) → assigned to VLANs (as tagged or untagged members)

VLANs → assigned Self IP addresses

Self IPs / Routes → configured at the network layer above

VLANs are not added to a Trunk; rather, a Trunk is added as a member of a VLAN. IP addresses and network routes are configured independently at a higher abstraction layer and have no direct association with Trunk creation.

This layered design ensures proper separation of concerns across the data plane. Misunderstanding this hierarchy is a common configuration error that can result in traffic forwarding failures.

A red diamond indicates the Virtual Server is enabled but unavailable due to all pool members being down.

For HTTP-based applications, cookie persistence is the most appropriate and commonly recommended persistence method.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Cookie persistence inserts or uses an HTTP cookie to maintain session affinity.

It operates at Layer 7 (HTTP) and is application-aware.

It allows persistence to be maintained even when multiple clients are behind a NAT device.

Why the other options are incorrect:

A. Destination addressDestination address persistence is generally used for inbound traffic patterns such as firewall or proxy scenarios.

B. Hash persistenceHash persistence is less granular and not HTTP-specific.

C. SSL persistenceSSL persistence is typically used when SSL session IDs are reused and is less reliable than cookies for HTTP applications.

Correct Resolution:

Using cookie persistence ensures that HTTP web requests are consistently directed to the same pool member.