F5 F5CAB3 BIG-IP Administration Data Plane Configuration (F5CAB3) exam Exam Practice Test

In F5 BIG-IP administration, iApps are designed to manage complex application configurations as a single unit. When an iApp is deployed, it creates an "Application Service" object that owns all the associated LTM objects, such as Virtual Servers, Pools, and Nodes. By default, these iApps are created with Strict Updates enabled. Strict Updates is a safety mechanism that prevents administrators from making manual "out-of-band" changes to the individual objects created by the iApp. The system enforces this because manual changes would be overwritten the next time the iApp template is updated or re-entered.

When the administrator attempts to change the destination IP address directly on the Virtual Server object, the BIG-IP system checks the "Strict Updates" flag. If it is set to "Enabled," the system blocks the modification and generates the error message stating the service must be updated via the application management interface. To resolve this, the administrator must navigate to the iApp >> Application Services menu, select the specific application service, and go to the "Reconfigure" tab. Within the iApp configuration form, the destination IP can be safely changed. Alternatively, if the administrator specifically wants to manage the objects manually and forgo the benefits of the iApp template management, they could disable "Strict Updates" in the iApp properties, though this is generally discouraged as it breaks the template's logic. The error is not related to subnetting or duplicate IPs, but strictly to the configuration authority assigned to the iApp service.

URI-based traffic steering requires inspection of the HTTP request. BIG-IP processes HTTP headers and URIs in the HTTP_REQUEST event. Pool member selection based on URI must occur before the request is sent to the server, making HTTP_REQUEST the correct event.

The exhibit shows the advanced configuration of a VLAN where the Fail-safe option is checked. VLAN Fail-safe is a high-availability feature used to monitor network connectivity on a specific VLAN. When enabled, the BIG-IP system monitors the VLAN for network traffic. If the system does not detect any "useful" traffic on the VLAN within the specified Fail-safe Timeout (which is 90 seconds in the exhibit), it attempts to generate traffic by pinging the default gateway or other devices. If it still detects no traffic, the BIG-IP concludes that the VLAN is unreachable or the network interface has failed, and it triggers a "Fail-safe Action"—in this case, "Reboot" or a failover to the peer device in the HA group.

Because the administrator has just created a new VLAN that "does NOT yet have any traffic," the Fail-safe mechanism triggers immediately after the 90-second timeout period. Since no devices are yet communicating on this VLAN, the BIG-IP incorrectly assumes there is a hardware or cabling failure and forces a failover to ensure the standby device (which might have better connectivity) takes over. To prevent this unwanted failover, the administrator should uncheck the Fail-safe box for that specific VLAN until the VLAN is fully populated with active nodes and regular traffic. Once the application is live and traffic is flowing, Fail-safe can be re-enabled to provide an additional layer of redundancy. Auto Last Hop (Option A) and Source Check (Option B) are routing and security features that do not trigger HA failover events.

To solve this requirement, we must distinguish between the two "legs" of an SSL connection in a BIG-IP environment: Client-side and Server-side.

Current State (SSL Bridging): The administrator states the servers currently require encrypted traffic. This means the BIG-IP is likely performing "SSL Bridging." In this setup, a Client SSL profile terminates encryption from the user, and a Server SSL profile re-encrypts the traffic before sending it to the back-end servers.

Target State (SSL Offloading): The requirement is to "offload SSL" to reduce web server load. This means the BIG-IP will continue to handle the encryption for the users (keeping the Client SSL profile) but will communicate with the back-end servers using unencrypted HTTP.

Why Option A is correct:

Remove the Server SSL profile: By removing this profile, the BIG-IP stops attempting to initiate an SSL/TLS handshake with the pool members.

Configure Pool Members to use HTTP: The service port for the pool members must be changed (typically from port 443 to port 80) so that the BIG-IP sends standard HTTP traffic to the servers.

Why other options are incorrect:

B & D: These suggest removing the Client SSL profile. If you remove this, the users can no longer connect via HTTPS, which violates the requirement for encrypted communication between the users and the BIG-IP.

C: Changing the Virtual Server to accept HTTP traffic would mean the user-to-BIG-IP connection is no longer encrypted, which is the opposite of SSL termination/offloading.

Persistence overrides load balancing decisions by maintaining client-to-server affinity.

Slow Ramp Time prevents new pool members from receiving a full share of traffic immediately, allowing applications to warm up gradually.

In this scenario, each backend node (server) hosts multiple services and is referenced by multiple pools and virtual servers. The goal is to ensure an equal number of total connections per backend server, regardless of how many pool members (services/ports) exist on that server.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Least Connections (node) tracks the total number of active connections to a node across all pool members and services.

This algorithm ensures load distribution is balanced at the server level, not just at the individual service (member) level.

It is specifically recommended when:

Multiple pool members exist on the same backend server

Multiple virtual servers reference the same backend servers

Why the other options are incorrect:

B. Predictive (member)Predictive algorithms are advanced and traffic-pattern based, but they operate at the member level and do not guarantee equal connections per server.

C. Least Connections (member)This balances connections per pool member, which can overload a server hosting multiple members while still appearing “balanced” per member.

D. Predictive (node)Although node-aware, predictive algorithms are less deterministic and not the best choice when strict equality of connections is required.

Correct Resolution:

Using Least Connections (node) ensures that each backend server carries an equal connection load across all services and pools.

Fallback persistence is used when the primary persistence method fails. Source Address Affinity is a Layer 4 persistence method and is fully supported as a fallback option for most virtual server types.

Forwarding (IP) virtual servers forward traffic based on routing decisions and do not use pools or pool members.

The X-Forwarded-For header preserves the original client IP when SNAT is enabled.

Connection rate limiting controls how many new connections per second are accepted, protecting backend resources.

HTTP Compression on a BIG-IP system is an optimization feature that reduces the size of HTTP responses sent to clients, thereby saving bandwidth and improving page load times for end-users. To implement this functionality on a Virtual Server, the system requires two specific profiles to work in tandem: an HTTP profile and a Compression profile.

The HTTP profile (Option E) is a prerequisite because compression is an application-layer (Layer 7) operation. The BIG-IP must be "HTTP-aware" to parse the incoming requests and outgoing responses. The HTTP profile allows the BIG-IP to inspect the Accept-Encoding header from the client (to see if the client supports gzip or deflate) and to modify the Content-Encoding and Vary headers in the server's response. Without the HTTP profile, the Virtual Server operates at Layer 4 (TCP) and sees the traffic only as an opaque stream of bytes, making compression impossible.

The Compression profile (Option B) contains the actual settings and engine for the task. It defines which content types should be compressed (e.g., text/html, application/javascript), the compression level, and the minimum content length required before compression is applied. While a Stream profile (Option D) is used for data replacement (search and replace) and SSL profiles (Option C) are used for encryption, they do not provide compression logic. By applying both the HTTP and Compression profiles, the BIG-IP can successfully intercept server responses, compress the payload according to the configured policy, and deliver the optimized data to the user, effectively offloading the CPU-intensive compression work from the backend web servers.

The issue of "lost shopping carts" in an ecommerce environment is a classic symptom of a missing or improperly configured Persistence Profile. In modern web applications, session data—such as items added to a cart—is often stored locally on the specific web server that initially handled the user's request. If the BIG-IP system load balances a user's subsequent request (like clicking "Checkout") to a different server among the 50 webservers, the new server will not have the session data, and the user will appear to have an empty cart.

While Least Connections (node) is an efficient load balancing algorithm, it makes a new decision for every connection unless persistence is enabled. To resolve this, the administrator must implement a persistence mechanism. HTTP Cookie Persistence (Option A) is the industry standard for web applications. By assigning a cookie persistence profile to the Virtual Server, the BIG-IP inserts a unique cookie into the HTTP response. When the user's browser returns that cookie in future requests, the BIG-IP identifies the specific server that handled the first request and consistently directs the user back to that same server for the duration of their session.

Sip_info (Option B) is a persistence method for VOIP traffic and is not applicable to web traffic. Ratio load balancing (Options C and D) merely changes the distribution frequency but still does not guarantee that a specific user will stay on the same server across multiple requests. Therefore, adding a cookie persistence profile is the direct procedural fix to maintain session state and ensure ecommerce functionality.

When multiple users share one source IP, source-address persistence fails. Cookie persistence uniquely identifies users at Layer 7 and ensures correct session handling.

Standard DNS queries use UDP. Configuring the Virtual Server for TCP causes DNS traffic to fail.

An F5 iApp is a template-driven system used to deploy complex applications by grouping all necessary BIG-IP objects (Virtual Servers, Pools, Profiles) into a single management entity. Objects created by an iApp are distinguished by their naming convention and metadata. In the provided exhibit, the Virtual Server configuration in Option A is clearly identified as an iApp-managed object through two primary indicators. First, the object resides within a sub-directory or partition ending in .app (/Common/vmware_test.app/). Second, the configuration explicitly includes the attribute app-service /Common/vmware_test.app/vmware_test, which serves as the system's internal pointer linking the LTM object back to the parent iApp Application Service. Furthermore, several profiles associated with this virtual server also reside within the same .app container, such as /Common/vmware_test.app/vmware_test_http.

In contrast, Options B, C, and D represent standard, manually created Virtual Servers. While they may have complex configurations (such as the APM profiles in app2_vs and app1_vs), they lack the folder-based naming hierarchy and the app-service metadata attribute that denotes iApp ownership. Standard objects like app1_vs are managed individually, whereas the objects within vmware_test.app are typically protected by "Strict Updates." This means their configuration is controlled by the iApp's template logic; any manual attempt to modify these specific parameters directly via the Virtual Server menu would result in an error message stating the service must be updated via the application management interface. Identifying these objects is a critical procedural step for administrators to determine whether a configuration should be edited through the standard LTM menus or through the iApp's "Reconfigure" tab to ensure consistency and prevent manual changes from being overwritten by the template.

In a default BIG-IP configuration, the system utilizes the Load Balancing Method (typically Round Robin) to distribute each new connection across available pool members. However, the introduction of a persistence profile fundamentally changes this behavior. Persistence (also known as "stickiness") ensures that once a client has been load balanced to a specific pool member, all subsequent requests from that same client during a defined session or timeout period are directed to that same member, bypassing the standard load balancing algorithm. This is critical for applications that maintain state, such as shopping carts or authenticated sessions, where moving a user to a different server would result in a loss of session data.

While other options affect traffic handling, they do not "alter" the fundamental load balancing decision in the same way. A OneConnect profile (Option A) optimizes connection management by pooling idle server-side connections; while it changes how connections are reused, the initial load balancing decision still follows the configured method. A fallback host (Option C) is only utilized when the primary pool is unavailable, and since the question states all pool members are online, it remains inactive. SNAT Automap (Option D) changes the source IP address of the packet as it exits the BIG-IP toward the server to ensure return traffic passes back through the ADC, but it does not dictate which server is chosen for the request. Therefore, the persistence profile is the primary configuration element that overrides the load balancing algorithm to maintain a client-to-server relationship.

This scenario requires unequal load distribution based on server capacity. The newer servers must receive more connections than the older ones, while still dynamically accounting for active connection counts.

According to BIG-IP Administration: Data Plane Configuration documentation:

Weighted Least Connections (member) combines:

Connection awareness (least connections)

Administrator-defined weights (ratios) to reflect server capacity

Pool members with higher weights receive proportionally more new connections than members with lower weights, even when using the same load balancing algorithm.

Why B is correct:

Allows assigning higher weights to newer servers and lower weights to older servers

Ensures smarter traffic distribution based on both capacity and real-time load

Why the other options are incorrect:

A. Global AvailabilityUsed for disaster recovery and site failover, not intra-pool load distribution.

C. Round RobinDistributes connections evenly without considering server capacity.

D. Least Connections (member)Balances only by current connection count and does not account for differences in server performance or capacity.

Correct Resolution:

Use Weighted Least Connections (member) and assign higher weights to newer servers so they receive more traffic while protecting older servers from overload.

The BIG-IP system uses a centralized management framework to ensure that all devices within a Sync-Failover group share a consistent configuration. When an administrator makes a change on any member of the group—whether it is the active or the standby device—the system detects a "ConfigSync" mismatch. The "Device Management >> Overview" screen tracks these changes by comparing the commit ID and timestamps of the configurations across all peers.

If a change is made on the standby member, that device now possesses a more recent configuration than the other members of the group. Consequently, the BIG-IP GUI will display a status of "Changes Pending" and suggest a Recommended Action to resolve the discrepancy. In this scenario, the correct action is to Synchronize the standby member configuration to the group. This push operation will copy the updated configuration from the standby device to the active device (and any other peers), bringing the entire cluster back into a "In Sync" status. It is important to note that BIG-IP allows bi-directional synchronization; you do not have to be on the active device to push a configuration. However, administrators must be cautious: choosing Option C (Synchronizing the active member to the group) would overwrite the changes just made on the standby device with the older configuration from the active device, effectively reverting the changes. The Recommended Action always points toward the direction that propagates the most recent change to the rest of the group.

This question addresses the critical architectural distinction between "member-based" and "node-based" load balancing in environments where servers are multi-homed or host multiple virtualized services. On a BIG-IP, a node represents the underlying IP address of a physical or virtual server, while a pool member represents a specific combination of that IP and a service port (e.g., 10.1.1.10:80).

When multiple pools reference the same IP address across different ports or Virtual Servers, using Least Connections (member) (Option D) only balances connections relative to that specific pool. For example, if Pool_A and Pool_B both use Server_X, and Pool_A has 100 connections while Pool_B has only 5, a member-based algorithm for Pool_B only sees the 5 connections and may continue to send traffic there even if Server_X is CPU-saturated by Pool_A.

The Least Connections (node) algorithm (Option B) solves this by tracking the aggregate total of all active connections directed to that specific node (IP address) across every pool on the system. By selecting the node with the absolute lowest total connection count, the BIG-IP ensures a more equitable distribution of work at the hardware resource level. Predictive methods (Options A and C) use a ranking system based on the trend of connection counts over time, but for the specific requirement of maintaining an equal number of current connections on multi-service servers, the direct Least Connections (node) calculation is the standard and most effective procedural choice.

BIG-IP provides several built-in TCP profiles optimized for different traffic patterns and network conditions. When attempting to improve general TCP performance, the recommended starting point is f5-tcp-progressive.

According to the BIG-IP Administration: Data Plane Configuration documentation:

f5-tcp-progressive is designed as a balanced, general-purpose TCP optimization profile.

It dynamically adjusts TCP behavior to improve throughput and latency for most enterprise applications.

It is the recommended first-choice profile when tuning TCP performance before moving to more specialized profiles.

Why the other options are incorrect:

A. f5-tcp-legacyThis profile exists for backward compatibility and does not include modern TCP optimizations.

C. f5-tcp-mobileThis profile is optimized specifically for high-latency, lossy mobile networks and is not suitable for general-purpose environments.

D. No optionBIG-IP explicitly provides built-in TCP profiles for performance tuning; using none would forgo optimization opportunities.

Correct Resolution:

The administrator should first apply f5-tcp-progressive to evaluate potential TCP performance improvements before considering more specialized profiles.

When many users share one source IP, source-address persistence fails. Cookie persistence uniquely identifies clients at Layer 7.