F5 F5CAB3 BIG-IP Administration Data Plane Configuration (F5CAB3) exam Exam Practice Test

This scenario describes a classic case of asymmetric routing in a " one-arm " or non-gateway deployment. When a BIG-IP system is configured for SSL offloading, the following traffic flow occurs:

Client-Side: The client establishes a successful SSL/TLS handshake with the Virtual Server. This explains why the user can " successfully establish an SSL connection. "

Server-Side: The BIG-IP decrypts the traffic and forwards it as plain HTTP to the backend server. The packet trace confirms the server receives the HTTP GET request and responds with the content.

The Routing Failure: By default, the BIG-IP system preserves the client ' s original source IP address. If the backend server ' s default gateway is not the BIG-IP system (or if the server is on the same subnet as the client), the server will attempt to send the response directly back to the client ' s IP address, bypassing the BIG-IP.

Stateful Drop: Because the BIG-IP is a Full Proxy, it expects the response to return through its own internal state table to be encrypted and sent back to the client. Since the response bypasses the BIG-IP, the BIG-IP connection eventually times out, and the client receives no data despite the server having sent it.

Solution (SNAT): Enabling Secure Network Address Translation (SNAT), specifically SNAT Auto Map, ensures that the BIG-IP replaces the client ' s source IP with its own internal self-IP before sending the request to the server. This forces the server to send the response back to the BIG-IP, allowing the BIG-IP to complete the transaction and deliver the content to the user.

The pool member list in the exhibit shows servers listening on four distinct service ports: 80 (HTTP), 21 (FTP), 443 (HTTPS), and 22 (SSH). To accurately monitor a pool where members provide different services, the administrator must apply monitors that correspond to each of those specific services.

The key to this configuration is the Availability Requirement (also known as " Monitor Rule " ). If the administrator sets the requirement to " All health monitors, " every single monitor (HTTP, HTTPS, FTP, and SSH) must pass for a member to be marked " Up. " This would cause an immediate failure: for example, a server listening only on port 80 would fail the HTTPS, FTP, and SSH checks, resulting in the member being marked " Down " even if the HTTP service is healthy.

To ensure accuracy, the administrator should apply all four relevant monitors and set the Availability Requirement to at least one monitor. With this setting, the BIG-IP marks a member as " Up " if any of the assigned monitors return a successful response. Therefore, the member at 10.200.50.210:80 will stay " Up " as long as the HTTP monitor passes, even though it fails the FTP, HTTPS, and SSH monitors. This configuration allows a single pool to contain diverse service types while ensuring that the specific port defined for each member is verified correctly. Option C is incorrect because ICMP only checks if the IP is alive, not if the specific service port is functioning.

Connection rate limiting controls how many new connections per second are accepted, protecting backend resources.

SNAT Automap is a common configuration that replaces the client ' s original source IP address with one of the BIG-IP ' s self IP addresses. This ensures that the backend servers send return traffic back through the BIG-IP, which is necessary for the ADC to process the traffic correctly. However, a side effect of SNAT is that the backend servers only see the BIG-IP ' s IP in their logs, losing visibility into the true identity of the client.

To resolve this while still using SNAT for routing purposes, the administrator must configure the BIG-IP to " pass " the client ' s IP address at the application layer. This is achieved by using an HTTP Profile with the Insert X-Forwarded-For setting enabled. When this profile is applied to the Virtual Server, the BIG-IP intercepts the HTTP request, adds a header (X-Forwarded-For) containing the client ' s original IP, and then forwards the modified request to the server. The backend web server can then be configured to read this header and log the original client IP instead of the BIG-IP ' s SNAT address.

Other options are incorrect for this requirement. Performance (HTTP) (Option A) is a virtual server type optimized for speed but often lacks the full Layer 7 header manipulation capabilities of a Standard Virtual Server. SNAT Pool with the client IP (Option C) is technically impossible as SNAT pools use static, pre-defined IPs. There is no such thing as an HTTP Transparent profile (Option D) in standard BIG-IP administration for this purpose. The X-Forwarded-For header insertion within the HTTP profile is the standard procedural method for maintaining client visibility in SNAT-enabled environments.

The requirement states that load balancing decisions must be based on the number of active connections on each pool member. This directly maps to the Least Connections (member) load balancing method.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Least Connections (member) selects the pool member with the fewest active connections at the time of the request.

This method dynamically adapts to real-time traffic patterns and ensures that more heavily loaded pool members receive fewer new connections.

It is especially effective for web servers where connection duration may vary and equal distribution of active sessions is desired.

Why the other options are incorrect:

B. Round RobinDistributes connections sequentially without considering current load or active connections.

C. Ratio (member)Distributes traffic based on static ratios, not real-time connection counts.

D. Ratio (node)Uses predefined ratios at the node level and does not account for active connection counts.

Correct Resolution:

Using Least Connections (member) ensures that new connections are directed to the pool member currently handling the fewest active connections, meeting the stated requirement.

When multiple users share one source IP, source-address persistence fails. Cookie persistence uniquely identifies users at Layer 7 and ensures correct session handling.

Connection rate limits restrict how many new connections are accepted per second, protecting application resources.

Standard DNS queries use UDP. Configuring the Virtual Server for TCP causes DNS traffic to fail.

By default, BIG-IP load balancing algorithms (such as Round Robin) distribute connections evenly across all available pool members. However, persistence profiles override normal load balancing decisions by forcing subsequent connections from a client to be sent to the same pool member.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Persistence creates a client-to-server mapping that is honored before load balancing algorithms are applied.

When persistence is enabled, BIG-IP may repeatedly select the same pool member even if others are available.

This directly alters load balancing behavior.

Why the other options are incorrect:

A. Adding a OneConnect profileOneConnect optimizes server-side TCP connections but does not change which pool member is selected.

B. Enabling SNAT automapSNAT affects source address translation, not pool member selection.

C. Enabling a fallback host in the HTTP profileA fallback host is only used when no pool members are available.

Correct Resolution:

Adding a persistence profile alters load balancing behavior by maintaining client affinity to a specific pool member.

To provide encrypted communication between users and a virtual server, the BIG-IP system acts as a transparent SSL/TLS proxy. The administrative configuration required for this is a Client SSL profile.

When multiple hostnames (FQDNs) are associated with a single IP address, the system must determine which SSL certificate to present to the client during the initial TLS handshake. This is achieved using an extension of the TLS protocol called Server Name Indication (SNI).

The configuration logic is as follows:

Profile Type: The Client SSL profile is responsible for terminating the SSL connection from the client (the user) to the BIG-IP system.

The Setting: Within the Client SSL profile (under the " Advanced " view), there is a field specifically called Server Name. By entering the specific hostname (e.g., www.example.com) in this field, the BIG-IP system can match the hostname requested by the client in the ClientHello message to the correct profile.

Implementation: The administrator typically creates multiple Client SSL profiles—one for each hostname—and assigns them all to the same virtual server. One of these profiles must be designated as the Default SSL Profile for SNI to handle requests where the client does not provide a hostname or provides one that does not match any specific profile.

By using the Client SSL profile and the Server Name setting, the BIG-IP system ensures that each user receives the correct certificate for the specific site they are trying to reach, even though all sites share a single virtual server IP.

When a pool contains servers with heterogeneous hardware capabilities (differing CPU, RAM, or connection limits), a static load balancing method like Round Robin is ineffective because it distributes requests equally, regardless of the server ' s capacity. To optimize traffic distribution for newer, more powerful servers, a dynamic or weighted method is required.

Weighted Least Connections (member): This is the ideal method for this scenario. It combines two factors:

Least Connections: It first checks the current active connection count to ensure traffic goes to the least busy server.

Weight (Ratio): It allows the administrator to assign a " Ratio " value to each pool member. Newer servers can be assigned a higher ratio (e.g., 3) while older servers are assigned a lower ratio (e.g., 1). The BIG-IP system uses these weights to disproportionately favor the newer servers even when connection counts are similar.

Why other options are incorrect:

Global Availability: This is primarily a GSLB (Global Server Load Balancing) or specific LTM priority group concept where traffic is sent to the first available member in a list until it fails, then moves to the next. It does not load balance based on capacity.

Round Robin: This passes each new connection request to the next server in line, treating the old and new servers exactly the same.

Least Connections (member): While this sends traffic to the server with the fewest active connections, it assumes all servers are equal. If an old server and a new server both have 10 connections, they are treated as equally capable of taking the 11th, which is not true in this scenario.

This question tests precise knowledge of both TMSH command syntax and BIG-IP object namespace hierarchy . Two critical distinctions must be correctly identified:

1. create vs. modify: Since the Trunk already exists and the administrator is adding interfaces to it, the correct verb is modify — not create . Using create on an existing object would either throw an error or attempt to overwrite the object entirely, neither of which is the desired outcome.

2. /sys vs. /net namespace: Trunk objects in BIG-IP reside within the /net namespace, which encompasses network-layer constructs including Trunks, VLANs, Self IPs, and Routes. The /sys namespace is reserved for system-level objects such as management settings, software, and licensing — it does not contain Trunk objects.

Therefore, the only syntactically and functionally correct command is:

tmsh modify /net trunk trunk_A interfaces add {1.3 1.4}

This command appends interfaces 1.3 and 1.4 to the existing trunk_A object without disrupting currently assigned interfaces, increasing aggregated bandwidth accordingly.

Options A and C use the incorrect /sys namespace, and options A and B incorrectly use the create verb for an existing object.

The X-Forwarded-For header preserves the original client IP when SNAT is enabled.

Slow Ramp Time prevents new members from being overwhelmed immediately after activation.

Performance (Layer 4) virtual servers rely on FastL4 profiles to provide high-speed L4 processing without full proxy overhead.

Below is BATCH 2 (next 10 questions) extracted only from your uploaded document that are clearly related to BIG-IP Administration: Data Plane Configuration topics.

❗As requested, I have strictly excluded questions related to:

Licensing

HA / Device Trust / Sync-only

Logging destinations

User roles

Hardware, EUD, support processes

System-only administration

Source: Your uploaded TMOS Administration v2.0 document

According to the provided exhibit, the " SSL Profile (Client) " section in the Virtual Server configuration is empty. For a BIG-IP system to process HTTPS traffic, it must act as an SSL/TLS endpoint. This process, known as SSL Termination or SSL Offload, requires the assignment of a Client SSL Profile to the Virtual Server. Without this profile, the BIG-IP does not have the necessary certificate and private key information to perform the SSL handshake with the client ' s browser. Consequently, when a user attempts to connect via HTTPS, the TCP connection may establish, but the SSL handshake will fail because the BIG-IP will not know how to decrypt the incoming encrypted packets.

A Client SSL profile defines the ciphers, certificates, and keys that the BIG-IP uses to communicate securely with the client. In a standard HTTPS deployment, the BIG-IP decrypts the traffic and can then send it to the backend pool members either as plain text (header insertion/manipulation) or re-encrypt it using a Server SSL profile. While a Server SSL profile (Option C) is needed if the backend servers themselves require HTTPS, the initial failure for a user reaching a Virtual Server is almost always the lack of a Client SSL profile to terminate the user ' s connection. Changing the Service Port to HTTP (Option D) would be incorrect because the goal is to handle HTTPS traffic (typically port 443). Assigning the " clientssl " or a custom client-side profile from the " Available " list to the " Selected " list in the GUI is the mandatory step to make the Virtual Server operational for secure web traffic.

Slow Ramp Time prevents new pool members from receiving full traffic immediately, avoiding overload.

X-Forwarded-For inserts the original client IP into HTTP headers while SNAT is enabled.

DNS traffic is primarily transported using UDP port 53. In the exhibit, the Virtual Server is configured with the Protocol set to TCP, which prevents standard DNS queries from being processed correctly. BIG-IP Virtual Servers must be configured with the correct Layer 4 protocol to match the application traffic they are handling.

According to the BIG-IP Administration: Data Plane Configuration documentation:

The Protocol setting on a Virtual Server defines whether traffic is processed as TCP, UDP, or another supported transport protocol.

Standard DNS queries and responses use UDP, while TCP is only required for DNS zone transfers (AXFR) or exceptionally large responses.

When a DNS Virtual Server is incorrectly configured with TCP, UDP-based DNS queries are dropped, causing all requests to fail.

Why the other options are incorrect:

A. Protocol profile (Client) to DNS_OPTIMIZEDA DNS profile enhances DNS functionality but does not correct an incorrect transport protocol configuration.

B. Type to Performance (HTTP)Performance (HTTP) Virtual Servers are designed for HTTP traffic and are not suitable for DNS services.

C. Source Address to 192.168.10.0/24The existing source IPs already fall within the allowed range, so this setting does not address the failure.

Correct Resolution:

Changing the Protocol to UDP aligns the Virtual Server with standard DNS transport requirements, allowing DNS queries to be successfully processed and load-balanced.

When a single IP address (Virtual Server) must host multiple hostnames (e.g., site1.com, site2.com) over HTTPS, the BIG-IP must be able to present the correct SSL certificate for each site during the initial handshake. This requirement is handled by a technology called Server Name Indication (SNI).

To implement this on the BIG-IP, the administrator must use a Client SSL profile because the encryption is occurring between the user (Client) and the Virtual Server. Within the Client SSL profile settings, there is a field called Server Name. By creating multiple Client SSL profiles—each with a different " Server Name " (the hostname) and its corresponding certificate—and attaching them all to the same Virtual Server, the BIG-IP can inspect the SNI extension in the client ' s " Client Hello " packet. It then selects the specific profile that matches the requested hostname.

Option A is incorrect because " Client Name " is not the standard field name used for SNI hostname matching in the profile. Options B and C refer to Server SSL profiles, which manage the connection between the BIG-IP and the backend servers. While Server SSL profiles also have a " Server Name " field (used to send SNI to a backend server), the requirement here is to provide encrypted communication for " users " accessing the virtual server, which definitively requires a Client-side SSL configuration.

Similar to the logic required for managing multi-service backend environments, the issue described—where servers hosting multiple protocols like FTP and HTTP are experiencing uneven distribution—stems from the BIG-IP ' s default behavior of treating each pool independently. If the administrator uses a member-based load balancing method, the BIG-IP distributes HTTP traffic regardless of how much FTP traffic that same physical server is currently processing.

To resolve this, the administrator must utilize the Least Connections (Node) method. By switching both the HTTP and FTP pools to this algorithm, the BIG-IP begins to make load balancing decisions based on the total combined connection count for the IP address of each server. When a new HTTP request arrives, the BIG-IP checks which server has the fewest total connections (including existing FTP sessions). This prevents a server that is already busy with long-lived FTP transfers from being overwhelmed by a sudden burst of HTTP requests.

Ratio methods (Options A and C) are static and rely on the administrator manually assigning weights to servers based on their perceived capacity; they do not adapt to real-time fluctuations in traffic volume across different pools. Least Connections (Member) (Option B) remains blind to the " cross-pool " traffic on the same hardware. Only the Node-based Least Connections approach provides the global visibility necessary to " even out " the total resource utilization across servers supporting multiple distinct applications.

When dealing with heterogeneous server hardware where some servers are more powerful than others, a dynamic load balancing method that accounts for both current load and server capacity is required. The Weighted Least Connections (member) method is the most appropriate choice. This method works by tracking the number of active connections to each pool member and then " weighting " that number based on a user-defined Ratio value assigned to the member. For example, the administrator can assign a higher Ratio to the three newer, more powerful servers and a lower Ratio to the two older servers. The BIG-IP then uses a formula to calculate which server should receive the next connection, ensuring that the newer servers handle a proportionately larger share of the total concurrent connections.

Standard Round Robin (Option C) would be ineffective because it distributes connections strictly sequentially (1, 2, 3, 4, 5) without regard for the servers ' capacity or current load, which would eventually overwhelm the older servers. Least Connections (member) (Option D) is better than Round Robin because it picks the server with the fewest active connections, but it still assumes all servers are equal; it would try to keep the connection counts identical across all 5 servers, which would still stress the older hardware more than the new. Global Availability (Option B) is a GSLB (DNS-based) method used for multi-site redundancy, not for local pool member load balancing. By using Weighted Least Connections, the administrator achieves a balance where the more capable servers take the brunt of the work while the older servers are utilized only to their specific safe capacity.

A Performance (Layer 4) virtual server does not inspect or process application-layer data such as HTTP headers or cookies. Therefore, only Layer 4–compatible persistence methods can be used.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Source Address Affinity persistence operates at Layer 4 and uses the client IP address to maintain session persistence.

It is fully compatible with Performance (Layer 4) virtual servers.

It works regardless of encryption, making it suitable for TLS-secured applications.

Why the other options are incorrect:

B. Cookie persistenceRequires an HTTP profile and Layer 7 inspection, which is not supported on Performance virtual servers.

C. Microsoft RDP persistenceIs protocol-specific and not applicable to web-based TLS traffic.

D. Host persistenceRequires HTTP host header inspection, which is not available at Layer 4.

Correct Resolution:

Source Address Affinity persistence is the appropriate choice for maintaining persistence on a Performance (Layer 4) virtual server handling TLS traffic.

Below is Batch 1 (Questions 1–10) extracted only from your uploaded document that are directly related to BIG-IP Administration: Data Plane Configuration topics (Virtual Servers, Pools, Load Balancing, Monitors, Persistence, SNAT, Profiles).

I have excluded system-only, licensing, support, hardware, HA management-only, and admin UI questions that are not Data Plane–focused.

Source: Your uploaded TMOS Administration v2.0 document

✅ BATCH 1 (10 Questions)

This scenario describes a classic routing issue often encountered during SSL offload deployments. The fact that an SSL connection is established indicates the Client SSL profile is working correctly. The packet trace showing the server " receives and responds " to the request is the most critical diagnostic clue.

When a BIG-IP receives traffic, it typically passes the client ' s original source IP address to the backend server. If the backend server ' s default gateway is not the BIG-IP (a common " one-arm " network topology), the server will attempt to send its response directly back to the client ' s IP via its own default router. The client ' s browser will reject this response because it expects traffic to come from the Virtual Server ' s IP, not the backend server ' s IP.

To resolve this, the administrator must enable SNAT (Source Address Translation), typically using SNAT Automap. When SNAT is enabled, the BIG-IP replaces the client ' s original source IP with one of its own Self IPs before forwarding the request to the server. Because the source of the packet is now the BIG-IP, the backend server is forced to send its response back to the BIG-IP. The BIG-IP then receives the response, translates it back, and delivers the content to the user. Option A is unnecessary if the servers are expecting plain-text traffic after the BIG-IP performs offload. Option D would only worsen the existing routing discrepancy.