F5 F5CAB5 BIG-IP Administration Support and Troubleshooting (F5CAB5) exam Exam Practice Test

To verify the specific health and availability status of individual members within a specific pool, the administrator must navigate to the Members tab of that specific pool.

Navigation Path: The correct path is Local Traffic > Pools > Pool List, then clicking on the name of the <pool_in_question>, and finally selecting the Members tab. This screen provides a granular view of each member's IP address, port, and their current status (indicated by the colored icons: Green, Red, Yellow, or Blue).

Why Option A is correct: While you can see a general status summary on the Pool List page (Option B), that page only shows the status of the pool as a whole. To troubleshoot why a pool is not working or to see which specific member is down, you must drill down into the Members tab.

Evaluation of Other Options:

Local Traffic —> Pools (Option B): This leads to the Pool List. It shows the aggregate status of all pools but does not list individual member details or their specific monitor results without further clicking.

Local Traffic —> Virtual Servers —> Statistics (Option C): This path shows traffic statistics (bits in/out, connections) for virtual servers, not the health monitor status of individual pool members.

Local Traffic —> Nodes (Option D): While this shows the health of the underlying IP address (Node), it does not show the status of the specific service (Port/Member) within a pool. A Node might be "Up" (ICMP), while the Pool Member is "Down" (HTTP failure).

The pool member is markedDOWNbecause it is monitored bymultiple health monitors, specifically anHTTPmonitor and anHTTP/2monitor. The status message clearly shows that theHTTP monitor is UP, while theHTTP/2 monitor is DOWN. In BIG-IP, when multiple monitors are assigned to a pool member, the default behavior isAND logic, meaningall assigned monitors must succeedfor the pool member to be considered healthy.

In this scenario, the server is responding successfully to standard HTTP (likely HTTP/1.1) requests but does not support or respond correctly to HTTP/2 requests. As a result, the HTTP/2 monitor fails, which causes the overall monitor status to beDOWN, even though HTTP traffic itself is working.

This behavior is expected and documented in BIG-IP monitoring logic. Unless the monitor rule is explicitly changed to“at least one of”, a single failing monitor will mark the pool member down. Therefore, the correct conclusion is that the pool member isonly serving HTTP traffic, not HTTP/2.

The resolution would be to either remove the HTTP/2 monitor, correct the application to support HTTP/2, or adjust the monitor rule to match the intended health-check logic.

Comprehensive and Detailed 150 to 250 Words Explanation From BIG-IP Administration, Support, and Troubleshooting Documents:

These log messages indicate that the BIG-IP system’sTraffic Management Microkernel (TMM)has enteredaggressive eviction modedue tohigh global memory utilization. When TMM memory consumption reaches critical thresholds, BIG-IP activates thedefault eviction policyto protect system stability and prevent a full traffic processing failure. This condition directly corresponds toOption A, where the global eviction policy is triggered because TMM memory resources are nearing exhaustion.

Once aggressive mode is activated, BIG-IP begins using theconnection sweeper mechanism, which selectively terminates existing connections to free memory. The repeated log entries stating“1 connections killed”confirm that the system isreaping some connections, not all connections. This behavior matchesOption C. The eviction process is incremental and controlled, targeting idle, low-priority, or least-recently-used connections first to minimize impact on active traffic.

Option B is incorrect because BIG-IP doesnotdrop all connections during aggressive mode; it only removes enough connections to relieve memory pressure. Option D is also incorrect because TMM eviction is based onTMM global memory usage, not swap memory utilization. TMM does not rely on swap space in the same way the host Linux system does.

These messages are a critical warning sign that the system is under memory stress and may require traffic optimization, connection limits, or hardware scaling.

Comprehensive and Detailed Explanation From BIG-IP Administration S73upport and Troubleshooting documents: Persistence is critical for ensuring that a client's session remains with the same pool member throughout its duration. If primary persistence (like Cookie Persistence) fails—for instance, because the client has disabled cookies—load balancing will not work as expected, and the session may be broken. A "Fallback Persistence Profile" provides a backup method75. The most common and reliable fallback method is "Source Address Affinity"76. This method tracks the client's IP address in the BIG-IP's persistence table and ensures that any subsequent requests from that IP are routed to the same pool member, even if the primary persistence token is missing. Troubleshooting session drops often involves checking if a fallback method is configured to handle scenarios where the primary method is unsupported by the client's browser or environment. Without a fallback, the BIG-IP would revert to standard load balancing, potentially sending the client to a different server that lacks their session data.

In an HTTPS session, the application-layer payload—including HTTP request headers, response headers, cookies, and body content—is encrypted using SSL/TLS. Without decrypting the traffic (for example, without SSL offloading on BIG-IP or access to the private keys), a packet capture cannot reveal any HTTP-level details.

However,network-layer and transport-layer information remains visible, even when encryption is used. This includes source and destination IP addresses, source and destination ports, TCP flags, sequence numbers, and TLS handshake metadata. Therefore, thesource IP address (Option B)is visible in a packet capture of HTTPS traffic without decryption.

Options A, C, and D are incorrect because HTTP headers and cookies are part of the encrypted payload once HTTPS is established. BIG-IP troubleshooting documentation emphasizes this distinction when analyzing encrypted traffic flows using tcpdump, as administrators must rely on IP, port, and timing information unless SSL inspection or decryption is configured.

When a BIG-IP system experiences high overall CPU usage, troubleshooting requires identifying which specific application or service is the primary consumer of resources. While the system-wide performance graphs provide a global view, the granular data necessary to isolate a "top talker" is found in the "Local Traffic" statistics. Navigating to Statistics > Module Statistics > Local Traffic > Virtual Servers allows the administrator to see specific metrics for each configured virtual server, including the number of packets processed, current connections, and critical CPU cycles consumed. This is essential for troubleshooting performance issues where an inefficient iRule, high SSL handshake volume, or complex L7 profiles (like Compression or ASM) might be overtaxing the Traffic Management Microkernel (TMM) for one specific application. By reviewing these basic stats, an administrator can determine if a performance bottle-neck is a system-wide h1ardware issue or if it is isolated to a single virtual server, enabling targeted remediation such as optimizing iRule logic or moving the high-load virtual server to a dedicated device.

The "Manual Resume" feature is a safety mechanism used when a pool is not working as expected due to flapping services or unstable backend applications. Normally, when a health monitor fails, the pool member is marked "Offline" (Red), and when the monitor passes, it automatically returns to "Available" (Green)47. However, if "Manual Resume" is enabled, the BIG-IP will not automatically put the member back into rotation after a failure48. Even if the health check begins to pass again, the member remains in an "Offline (Disabled)" state49. This requires an administrator to manually intervene and re-enable the member. This is a common point of confusion when troubleshooting; a member may show passing health checks but still not receive traffic because it is waiting for a manual administrative "resume" command. This feature is intended to prevent "unhealthy" servers from receiving traffic until an engineer has confirmed the root cause of the initial failure was resolved.

When load balancing is not working as 23expected and connections appear skewed across physical hardware, the administrator must distinguish between "member"24 and "node" level balancing. A "member" refers to a specific IP and Port combination (e.g., 10.1.1.1:80), whereas a "node" refers to the underlying IP address (10.1.1.1) regardless of the port25. If a single server hosts multiple services (Web, FTP, API) across different pools, using "Least Connections (member)" would only balance connections within each individual pool26. This could lead to a scenario where one server is overwhelmed because it is winning the "least connections" count in three different pools simultaneously. By selecting "Least Connections (node)," the BIG-IP tracks the total number of concurrent connections to the physical IP address across all pools it belongs to27. This ensures that the administrator can maintain an equal distribution of work across the hardware, preventing performance degradation on backend servers that host multiple application services.

The failure to connect is caused by a restrictive Source Address filter configured on the Virtual Server.

Source Address Filtering: In the BIG-IP system, the Source Address field on a Virtual Server acts as an implicit Access Control List (ACL). Only traffic originating from a client IP address that matches the specified network range will be accepted and processed by the Virtual Server.

Analyzing the Exhibit: The provided configuration for vs_http shows the Source Address is set to 10.128.10.0/24. This means the Virtual Server will only accept connections from the subnet ranging from 10.128.10.1 to 10.128.10.254.

Identifying the Conflict: The user trying to connect has the IP address 192.168.162.70. Since 192.168.162.70 does not fall within the allowed 10.128.10.0/24 range, the BIG-IP system will not match this traffic to the Virtual Server, effectively blocking the connection attempt.

Evaluation of Other Options:

All Ports (Option A): Configuring a Virtual Server for "All Ports" (port 0) allows it to handle traffic for any destination port, which would not block a standard HTTP application.

Destination Address (Option B): The destination address 192.168.162.80 is the Virtual IP (VIP) users should be connecting to; this is a standard configuration and not the cause of the failure for a user reaching out to it.

Standard Type (Option C): A "Standard" Virtual Server is the most common type used for HTTP applications as it allows for Layer 7 profiles and full proxy capabilities.

Troubleshooting SSL connection resets often involves verifying license limits against actual resource utilization. F5 devices use a "Transactions Per Second" (TPS) license to control the amount of SSL processing the device can handle. The log entry SSL transaction (TPS) rate limit reached is a clear indicator that the traffic volume has exceeded the licensed capacity. When determining the necessary license level, it is important to know that F5 primarily licenses and limits the "Client-side" SSL TPS—which represents the encrypted connections between the users and the virtual servers. In this specific scenario, the peak demand reached 1200 client-side transactions per second. Although there were also 800 server-side transactions (re-encryption from the BIG-IP to the pool), these typically do not count against the primary TPS license limit in the same manner. Therefore, to ensure that the virtual server works as expected during peak load, the administrator must upgrade the license to at least 1200 TPS. This troubleshooting process links system log errors to license-enforced resource constraints.

In complex network environments, "SNAT Automap" is frequently used to ensure that backend servers send return traffic through the BIG-IP. However, SNAT hides the original client's IP address, replacing it with the BIG-IP's self-IP. When interpreting traffic flow for security or logging purposes, backend servers often need that original IP. To resolve this without breaking the network-layer routing provided by SNAT, the administrator should apply an HTTP profile to the virtual server and enable the "Insert X-Forwarded-For" option. When this is enabled, the BIG-IP inserts a standard HTTP header containing the client's original IP address before forwarding the request to the pool member. This troubleshooting method allows the backend application to log the actual user's identity while maintaining a functional L3/L4 traffic flow where the server responds to the BIG-IP's local address. This is a standard troubleshooting solution for "web server not working as expected" scenarios where applica8tion logic depends on knowing the geography or specific identity of the connecting user.

Monitoring granular resource utilization is essential when troubleshooting performance degradation for specific applications. While global system stats show overall hardware health, they do not pinpoint which virtual server is overconsuming resources during traffic spikes. To identify the specific application causing a high CPU load, the administrator should navigate to Statistics > Module Statistics > Local Traffic > Virtual Servers7474. This section provides detailed metrics for each virtual server, including CPU cycles used for traffic processing and iRule execution75. Identifying a "top-talker" or a problematic virtual server allows the administrator to take targeted action, such as optimizing an inefficient iRule, adjusting compression levels, or offloading the virtual server to a different device group76. This targeted troubleshooting ensures that one high-demand virtual server does not negatively impact the performance of other services running on the same BIG-IP hardware, maintaining overall system stability and resource availability

BIG-IP status icons provide immediate visual feedback regarding the state of an object based on its availability and enabled/disabled status.

Color (Black): The color black indicates that an object has been manually Disabled by an administrator.

Shape (Circle): The circular shape indicates that the object is Available (i.e., its health monitors are passing).

Scenario Result: Since the virtual server is manually disabled (Black) but its associated pool has a working health monitor that is currently passing (Circle), the resulting icon is a Black Circle.

When a virtual server is not working as expected despite the pool members being marked "UP" (Green), the issue is frequently a return-path routing failure. If the BIG-IP forwards a request with the original client's source IP address, the backend server will try to respond directly to that client. If the server does not have its default gateway pointed back to the BIG-IP, the response packet will be routed elsewhere (or dropped), resulting in a connection timeout for the user. To resolve this, the administrator must configure "Source Address Translation" (SNAT). By setting SNAT to "Automap" or a specific SNAT address, the BIG-IP replaces the client's IP with its own internal self-IP. The backend server then sees the BIG-IP as the source and sends the response back to it locally. This troubleshooting step ensures a functional, symmetric tr18affic flow. Identifying the need for SNAT is one of the most common troubleshooting tasks for new virtual server deployments where the BIG-IP is not the default gateway for the backend servers.

In the BIG-IP Configuration Utility, the status icon (shape and color) provides immediate feedback on why a virtual server is not working as expected81. A "Red Diamond" indicates that the object is "Offline" and unavailable to process traffic82. For a virtual server, this specific status typically means it has inherited an offline state from its mandatory backend resources8383. If all pool members associated with the virtual server have failed their health monitors, the virtual server will transition to a red diamond status because it has no healthy destination for incoming requests. This is distinct from a "Black Circle," which would indicate the virtual server has been manually "Disabled" by an administrator85858585. To troubleshoot a red diamond, the administrator must examine the associated pool and its members to determine why the health monitors are failing (e.g., server crashes, network path failures, or incorrect monitor strings). Resolving the health check failures on the pool members will return the virtual server to an "Available" (Green) status.

F5 BIG-IP provides two distinct ways to throttle traffic on a Virtual Server: total capacity and velocity.

Connection Rate Limit: This setting specifically controls the number of new connection attempts per second. It is the correct tool for managing traffic spikes and protecting backend resources from being overwhelmed by a high frequency of new requests.

Comparison (Connection Limit): A standard Connection Limit (Option C) restricts the total concurrent connections allowed at any one time, regardless of how fast they arrive.

Other Profiles: OneConnect (Option A) is used for connection pooling and reuse to reduce server-side load, and HTTP Compression (Option B) reduces bandwidth usage but does not limit connection counts or rates.

Before upgrading a BIG-IP system to a newer TMOS version, it is critical to review known issues to avoid introducing instability or regressions.F5 Bug Tracker (Option B)is a primary resource for this purpose. It allows administrators to search for documented software defects by TMOS version, module, symptom, or bug ID. Using Bug Tracker, an administrator can identify unresolvedissues, fixed bugs, and behavioral changes that may affect their specific deployment, such as traffic handling, high availability, or module-specific functionality. This directly supports proactive troubleshooting and informed upgrade planning.

F5 iHealth (Option D)is another essential tool used during upgrade preparation. iHealth analyzes uploaded UCS or QKView files and correlates the device configuration and software version with F5’s known issues database. It provides actionable reports highlighting critical defects, upgrade risks, interoperability concerns, and recommended target versions. iHealth is especially valuable because it contextualizes known issues based on the actual configuration running on the device.

The other options are not appropriate for verifying known software issues.F5 End User Diagnostics (Option A)is a client-side troubleshooting tool,F5 University (Option C)is a training platform, andF5 Downloads (Option E)is primarily used to obtain software images and release notes, not to analyze known defects in depth.

Uneven load balancing on a BIG-IP system typically occurs when traffic is not distributed evenly across all available pool members. One common reason is thatmonitors have marked down multiple pool members (Option B). When health monitors fail for specific pool members, BIG-IP automatically removes those members from load-balancing decisions. As a result, traffic is sent only to the remaining healthy member, creating the appearance that load balancing is not functioning correctly. This behavior is expected and aligns with BIG-IP’s design to ensure traffic is sent only to healthy resources.

Another frequent cause isthe presence of a persistence profile on the pool or virtual server (Option C). Persistence (such as source address or cookie persistence) forces subsequent client connections to be sent to the same pool member for session continuity. While persistence is critical for certain applications, it can override the load-balancing algorithm and cause most or all traffic to be directed to a single pool member, especially during low traffic volumes or testing scenarios.

The other options are incorrect because avirtual server marked down (Option A)would not pass traffic at all, andall pool members marked down (Option D)would result in no connections rather than uneven distribution. This analysis follows standard BIG-IP troubleshooting methodology using pool status, monitor results, and persistence configuration review.