F5CAB3 BIG-IP Administration Data Plane Configuration (F5CAB3) exam Question and Answers

Persistence overrides load balancing decisions by maintaining client-to-server affinity.

Slow Ramp Time prevents new members from being overwhelmed immediately after activation.

Connection rate limiting controls how many new connections per second are accepted, protecting backend resources.

With manual resume enabled, BIG-IP does not automatically return a pool member to service after recovery. The member remains offline until manually re-enabled.

A red diamond indicates that the Virtual Server is enabled but unavailable, typically due to all pool members being down.

In F5 BIG-IP administration, iApps are designed to manage complex application configurations as a single unit. When an iApp is deployed, it creates an "Application Service" object that owns all the associated LTM objects, such as Virtual Servers, Pools, and Nodes. By default, these iApps are created with Strict Updates enabled. Strict Updates is a safety mechanism that prevents administrators from making manual "out-of-band" changes to the individual objects created by the iApp. The system enforces this because manual changes would be overwritten the next time the iApp template is updated or re-entered.

When the administrator attempts to change the destination IP address directly on the Virtual Server object, the BIG-IP system checks the "Strict Updates" flag. If it is set to "Enabled," the system blocks the modification and generates the error message stating the service must be updated via the application management interface. To resolve this, the administrator must navigate to the iApp >> Application Services menu, select the specific application service, and go to the "Reconfigure" tab. Within the iApp configuration form, the destination IP can be safely changed. Alternatively, if the administrator specifically wants to manage the objects manually and forgo the benefits of the iApp template management, they could disable "Strict Updates" in the iApp properties, though this is generally discouraged as it breaks the template's logic. The error is not related to subnetting or duplicate IPs, but strictly to the configuration authority assigned to the iApp service.

Application-level monitors ensure that only the affected service is marked down, not the entire node.

In F5 BIG-IP systems, an iApp is a template-driven framework used to deploy and manage application-specific configurations. When an iApp is deployed, the system creates a specialized folder or "Application Service" container to hold all the resulting Local Traffic Manager (LTM) objects, such as virtual servers, pools, and profiles. This container is visually and programmatically identified by the .app extension in its path name.

The naming convention for these objects follows a specific hierarchical structure: //.app/. For example, if an administrator creates an iApp named "testhttp" in the "/Common" partition, the virtual server created by that iApp would be identified in the configuration (TMSH) and the GUI as /Common/testhttp.app/testhttp. This structure allows the BIG-IP system to distinguish between manually created objects and those managed by the iApp's automation logic.

This identification is crucial because iApp-managed objects typically have Strict Updates enabled, which prevents administrators from making direct manual changes to the object settings outside of the iApp's reconfigure interface. Attempting to modify such an object directly will result in an error message stating that the application service must be updated using an application management interface. By recognizing the .app path and the repeated name within the structure, an administrator can immediately identify that the object belongs to an iApp and should be managed through the iApp's specific management screen rather than standard LTM configuration menus.

A Performance (Layer 4) virtual server does not inspect or process application-layer data such as HTTP headers or cookies. Therefore, only Layer 4–compatible persistence methods can be used.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Source Address Affinity persistence operates at Layer 4 and uses the client IP address to maintain session persistence.

It is fully compatible with Performance (Layer 4) virtual servers.

It works regardless of encryption, making it suitable for TLS-secured applications.

Why the other options are incorrect:

B. Cookie persistenceRequires an HTTP profile and Layer 7 inspection, which is not supported on Performance virtual servers.

C. Microsoft RDP persistenceIs protocol-specific and not applicable to web-based TLS traffic.

D. Host persistenceRequires HTTP host header inspection, which is not available at Layer 4.

Correct Resolution:

Source Address Affinity persistence is the appropriate choice for maintaining persistence on a Performance (Layer 4) virtual server handling TLS traffic.

Below is Batch 1 (Questions 1–10) extracted only from your uploaded document that are directly related to BIG-IP Administration: Data Plane Configuration topics (Virtual Servers, Pools, Load Balancing, Monitors, Persistence, SNAT, Profiles).

I have excluded system-only, licensing, support, hardware, HA management-only, and admin UI questions that are not Data Plane–focused.

Source: Your uploaded TMOS Administration v2.0 document

✅ BATCH 1 (10 Questions)

When the connection limit is reached, BIG-IP resets new connections, even if pool members are healthy.

Slow Ramp Time prevents new pool members from receiving full traffic immediately, avoiding overload.

In BIG-IP configuration, health monitors can be applied at three distinct levels: the node, the pool, or the individual pool member. To ensure that a specific application service—in this case, a database service on port 1521—is functioning correctly for the entire pool, the administrator should apply the monitor at the pool level. Navigating to Local Traffic > Pools > DB.Pool > Properties allows the administrator to select one or more monitors from the "Available" list and move them to the "Active" list.

Applying a monitor at the pool property level ensures that the BIG-IP checks the health of every member assigned to that pool using the same logic. If a database-specific monitor (such as a TCP handshake or an Oracle/SQL check) fails for a specific member, the BIG-IP marks that member as "offline" for that specific pool, preventing new connections from being sent to it. While monitors can be applied to Pool Members (Option D) to give different members unique monitoring logic, it is more administratively efficient to apply it to the pool properties when all servers are expected to behave identically. Applying it to Nodes (Option C) would only verify that the IP address is up (typically via ICMP), which does not guarantee that the database service on port 1521 is actually responding. Finally, Profiles (Option A) are used to define how traffic is handled once it is accepted by a Virtual Server, not for the proactive health checking of backend resources. Therefore, the pool properties page is the standard location for configuring service-specific availability requirements.

From the exhibit, the pool contains different applications on different service ports (for example, HTTP/80, FTP/21, HTTPS/443, SSH/22). To mark pool members correctly, BIG-IP must be able to verify the actual service running on each member’s port.

In BIG-IP Administration: Data Plane Configuration, monitor behavior is described as follows:

When multiple monitors are assigned to a pool, the Availability Requirement controls how monitor results are evaluated:

At least one = the pool member is marked up if any one of the assigned monitors succeeds.

All = the pool member is marked up only if every assigned monitor succeeds.

For pools containing members with different services/ports, using All can incorrectly mark members down because monitors intended for other services will fail on the wrong port.

Why C is correct:

Assigning HTTPS, HTTP, FTP, and SSH covers the actual services shown in the pool.

Setting the Availability Requirement to at least one ensures that each pool member is considered available when its appropriate service monitor succeeds, without being forced to pass unrelated service monitors.

Why the other options are incorrect:

A / D (Availability Requirement = all): would cause members to be marked down when unrelated monitors fail (e.g., SSH monitor against an HTTP member).

B (includes ICMP): ICMP can indicate the host is reachable even if the application service is down, which does not “accurately” reflect service availability.

Therefore, the best choice is HTTPS, HTTP, FTP, and SSH with Availability Requirement of at least one health monitor.

When many users share one source IP, source-address persistence fails. Cookie persistence uniquely identifies clients at Layer 7.

In a BIG-IP High Availability (HA) environment, most configuration objects (Virtual Servers, Pools, iRules) are considered "shared" and are synchronized automatically between devices. However, network-level objects—specifically VLANs and Self IPs—are unique to the hardware and are generally not synchronized by the ConfigSync process.

This is intentional because two devices in a cluster may have different physical cabling or interface assignments. For example, Cluster Member A might use interface 1.1 for a specific VLAN, while Cluster Member B might use interface 1.2. Because the BIG-IP system cannot assume that the physical network topology is identical for both appliances, the administrator must Configure the new VLAN manually on Cluster Member B.

Once the VLAN is created manually on both devices with the exact same name, it can then be used to host "shared" floating Self IP addresses or traffic groups that will synchronize. Failing to create the VLAN on the peer device will prevent the traffic group from failing over correctly, as the peer will not have the necessary Layer 2 broadcast domain defined to take over the traffic. Resetting Device Trust (Option D) is a drastic step for fix sync communication issues but will not change the fact that VLANs are non-syncable objects. Enabling the interface (Option B) only affects the link status of Member A and has no impact on the configuration of Member B.

X-Forwarded-For inserts the original client IP into HTTP headers, preserving client identity while SNAT is enabled.

Connection rate limits restrict how many new connections are accepted per second, protecting application resources.

Using “at least one” ensures each member is marked up based on its relevant service monitor.