F5CAB3 BIG-IP Administration Data Plane Configuration (F5CAB3) exam Question and Answers

When a failover occurs in a standard BIG-IP High Availability (HA) pair, the newly active device takes over the floating IP addresses (Virtual Servers, Self IPs). By default, the new active device sends Gratuitous ARP (GARP) messages to the local network switch to inform it that these IP addresses are now associated with its own physical MAC addresses. However, network switches and intermediate routers often have ARP aging timers or security features that may delay the updating of their ARP tables, leading to " black-holed " traffic or dropped packets for several seconds or minutes until the network infrastructure correctly relearns the new path.

To eliminate this delay and ensure a seamless transition, a BIG-IP Administrator should Configure MAC Masquerade. MAC Masquerade allows the administrator to assign a unique, " virtual " MAC address to a specific traffic group. Instead of using the hardware-burned MAC address of the individual appliance, the active device uses this shared virtual MAC address for all communication involving floating IPs. When a failover occurs, the standby device assumes control of the traffic group and begins using the exact same virtual MAC address. Because the MAC address associated with the VIPs never changes from the switch ' s perspective, there is no need for the switch to update its MAC address table or for the surrounding infrastructure to update its ARP caches. This effectively eliminates the " stabilization period " reported by users, as the data plane transition happens almost instantaneously at Layer 2, maintaining continuous traffic flow without being hindered by external network re-convergence times.

By default, BIG-IP load balancing algorithms (such as Round Robin) distribute connections evenly across all available pool members. However, persistence profiles override normal load balancing decisions by forcing subsequent connections from a client to be sent to the same pool member.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Persistence creates a client-to-server mapping that is honored before load balancing algorithms are applied.

When persistence is enabled, BIG-IP may repeatedly select the same pool member even if others are available.

This directly alters load balancing behavior.

Why the other options are incorrect:

A. Adding a OneConnect profileOneConnect optimizes server-side TCP connections but does not change which pool member is selected.

B. Enabling SNAT automapSNAT affects source address translation, not pool member selection.

C. Enabling a fallback host in the HTTP profileA fallback host is only used when no pool members are available.

Correct Resolution:

Adding a persistence profile alters load balancing behavior by maintaining client affinity to a specific pool member.

F5 provides several pre-configured (built-in) TCP profiles designed to optimize traffic for different network conditions. When an administrator is looking to improve general performance but does not have a specific, narrow use case (like strictly mobile or strictly long-haul WAN), the f5-tcp-progressive profile is the recommended starting point.

The f5-tcp-progressive profile is designed as a modern, high-performance replacement for the older default TCP settings. It incorporates several advanced congestion control algorithms and buffer management techniques that allow it to adapt dynamically to varying network latencies and packet loss scenarios. Unlike f5-tcp-legacy (Option A), which uses older, less efficient stacks, the progressive profile leverages modern TMM (Traffic Management Microkernel) optimizations.

While f5-tcp-mobile (Option B) is highly effective for high-loss cellular networks and f5-tcp-wan (Option D) is optimized for high-latency long-distance links, they can sometimes be too aggressive or poorly suited for standard campus or data center environments. The f5-tcp-progressive profile acts as a " best-of-all-worlds " template that typically provides an immediate performance boost for most web applications by improving window scaling and fast-retransmit behavior. Therefore, it is the procedural " first step " in TCP performance tuning before moving to more specialized, niche profiles.

In F5 BIG-IP administration, iApps are designed to manage complex application configurations as a single unit. When an iApp is deployed, it creates an " Application Service " object that owns all the associated LTM objects, such as Virtual Servers, Pools, and Nodes. By default, these iApps are created with Strict Updates enabled. Strict Updates is a safety mechanism that prevents administrators from making manual " out-of-band " changes to the individual objects created by the iApp. The system enforces this because manual changes would be overwritten the next time the iApp template is updated or re-entered.

When the administrator attempts to change the destination IP address directly on the Virtual Server object, the BIG-IP system checks the " Strict Updates " flag. If it is set to " Enabled, " the system blocks the modification and generates the error message stating the service must be updated via the application management interface. To resolve this, the administrator must navigate to the iApp > > Application Services menu, select the specific application service, and go to the " Reconfigure " tab. Within the iApp configuration form, the destination IP can be safely changed. Alternatively, if the administrator specifically wants to manage the objects manually and forgo the benefits of the iApp template management, they could disable " Strict Updates " in the iApp properties, though this is generally discouraged as it breaks the template ' s logic. The error is not related to subnetting or duplicate IPs, but strictly to the configuration authority assigned to the iApp service.

BIG-IP provides several built-in TCP profiles optimized for different traffic patterns and network conditions. When attempting to improve general TCP performance, the recommended starting point is f5-tcp-progressive.

According to the BIG-IP Administration: Data Plane Configuration documentation:

f5-tcp-progressive is designed as a balanced, general-purpose TCP optimization profile.

It dynamically adjusts TCP behavior to improve throughput and latency for most enterprise applications.

It is the recommended first-choice profile when tuning TCP performance before moving to more specialized profiles.

Why the other options are incorrect:

A. f5-tcp-legacyThis profile exists for backward compatibility and does not include modern TCP optimizations.

C. f5-tcp-mobileThis profile is optimized specifically for high-latency, lossy mobile networks and is not suitable for general-purpose environments.

D. No optionBIG-IP explicitly provides built-in TCP profiles for performance tuning; using none would forgo optimization opportunities.

Correct Resolution:

The administrator should first apply f5-tcp-progressive to evaluate potential TCP performance improvements before considering more specialized profiles.

Persistence overrides load balancing decisions by maintaining client-to-server affinity.

Slow Ramp Time prevents new pool members from receiving a full share of traffic immediately, allowing applications to warm up gradually.

When multiple hostnames resolve to the same IP address and encrypted communication is required, the BIG-IP must be able to present the correct SSL certificate based on the hostname requested by the client. This is accomplished using Server Name Indication (SNI).

According to BIG-IP Administration: Data Plane Configuration documentation:

SNI is a client-side TLS extension, where the client includes the requested hostname during the SSL handshake.

BIG-IP evaluates this hostname using the Client SSL profile, not the Server SSL profile.

The “Server Name” setting in the Client SSL profile enables BIG-IP to select the appropriate SSL certificate for the requested hostname.

Why option C is correct:

Client SSL profile handles inbound (client-side) encryption.

Server Name enables SNI-based certificate selection when multiple DNS names share the same virtual server IP.

Why the other options are incorrect:

A. Client SSL, Client NameThere is no Client SSL setting called Client Name for SNI certificate selection.

B. Server SSL, Server NameServer SSL is used for encryption between BIG-IP and backend servers, not for client-side hostname identification.

D. Server SSL, Client NameServer SSL does not process client-requested hostnames during TLS negotiation.

Correct Resolution:

Configure a Client SSL profile and enable the Server Name (SNI) setting to support multiple encrypted hostnames on the same virtual server IP.

The exhibit shows the advanced configuration of a VLAN where the Fail-safe option is checked. VLAN Fail-safe is a high-availability feature used to monitor network connectivity on a specific VLAN. When enabled, the BIG-IP system monitors the VLAN for network traffic. If the system does not detect any " useful " traffic on the VLAN within the specified Fail-safe Timeout (which is 90 seconds in the exhibit), it attempts to generate traffic by pinging the default gateway or other devices. If it still detects no traffic, the BIG-IP concludes that the VLAN is unreachable or the network interface has failed, and it triggers a " Fail-safe Action " —in this case, " Reboot " or a failover to the peer device in the HA group.

Because the administrator has just created a new VLAN that " does NOT yet have any traffic, " the Fail-safe mechanism triggers immediately after the 90-second timeout period. Since no devices are yet communicating on this VLAN, the BIG-IP incorrectly assumes there is a hardware or cabling failure and forces a failover to ensure the standby device (which might have better connectivity) takes over. To prevent this unwanted failover, the administrator should uncheck the Fail-safe box for that specific VLAN until the VLAN is fully populated with active nodes and regular traffic. Once the application is live and traffic is flowing, Fail-safe can be re-enabled to provide an additional layer of redundancy. Auto Last Hop (Option A) and Source Check (Option B) are routing and security features that do not trigger HA failover events.

The two load balancing methods that consider all connections between the BIG-IP and each backend node — not just connections to a specific pool member — are Least Connections (node) and Weighted Least Connections (node) .

The critical distinction here lies in the node-level scope of evaluation. A node represents the backend server ' s IP address, regardless of how many services or ports it may be serving. Therefore:

Least Connections (node) directs new connections to the node with the fewest total active connections across all services on that server, providing a holistic connection-count perspective.

Weighted Least Connections (node) operates identically but factors in an administrator-defined ratio weight, allowing servers with greater capacity to proportionally absorb more connections while still evaluating total node-level connection counts.

By contrast:

Ratio (member) distributes traffic based on a static weight ratio and does not dynamically evaluate current connection counts.

Round Robin distributes traffic sequentially in rotation, completely ignoring current connection states on any node or member.

The node-based methods are particularly valuable in environments where a single backend server hosts multiple pool members across different ports, ensuring the server ' s overall load — not just per-service load — governs balancing decisions.

SSH is a TCP-based service. A TCP monitor validates service availability without requiring application-layer inspection.

In BIG-IP systems, iRules influence traffic only when they are attached to a Virtual Server. If application traffic is being sent to nodes or pool members that are not defined in the pool, this typically indicates that an iRule is overriding the default load-balancing behavior by explicitly selecting a pool or node.

According to BIG-IP Administration: Data Plane Configuration and official F5 guidance:

iRules are associated with Virtual Servers, not directly with pools or nodes.

To determine whether an iRule is actively affecting traffic, the administrator must inspect the Virtual Server configuration.

Explanation of the correct answers:

B. Via the GUI at the Resources tab for the virtual serverThe Resources tab in the Configuration Utility displays all traffic-handling objects applied to the Virtual Server, including assigned iRules. This is the primary GUI location to verify whether an iRule is influencing data plane traffic.

C. Via TMSH with the list /ltm virtual < virtual_server > commandThis TMSH command displays the full Virtual Server configuration, including any iRules listed under the rules section. It is the authoritative CLI method to confirm iRule usage.

Why the other options are incorrect:

A. Via TMSH with the list /ltm rule < irule > commandThis command only shows the contents of an iRule and does not indicate whether the iRule is attached to or used by any Virtual Server.

D. Via the GUI at the iRule tab for the virtual serverBIG-IP does not provide a dedicated “iRule” tab on Virtual Servers. iRules are viewed and managed under the Resources tab.

Correct Conclusion:

To verify whether an iRule is responsible for unexpected node selection, the BIG-IP Administrator must examine the Virtual Server configuration, either through the Resources tab in the GUI or by using TMSH to list the Virtual Server configuration.

The X-Forwarded-For header preserves the original client IP when SNAT is enabled.

The pool member list in the exhibit shows servers listening on four distinct service ports: 80 (HTTP), 21 (FTP), 443 (HTTPS), and 22 (SSH). To accurately monitor a pool where members provide different services, the administrator must apply monitors that correspond to each of those specific services.

The key to this configuration is the Availability Requirement (also known as " Monitor Rule " ). If the administrator sets the requirement to " All health monitors, " every single monitor (HTTP, HTTPS, FTP, and SSH) must pass for a member to be marked " Up. " This would cause an immediate failure: for example, a server listening only on port 80 would fail the HTTPS, FTP, and SSH checks, resulting in the member being marked " Down " even if the HTTP service is healthy.

To ensure accuracy, the administrator should apply all four relevant monitors and set the Availability Requirement to at least one monitor. With this setting, the BIG-IP marks a member as " Up " if any of the assigned monitors return a successful response. Therefore, the member at 10.200.50.210:80 will stay " Up " as long as the HTTP monitor passes, even though it fails the FTP, HTTPS, and SSH monitors. This configuration allows a single pool to contain diverse service types while ensuring that the specific port defined for each member is verified correctly. Option C is incorrect because ICMP only checks if the IP is alive, not if the specific service port is functioning.

Connection rate limits restrict how many new connections are accepted per second, protecting application resources.

When a pool contains servers with heterogeneous hardware capabilities (differing CPU, RAM, or connection limits), a static load balancing method like Round Robin is ineffective because it distributes requests equally, regardless of the server ' s capacity. To optimize traffic distribution for newer, more powerful servers, a dynamic or weighted method is required.

Weighted Least Connections (member): This is the ideal method for this scenario. It combines two factors:

Least Connections: It first checks the current active connection count to ensure traffic goes to the least busy server.

Weight (Ratio): It allows the administrator to assign a " Ratio " value to each pool member. Newer servers can be assigned a higher ratio (e.g., 3) while older servers are assigned a lower ratio (e.g., 1). The BIG-IP system uses these weights to disproportionately favor the newer servers even when connection counts are similar.

Why other options are incorrect:

Global Availability: This is primarily a GSLB (Global Server Load Balancing) or specific LTM priority group concept where traffic is sent to the first available member in a list until it fails, then moves to the next. It does not load balance based on capacity.

Round Robin: This passes each new connection request to the next server in line, treating the old and new servers exactly the same.

Least Connections (member): While this sends traffic to the server with the fewest active connections, it assumes all servers are equal. If an old server and a new server both have 10 connections, they are treated as equally capable of taking the 11th, which is not true in this scenario.

The Local Traffic > Network Map provides a single consolidated view within the BIG-IP Configuration Utility that displays the full relationship hierarchy of all application delivery objects simultaneously. This includes Virtual Servers, their associated Pools, individual Pool Members, applied iRules, profiles, and the health status of each object — all rendered in a single topological screen.

This view is specifically designed for administrators and users who need rapid situational awareness across the data plane without navigating multiple menu screens. Each object is colour-coded to reflect its current availability state (green = available, red = unavailable, yellow = degraded).

The alternative options do not satisfy all requirements:

Local Traffic > Monitors only displays health monitor configurations, not virtual server or pool member relationships.

Statistics provides performance counters and throughput data, not object relationship mapping.

Local Traffic > Virtual Servers lists virtual server configurations individually but does not provide a unified topology view inclusive of pool members and iRules in a single screen.

The Network Map is the authoritative single-pane-of-glass tool for application object visibility on BIG-IP.

This question tests precise knowledge of both TMSH command syntax and BIG-IP object namespace hierarchy . Two critical distinctions must be correctly identified:

1. create vs. modify: Since the Trunk already exists and the administrator is adding interfaces to it, the correct verb is modify — not create . Using create on an existing object would either throw an error or attempt to overwrite the object entirely, neither of which is the desired outcome.

2. /sys vs. /net namespace: Trunk objects in BIG-IP reside within the /net namespace, which encompasses network-layer constructs including Trunks, VLANs, Self IPs, and Routes. The /sys namespace is reserved for system-level objects such as management settings, software, and licensing — it does not contain Trunk objects.

Therefore, the only syntactically and functionally correct command is:

tmsh modify /net trunk trunk_A interfaces add {1.3 1.4}

This command appends interfaces 1.3 and 1.4 to the existing trunk_A object without disrupting currently assigned interfaces, increasing aggregated bandwidth accordingly.

Options A and C use the incorrect /sys namespace, and options A and B incorrectly use the create verb for an existing object.

The configuration error is the HTTP Profile = http setting. The virtual server is intended to load balance SSH , which operates over TCP port 22 and is not an HTTP application protocol. The configured TCP protocol and TCP profile are therefore appropriate, but an HTTP profile should not be attached to this SSH virtual server.

F5 documentation states that an HTTP profile defines how BIG-IP manages HTTP traffic . The standard http profile operates in Reverse proxy mode by default and invokes BIG-IP ' s HTTP protocol processing. F5 separately documents Transparent HTTP proxy mode as the mode that can forward invalid HTTP traffic instead of dropping it. This distinction is important because an SSH protocol exchange is not syntactically valid HTTP traffic.

Setting HTTP Profile to None removes unnecessary Layer 7 HTTP parsing and leaves the virtual server handling the SSH connection through its TCP profile. The other changes are inappropriate: SSH requires TCP rather than UDP; the source address does not need to equal the virtual server ' s destination IP; and changing the destination to 0.0.0.0/0 is unrelated to the application-protocol mismatch.

Reference Topics: Local Traffic Profiles → HTTP Profiles , Proxy Mode , TCP profiles , Virtual Server profile assignment .

WAN-optimized TCP profiles improve performance for high-latency Internet clients, while LAN profiles are optimal for backend servers.

The log message “Intercept exhaustion” indicates that the BIG-IP system has exhausted the available source port translations for one or more SNAT addresses. This occurs when too many concurrent client connections are being translated through a limited number of SNAT IP addresses, and all ephemeral source ports (typically ~64,000 per SNAT IP) are in use.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Each SNAT IP address provides a finite number of available source ports.

When the number of concurrent connections exceeds the available port space, the BIG-IP logs an Intercept exhaustion error and new connections fail.

The recommended resolution is to increase the available SNAT resources by adding additional IP addresses to the SNAT pool.

Why the other options are incorrect:

A. Increase the timeout of the SNAT addressesIncreasing timeouts may actually worsen the problem by keeping ports allocated longer, accelerating port exhaustion.

B. Remove the SNAT pool and apply SNAT AutomapSNAT Automap uses the Self IP addresses on the egress VLAN, which may not provide additional capacity and can introduce routing or design issues. This is not a direct or recommended fix for SNAT exhaustion.

C. Remove an IP address from the SNAT poolThis would reduce the number of available source ports and further exacerbate the intercept exhaustion condition.

Correct Resolution:

By adding an IP address to the SNAT pool, the BIG-IP increases the total number of available source ports, alleviating intercept exhaustion and restoring successful client connections.

Fallback persistence is used when the primary persistence method fails. Source Address Affinity is a Layer 4 persistence method and is fully supported as a fallback option for most virtual server types.