F5CAB3 BIG-IP Administration Data Plane Configuration (F5CAB3) exam Questions and Answers

The configuration error is the HTTP Profile = http setting. The virtual server is intended to load balance SSH , which operates over TCP port 22 and is not an HTTP application protocol. The configured TCP protocol and TCP profile are therefore appropriate, but an HTTP profile should not be attached to this SSH virtual server.

F5 documentation states that an HTTP profile defines how BIG-IP manages HTTP traffic . The standard http profile operates in Reverse proxy mode by default and invokes BIG-IP ' s HTTP protocol processing. F5 separately documents Transparent HTTP proxy mode as the mode that can forward invalid HTTP traffic instead of dropping it. This distinction is important because an SSH protocol exchange is not syntactically valid HTTP traffic.

Setting HTTP Profile to None removes unnecessary Layer 7 HTTP parsing and leaves the virtual server handling the SSH connection through its TCP profile. The other changes are inappropriate: SSH requires TCP rather than UDP; the source address does not need to equal the virtual server ' s destination IP; and changing the destination to 0.0.0.0/0 is unrelated to the application-protocol mismatch.

Reference Topics: Local Traffic Profiles → HTTP Profiles , Proxy Mode , TCP profiles , Virtual Server profile assignment .

The two load balancing methods that consider all connections between the BIG-IP and each backend node — not just connections to a specific pool member — are Least Connections (node) and Weighted Least Connections (node) .

The critical distinction here lies in the node-level scope of evaluation. A node represents the backend server ' s IP address, regardless of how many services or ports it may be serving. Therefore:

Least Connections (node) directs new connections to the node with the fewest total active connections across all services on that server, providing a holistic connection-count perspective.

Weighted Least Connections (node) operates identically but factors in an administrator-defined ratio weight, allowing servers with greater capacity to proportionally absorb more connections while still evaluating total node-level connection counts.

By contrast:

Ratio (member) distributes traffic based on a static weight ratio and does not dynamically evaluate current connection counts.

Round Robin distributes traffic sequentially in rotation, completely ignoring current connection states on any node or member.

The node-based methods are particularly valuable in environments where a single backend server hosts multiple pool members across different ports, ensuring the server ' s overall load — not just per-service load — governs balancing decisions.

In a default BIG-IP configuration, the system utilizes the Load Balancing Method (typically Round Robin) to distribute each new connection across available pool members. However, the introduction of a persistence profile fundamentally changes this behavior. Persistence (also known as " stickiness " ) ensures that once a client has been load balanced to a specific pool member, all subsequent requests from that same client during a defined session or timeout period are directed to that same member, bypassing the standard load balancing algorithm. This is critical for applications that maintain state, such as shopping carts or authenticated sessions, where moving a user to a different server would result in a loss of session data.

While other options affect traffic handling, they do not " alter " the fundamental load balancing decision in the same way. A OneConnect profile (Option A) optimizes connection management by pooling idle server-side connections; while it changes how connections are reused, the initial load balancing decision still follows the configured method. A fallback host (Option C) is only utilized when the primary pool is unavailable, and since the question states all pool members are online, it remains inactive. SNAT Automap (Option D) changes the source IP address of the packet as it exits the BIG-IP toward the server to ensure return traffic passes back through the ADC, but it does not dictate which server is chosen for the request. Therefore, the persistence profile is the primary configuration element that overrides the load balancing algorithm to maintain a client-to-server relationship.

A red diamond indicates the Virtual Server is enabled but unavailable due to all pool members being down.

Slow Ramp Time prevents new members from being overwhelmed immediately after activation.

The BIG-IP Configuration Utility (GUI) organizes information hierarchically to allow for granular management of application objects. A Pool is a collection of backend servers (pool members) that provide the same service. To verify the specific network parameters—such as the IP address and the service port—of the servers within a pool, the administrator must navigate to the specific pool ' s configuration.

The standard procedural path to verify this is Local Traffic > Pools: Pool List, where the administrator selects the specific pool name. Once inside the pool ' s configuration, the Members tab displays a list of all IP addresses and service ports associated with that pool. Under the " Service Port " column, the administrator can confirm if the member is listening on port 80 (HTTP).

Options A and B are incorrect for this specific verification task. While Nodes (Option A) show the health of a physical server, a node represents only an IP address and does not have a " Service Port " associated with it until it is defined as a pool member. Verifying the Health Monitor (Option B) would tell the administrator how the system is checking the member ' s status, but it does not definitively show the port on which the member is actually receiving application traffic. In a BIG-IP environment, a pool member is uniquely identified by the combination of its Node IP and its Service Port, and the Members tab is the primary interface for managing and auditing these specific member attributes.

HTTP Compression on a BIG-IP system is an optimization feature that reduces the size of HTTP responses sent to clients, thereby saving bandwidth and improving page load times for end-users. To implement this functionality on a Virtual Server, the system requires two specific profiles to work in tandem: an HTTP profile and a Compression profile.

The HTTP profile (Option E) is a prerequisite because compression is an application-layer (Layer 7) operation. The BIG-IP must be " HTTP-aware " to parse the incoming requests and outgoing responses. The HTTP profile allows the BIG-IP to inspect the Accept-Encoding header from the client (to see if the client supports gzip or deflate) and to modify the Content-Encoding and Vary headers in the server ' s response. Without the HTTP profile, the Virtual Server operates at Layer 4 (TCP) and sees the traffic only as an opaque stream of bytes, making compression impossible.

The Compression profile (Option B) contains the actual settings and engine for the task. It defines which content types should be compressed (e.g., text/html, application/javascript), the compression level, and the minimum content length required before compression is applied. While a Stream profile (Option D) is used for data replacement (search and replace) and SSL profiles (Option C) are used for encryption, they do not provide compression logic. By applying both the HTTP and Compression profiles, the BIG-IP can successfully intercept server responses, compress the payload according to the configured policy, and deliver the optimized data to the user, effectively offloading the CPU-intensive compression work from the backend web servers.

The X-Forwarded-For header preserves the original client IP when SNAT is enabled.

With manual resume enabled, BIG-IP does not automatically return a pool member to service after recovery. The member remains offline until manually re-enabled.

When a failover occurs in a standard BIG-IP High Availability (HA) pair, the newly active device takes over the floating IP addresses (Virtual Servers, Self IPs). By default, the new active device sends Gratuitous ARP (GARP) messages to the local network switch to inform it that these IP addresses are now associated with its own physical MAC addresses. However, network switches and intermediate routers often have ARP aging timers or security features that may delay the updating of their ARP tables, leading to " black-holed " traffic or dropped packets for several seconds or minutes until the network infrastructure correctly relearns the new path.

To eliminate this delay and ensure a seamless transition, a BIG-IP Administrator should Configure MAC Masquerade. MAC Masquerade allows the administrator to assign a unique, " virtual " MAC address to a specific traffic group. Instead of using the hardware-burned MAC address of the individual appliance, the active device uses this shared virtual MAC address for all communication involving floating IPs. When a failover occurs, the standby device assumes control of the traffic group and begins using the exact same virtual MAC address. Because the MAC address associated with the VIPs never changes from the switch ' s perspective, there is no need for the switch to update its MAC address table or for the surrounding infrastructure to update its ARP caches. This effectively eliminates the " stabilization period " reported by users, as the data plane transition happens almost instantaneously at Layer 2, maintaining continuous traffic flow without being hindered by external network re-convergence times.

In a BIG-IP High Availability (HA) environment, most configuration objects (Virtual Servers, Pools, iRules) are considered " shared " and are synchronized automatically between devices. However, network-level objects—specifically VLANs and Self IPs—are unique to the hardware and are generally not synchronized by the ConfigSync process.

This is intentional because two devices in a cluster may have different physical cabling or interface assignments. For example, Cluster Member A might use interface 1.1 for a specific VLAN, while Cluster Member B might use interface 1.2. Because the BIG-IP system cannot assume that the physical network topology is identical for both appliances, the administrator must Configure the new VLAN manually on Cluster Member B.

Once the VLAN is created manually on both devices with the exact same name, it can then be used to host " shared " floating Self IP addresses or traffic groups that will synchronize. Failing to create the VLAN on the peer device will prevent the traffic group from failing over correctly, as the peer will not have the necessary Layer 2 broadcast domain defined to take over the traffic. Resetting Device Trust (Option D) is a drastic step for fix sync communication issues but will not change the fact that VLANs are non-syncable objects. Enabling the interface (Option B) only affects the link status of Member A and has no impact on the configuration of Member B.

When many users share one source IP, source-address persistence fails. Cookie persistence uniquely identifies clients at Layer 7.

When the connection limit is reached, BIG-IP resets new connections, even if pool members are healthy.

In BIG-IP configuration, health monitors can be applied at three distinct levels: the node, the pool, or the individual pool member. To ensure that a specific application service—in this case, a database service on port 1521—is functioning correctly for the entire pool, the administrator should apply the monitor at the pool level. Navigating to Local Traffic > Pools > DB.Pool > Properties allows the administrator to select one or more monitors from the " Available " list and move them to the " Active " list.

Applying a monitor at the pool property level ensures that the BIG-IP checks the health of every member assigned to that pool using the same logic. If a database-specific monitor (such as a TCP handshake or an Oracle/SQL check) fails for a specific member, the BIG-IP marks that member as " offline " for that specific pool, preventing new connections from being sent to it. While monitors can be applied to Pool Members (Option D) to give different members unique monitoring logic, it is more administratively efficient to apply it to the pool properties when all servers are expected to behave identically. Applying it to Nodes (Option C) would only verify that the IP address is up (typically via ICMP), which does not guarantee that the database service on port 1521 is actually responding. Finally, Profiles (Option A) are used to define how traffic is handled once it is accepted by a Virtual Server, not for the proactive health checking of backend resources. Therefore, the pool properties page is the standard location for configuring service-specific availability requirements.

By default, BIG-IP load balancing algorithms (such as Round Robin) distribute connections evenly across all available pool members. However, persistence profiles override normal load balancing decisions by forcing subsequent connections from a client to be sent to the same pool member.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Persistence creates a client-to-server mapping that is honored before load balancing algorithms are applied.

When persistence is enabled, BIG-IP may repeatedly select the same pool member even if others are available.

This directly alters load balancing behavior.

Why the other options are incorrect:

A. Adding a OneConnect profileOneConnect optimizes server-side TCP connections but does not change which pool member is selected.

B. Enabling SNAT automapSNAT affects source address translation, not pool member selection.

C. Enabling a fallback host in the HTTP profileA fallback host is only used when no pool members are available.

Correct Resolution:

Adding a persistence profile alters load balancing behavior by maintaining client affinity to a specific pool member.

Slow Ramp Time prevents new pool members from receiving a full share of traffic immediately, allowing applications to warm up gradually.

X-Forwarded-For inserts the original client IP into HTTP headers while SNAT is enabled.

Using “at least one” ensures each member is marked up based on its relevant service monitor.

The virtual server is configured for destination 192.168.21.50 , service port 53 , but its Protocol is TCP . Standard DNS query traffic is normally sent using UDP port 53 . Because virtual-server traffic matching includes the configured IP protocol, UDP DNS packets will not match a virtual server configured exclusively for TCP, causing the queries to fail.

F5 ' s DNS configuration guidance explicitly instructs administrators creating a DNS query virtual server to configure service port 53 and select UDP as the protocol. F5 also recommends separate TCP and UDP virtual servers when both forms of DNS traffic must be supported; TCP port 53 is particularly relevant for operations such as DNS zone transfers.

Option C is not required. The existing source network 192.168.100.0/23 spans addresses from 192.168.100.0 through 192.168.101.255, so both 192.168.101.100 and 192.168.101.200 are already permitted by the source-address criterion. F5 documents that the Source Address setting can specify the network from which a virtual server accepts traffic.

Therefore, changing the virtual server ' s Protocol from TCP to UDP corrects the traffic-matching problem.

Reference Topics: Virtual Server traffic matching; Protocol selection; DNS over UDP/TCP; Source Address matching; Service Port 53.

When multiple users share one source IP, source-address persistence fails. Cookie persistence uniquely identifies users at Layer 7 and ensures correct session handling.

This scenario requires unequal load distribution based on server capacity. The newer servers must receive more connections than the older ones, while still dynamically accounting for active connection counts.

According to BIG-IP Administration: Data Plane Configuration documentation:

Weighted Least Connections (member) combines:

Connection awareness (least connections)

Administrator-defined weights (ratios) to reflect server capacity

Pool members with higher weights receive proportionally more new connections than members with lower weights, even when using the same load balancing algorithm.

Why B is correct:

Allows assigning higher weights to newer servers and lower weights to older servers

Ensures smarter traffic distribution based on both capacity and real-time load

Why the other options are incorrect:

A. Global AvailabilityUsed for disaster recovery and site failover, not intra-pool load distribution.

C. Round RobinDistributes connections evenly without considering server capacity.

D. Least Connections (member)Balances only by current connection count and does not account for differences in server performance or capacity.

Correct Resolution:

Use Weighted Least Connections (member) and assign higher weights to newer servers so they receive more traffic while protecting older servers from overload.

Standard BIG-IP administration dictates that hardware-level physical attributes are managed within the Network section of the configuration. When a network switch and a BIG-IP fail to successfully negotiate speed and duplex settings (Auto-Negotiation), it can result in CRC errors, late collisions, or a total lack of link. To resolve this manually, the administrator must navigate to the Configuration Utility (GUI) and go to Network > Interfaces.

Within the Interfaces list, the administrator can select the specific physical port (e.g., 1.1 or 1.2) and modify its properties. By default, the media speed is set to " Auto, " but the drop-down menu allows for manual selection of specific speeds (e.g., 100Mb/s, 1Gb/s, 10Gb/s) and duplex settings (Full or Half). While these changes can also be made via the TMOS Shell (TMSH) (Option B) using the modify net interface command, the question asks for the standard location, which in most administrative contexts refers to the primary GUI path. System > Configuration (Option D) is used for global device settings like NTP, DNS, and licensing, not for interface-specific physical layer parameters. The Front Console (Option A), referring to the LCD panel on physical appliances, is primarily used for initial management IP setup and viewing system alerts, but does not provide the granular interface configuration required for media speed adjustments.