F5CAB3 BIG-IP Administration Data Plane Configuration (F5CAB3) exam Questions and Answers

HTTP Compression on a BIG-IP system is an optimization feature that reduces the size of HTTP responses sent to clients, thereby saving bandwidth and improving page load times for end-users. To implement this functionality on a Virtual Server, the system requires two specific profiles to work in tandem: an HTTP profile and a Compression profile.

The HTTP profile (Option E) is a prerequisite because compression is an application-layer (Layer 7) operation. The BIG-IP must be " HTTP-aware " to parse the incoming requests and outgoing responses. The HTTP profile allows the BIG-IP to inspect the Accept-Encoding header from the client (to see if the client supports gzip or deflate) and to modify the Content-Encoding and Vary headers in the server ' s response. Without the HTTP profile, the Virtual Server operates at Layer 4 (TCP) and sees the traffic only as an opaque stream of bytes, making compression impossible.

The Compression profile (Option B) contains the actual settings and engine for the task. It defines which content types should be compressed (e.g., text/html, application/javascript), the compression level, and the minimum content length required before compression is applied. While a Stream profile (Option D) is used for data replacement (search and replace) and SSL profiles (Option C) are used for encryption, they do not provide compression logic. By applying both the HTTP and Compression profiles, the BIG-IP can successfully intercept server responses, compress the payload according to the configured policy, and deliver the optimized data to the user, effectively offloading the CPU-intensive compression work from the backend web servers.

In the F5 BIG-IP ecosystem, a standard ICMP health monitor functions by sending an ICMP echo request to a target node and expecting an ICMP echo reply within a specified timeout period. When a node is marked " DOWN " despite the backend server being configured to respond to ICMP, the issue typically lies in the network path or the specific packet exchange between the BIG-IP ' s self IP and the node ' s IP. Running a tcpdump is the most effective next step because it provides a real-time packet capture of the actual monitor traffic leaving the BIG-IP and any return traffic coming back from the server. This allows the administrator to verify if the BIG-IP is actually sending the echo request, if the request is reaching the server, and if the server is indeed replying or if the reply is being dropped by an intermediate firewall or a security policy.

While other tools have their place, they are inappropriate for this specific layer 3/4 connectivity issue. A qkview is a comprehensive diagnostic file used primarily for F5 Support to analyze the entire system ' s state but is overkill for initial connectivity troubleshooting. An ssldump is used for inspecting SSL/TLS handshakes and encrypted payloads, which is irrelevant for a non-encrypted ICMP monitor. A curl command is a tool for testing HTTP/HTTPS application-level responses; it cannot be used to troubleshoot ICMP (ping) connectivity directly. By using tcpdump -ni < vlan_name > host < node_ip > , the administrator can see the ICMP " type 8 " (request) and " type 0 " (reply) packets, immediately identifying if the monitor failure is due to a " Destination Unreachable " message or a simple lack of response, thereby pinpointing the root cause in the data plane.

The configuration provided utilizes Priority Group Activation in conjunction with the min_active_members setting. Priority groups allow an administrator to define primary servers and " backup " servers within the same pool. The BIG-IP prioritizes traffic based on the assigned priority number, with the highest number receiving traffic first.

In this specific configuration, the priority 3 group is the primary group. Therefore, connections are first distributed to all pool members with priority 3 as long as they are available. The system will continue to use only the priority 3 group unless the number of available members in that group falls below the min_active_members value, which is set to 2.

If the priority 3 group has fewer than two active members, the BIG-IP " activates " the next available priority group (priority 2) and distributes traffic among the remaining members of priority 3 and all members of priority 2. This cascading logic continues down the list. Consequently, if both the priority 3 group and the priority 2 group have fewer than two members available, traffic is directed to the priority 1 group. This ensures that even in a multi-server failure scenario, the system has a last-resort group of servers to handle the traffic.

Option D is incorrect because if only one member of priority 3 goes down, there are still two members active (10.12.10.8 and 10.12.10.9). Since 2 is not less than the min_active_members threshold of 2, the priority 2 group will not yet be activated. Option B is incorrect because traffic flows from high priority to low priority, not the other way around.

BIG-IP provides several built-in TCP profiles optimized for different traffic patterns and network conditions. When attempting to improve general TCP performance, the recommended starting point is f5-tcp-progressive.

According to the BIG-IP Administration: Data Plane Configuration documentation:

f5-tcp-progressive is designed as a balanced, general-purpose TCP optimization profile.

It dynamically adjusts TCP behavior to improve throughput and latency for most enterprise applications.

It is the recommended first-choice profile when tuning TCP performance before moving to more specialized profiles.

Why the other options are incorrect:

A. f5-tcp-legacyThis profile exists for backward compatibility and does not include modern TCP optimizations.

C. f5-tcp-mobileThis profile is optimized specifically for high-latency, lossy mobile networks and is not suitable for general-purpose environments.

D. No optionBIG-IP explicitly provides built-in TCP profiles for performance tuning; using none would forgo optimization opportunities.

Correct Resolution:

The administrator should first apply f5-tcp-progressive to evaluate potential TCP performance improvements before considering more specialized profiles.

Fallback persistence is used when the primary persistence method fails. Source Address Affinity is a Layer 4 persistence method and is fully supported as a fallback option for most virtual server types.

A Performance (Layer 4) virtual server does not inspect or process application-layer data such as HTTP headers or cookies. Therefore, only Layer 4–compatible persistence methods can be used.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Source Address Affinity persistence operates at Layer 4 and uses the client IP address to maintain session persistence.

It is fully compatible with Performance (Layer 4) virtual servers.

It works regardless of encryption, making it suitable for TLS-secured applications.

Why the other options are incorrect:

B. Cookie persistenceRequires an HTTP profile and Layer 7 inspection, which is not supported on Performance virtual servers.

C. Microsoft RDP persistenceIs protocol-specific and not applicable to web-based TLS traffic.

D. Host persistenceRequires HTTP host header inspection, which is not available at Layer 4.

Correct Resolution:

Source Address Affinity persistence is the appropriate choice for maintaining persistence on a Performance (Layer 4) virtual server handling TLS traffic.

Below is Batch 1 (Questions 1–10) extracted only from your uploaded document that are directly related to BIG-IP Administration: Data Plane Configuration topics (Virtual Servers, Pools, Load Balancing, Monitors, Persistence, SNAT, Profiles).

I have excluded system-only, licensing, support, hardware, HA management-only, and admin UI questions that are not Data Plane–focused.

Source: Your uploaded TMOS Administration v2.0 document

✅ BATCH 1 (10 Questions)

Performance (Layer 4) virtual servers rely on FastL4 profiles to provide high-speed L4 processing without full proxy overhead.

Below is BATCH 2 (next 10 questions) extracted only from your uploaded document that are clearly related to BIG-IP Administration: Data Plane Configuration topics.

❗As requested, I have strictly excluded questions related to:

Licensing

HA / Device Trust / Sync-only

Logging destinations

User roles

Hardware, EUD, support processes

System-only administration

Source: Your uploaded TMOS Administration v2.0 document

WAN TCP profiles are optimized for high latency and packet loss typical of Internet clients, while LAN profiles are ideal for backend servers.

For HTTP-based applications, cookie persistence is the most appropriate and commonly recommended persistence method.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Cookie persistence inserts or uses an HTTP cookie to maintain session affinity.

It operates at Layer 7 (HTTP) and is application-aware.

It allows persistence to be maintained even when multiple clients are behind a NAT device.

Why the other options are incorrect:

A. Destination addressDestination address persistence is generally used for inbound traffic patterns such as firewall or proxy scenarios.

B. Hash persistenceHash persistence is less granular and not HTTP-specific.

C. SSL persistenceSSL persistence is typically used when SSL session IDs are reused and is less reliable than cookies for HTTP applications.

Correct Resolution:

Using cookie persistence ensures that HTTP web requests are consistently directed to the same pool member.

Source Address Affinity (Persistence) works by tracking the source IP address of incoming packets to ensure a client stays connected to the same backend server. The " netmask " setting within the persistence profile determines the " granularity " of this tracking. A netmask tells the BIG-IP how many bits of the source IP address to ignore when creating the persistence record. For example, the current setting of 255.0.0.0 (a /8 mask) means the BIG-IP only looks at the first octet of the IP; this results in all users from the same large Class A network (e.g., everyone from 10.0.0.0 to 10.255.255.255) being persisted to the exact same server, which can lead to severe load imbalance.

To ensure that each unique IP address creates its own individual persistence record, the administrator must set the netmask to 255.255.255.255 (for IPv4). This is a " host mask " or /32, which instructs the BIG-IP to evaluate all 32 bits of the client ' s source IP address. With this setting, 10.1.1.1 and 10.1.1.2 will be treated as distinct entities and can be load balanced to different servers, each maintaining their own " stickiness " . While Option A (255.255.255.0) would group users by their local subnet, only the full 255.255.255.255 mask satisfies the requirement for true unique-IP persistence. This configuration is standard for internet-facing applications where users arrive from diverse locations and the administrator wants to maintain the most granular and balanced distribution of traffic possible.

When multiple users share one source IP, source-address persistence fails. Cookie persistence uniquely identifies users at Layer 7 and ensures correct session handling.

When a pool contains servers with heterogeneous hardware capabilities (differing CPU, RAM, or connection limits), a static load balancing method like Round Robin is ineffective because it distributes requests equally, regardless of the server ' s capacity. To optimize traffic distribution for newer, more powerful servers, a dynamic or weighted method is required.

Weighted Least Connections (member): This is the ideal method for this scenario. It combines two factors:

Least Connections: It first checks the current active connection count to ensure traffic goes to the least busy server.

Weight (Ratio): It allows the administrator to assign a " Ratio " value to each pool member. Newer servers can be assigned a higher ratio (e.g., 3) while older servers are assigned a lower ratio (e.g., 1). The BIG-IP system uses these weights to disproportionately favor the newer servers even when connection counts are similar.

Why other options are incorrect:

Global Availability: This is primarily a GSLB (Global Server Load Balancing) or specific LTM priority group concept where traffic is sent to the first available member in a list until it fails, then moves to the next. It does not load balance based on capacity.

Round Robin: This passes each new connection request to the next server in line, treating the old and new servers exactly the same.

Least Connections (member): While this sends traffic to the server with the fewest active connections, it assumes all servers are equal. If an old server and a new server both have 10 connections, they are treated as equally capable of taking the 11th, which is not true in this scenario.

The issue of " lost shopping carts " in an ecommerce environment is a classic symptom of a missing or improperly configured Persistence Profile. In modern web applications, session data—such as items added to a cart—is often stored locally on the specific web server that initially handled the user ' s request. If the BIG-IP system load balances a user ' s subsequent request (like clicking " Checkout " ) to a different server among the 50 webservers, the new server will not have the session data, and the user will appear to have an empty cart.

While Least Connections (node) is an efficient load balancing algorithm, it makes a new decision for every connection unless persistence is enabled. To resolve this, the administrator must implement a persistence mechanism. HTTP Cookie Persistence (Option A) is the industry standard for web applications. By assigning a cookie persistence profile to the Virtual Server, the BIG-IP inserts a unique cookie into the HTTP response. When the user ' s browser returns that cookie in future requests, the BIG-IP identifies the specific server that handled the first request and consistently directs the user back to that same server for the duration of their session.

Sip_info (Option B) is a persistence method for VOIP traffic and is not applicable to web traffic. Ratio load balancing (Options C and D) merely changes the distribution frequency but still does not guarantee that a specific user will stay on the same server across multiple requests. Therefore, adding a cookie persistence profile is the direct procedural fix to maintain session state and ensure ecommerce functionality.

X-Forwarded-For inserts the original client IP into HTTP headers while SNAT is enabled.

In F5 BIG-IP systems, an iApp is a template-driven framework used to deploy and manage application-specific configurations. When an iApp is deployed, the system creates a specialized folder or " Application Service " container to hold all the resulting Local Traffic Manager (LTM) objects, such as virtual servers, pools, and profiles. This container is visually and programmatically identified by the .app extension in its path name.

The naming convention for these objects follows a specific hierarchical structure: / < partition > / < iapp_name > .app/ < object_name > . For example, if an administrator creates an iApp named " testhttp " in the " /Common " partition, the virtual server created by that iApp would be identified in the configuration (TMSH) and the GUI as /Common/testhttp.app/testhttp. This structure allows the BIG-IP system to distinguish between manually created objects and those managed by the iApp ' s automation logic.

This identification is crucial because iApp-managed objects typically have Strict Updates enabled, which prevents administrators from making direct manual changes to the object settings outside of the iApp ' s reconfigure interface. Attempting to modify such an object directly will result in an error message stating that the application service must be updated using an application management interface. By recognizing the .app path and the repeated name within the structure, an administrator can immediately identify that the object belongs to an iApp and should be managed through the iApp ' s specific management screen rather than standard LTM configuration menus.

Application-level monitors ensure that only the affected service is marked down, not the entire node.

Standard DNS queries use UDP. Configuring the Virtual Server for TCP causes DNS traffic to fail.

SSH (Secure Shell) operates over TCP port 22 , making the TCP health monitor the appropriate and correct choice for monitoring pool members in an SSH pool. The TCP monitor establishes a basic Layer 4 connection to each pool member on the designated port, verifying that the server is reachable and actively accepting TCP connections. A successful three-way handshake confirms the pool member is available; a failure marks it down and removes it from load balancing rotation.

The remaining monitor types are inappropriate for this use case:

UDP monitor operates at Layer 4 but uses the connectionless UDP protocol, which is incompatible with SSH since SSH exclusively uses TCP as its transport.

HTTP monitor sends a Layer 7 GET request expecting an HTTP response — irrelevant for an SSH service that does not speak the HTTP protocol.

HTTPS monitor functions identically to HTTP but over TLS — again, completely misaligned with SSH traffic and port behaviour.

For application-specific SSH validation beyond basic TCP connectivity, an external monitor or custom monitor could be used; however, TCP remains the standard and correct built-in monitor for SSH pool verification within the BIG-IP platform.

SSH is a Layer 4 TCP-based protocol that operates on TCP port 22 and does not use HTTP in any capacity. In the exhibit, the Virtual Server is configured with an HTTP Profile applied, which is inappropriate for SSH traffic and causes connection failures.

According to the BIG-IP Administration: Data Plane Configuration documentation:

An HTTP profile must only be applied to Virtual Servers handling HTTP or HTTPS traffic.

When an HTTP profile is attached, BIG-IP expects HTTP headers and attempts to parse application-layer data.

Non-HTTP protocols such as SSH, FTP (control), SMTP, and other raw TCP services will fail if an HTTP profile is enabled.

Why the other options are incorrect:

A. Set Protocol to UDPSSH uses TCP, not UDP. Changing the protocol would break SSH entirely.

B. Set Source Address to 10.1.1.2The source address setting controls client access restrictions and is unrelated to protocol parsing issues.

C. Set Destination Address/Mask to 0.0.0.0/0The destination address is already valid for a specific SSH service and does not impact protocol handling.

Correct Resolution:

The BIG-IP Administrator should remove the HTTP Profile (set it to None) so the Virtual Server functions as a pure Layer 4 TCP service, allowing SSH connections to pass through successfully.

A 400 Bad Request response from an HTTP/1.1 web server is a definitive indicator that the HTTP request sent by the health monitor is missing a required Host header . In HTTP/1.1, the Host header is mandatory per RFC 7230. Web servers — particularly those hosting named virtual hosts such as www.f5.com — will reject any HTTP/1.1 request that omits the Host header, returning a 400 error, which the BIG-IP monitor interprets as a failed health check, marking all members DOWN.

The correct Send string must include:

The GET request line with HTTP/1.1 protocol declaration

A \r\n (carriage return + line feed) after the request line

The Host: www.f5.com header to satisfy HTTP/1.1 requirements

A \r\n after the Host header

Connection: Close header to instruct the server to close the connection after responding

A final \r\n\r\n to properly terminate the HTTP request headers

Only option C satisfies all these requirements with the correct syntax and Host header inclusion.

Option D (the current configured string) omits the Host header entirely — the root cause of the 400 error. Options A and B are structurally incomplete or syntactically malformed.

To determine if an iRule is influencing traffic for a specific Virtual Server, the administrator must verify the association between the Virtual Server object and any applied scripts. In the BIG-IP Configuration Utility (GUI), this association is found under the Resources tab of the specific Virtual Server. While there is an " iRules " sub-menu under Local Traffic, checking the Virtual Server ' s Resources tab is the definitive way to see which specific rules are currently active and in what order they are being processed for that particular traffic flow.

From the Command Line Interface (CLI), the tmsh list /ltm virtual < virtual_server > command provides a full text-based output of the virtual server ' s configuration. If iRules are applied, they will appear within a " rules { ... } " block in the command output. This is more effective than Option A, which only lists the contents of the iRule itself but does not show if or where it is applied. Option C is a common misconception; while some versions of the GUI have reorganized menus, the standard location for managing the association of profiles, policies, and iRules to a Virtual Server remains the " Resources " section. By identifying the applied iRule, an administrator can then review the script logic—often containing commands like pool or node—to see if it is overriding the default pool selection based on specific HTTP headers, URI paths, or client IP addresses.