F5CAB3 Practice Questions

The f5-tcp-progressive profile is designed as a high-performance profile that aggressively optimizes TCP connections for modern, reliable networks. It incorporates features like a larger initial congestion window, Appropriate Byte Counting (ABC), and other enhancements over the default TCP profile. For a general investigation into improving TCP performance, this profile is the recommended first choice as it provides significant throughput gains on networks with low-to-moderate latency and packet loss, which is a common starting environment.

A. The f5-tcp-legacy profile is designed for compatibility with older TCP stacks and generally offers lower performance than modern profiles.

B. The f5-tcp-mobile profile is specifically optimized for high-latency, high-packet-loss networks typical of mobile and cellular connections.

D. The f5-tcp-wan profile is optimized for Wide Area Networks, focusing on handling higher latency and lower bandwidth than a typical LAN environment.

1. F5 Networks. (2021). BIG-IP TMOS: Implementations, version 16.1. Chapter 11: "TCP and HTTP Profiles". The guide describes f5-tcp-progressive as a profile that "aggressively optimizes the TCP connection for the LAN" and is a good starting point for performance tuning.

2. F5 Networks. (2021). K8024: The BIG-IP LTM f5-tcp-progressive TCP profile. This knowledge base article explicitly states, "The f5-tcp-progressive profile is a pre-configured, aggressive profile that you can use for general purpose performance improvements." It details the specific settings that enhance performance.

The exhibit shows the virtual server is configured with the TCP protocol. Standard DNS queries use the User Datagram Protocol (UDP) on port 53. While DNS can use TCP for larger responses or zone transfers, the failure of all queries strongly indicates a fundamental protocol mismatch. The BIG-IP is listening for TCP connections, but the internal DNS servers are sending UDP packets, which are being dropped. Changing the virtual server's protocol to UDP will allow it to correctly process the incoming DNS queries.

A. A DNS profile optimizes DNS traffic handling but does not change the underlying transport protocol (TCP/UDP) that the virtual server accepts.

B. The Performance (HTTP) virtual server type is specifically optimized for HTTP traffic and is not appropriate for DNS services.

C. This would restrict the source of traffic. While the current sources are within this range, it does not fix the protocol mismatch causing the failure.

F5 Networks (2021). BIG-IP LTM: Implementations, F5-BIG-LTM-13.1, Chapter 2: Implementing a Basic Network, Section: Configuring a virtual server, p. 2-11. The guide specifies selecting the appropriate protocol (TCP or UDP) for the service being load-balanced.

Mockapetris, P. (1987). RFC 1035: Domain Names - Implementation and Specification. IETF. Section 4.2, "Transport," states that UDP is the primary transport for standard queries, while TCP is used for tasks like zone transfers.

The requirement is to distribute traffic based on the current load of each server, specifically the number of active connections. The "Least Connections (member)" load balancing method is designed for this exact purpose. It tracks the number of active connections for each pool member (a specific IP address and port combination) and directs new connections to the member with the fewest active connections at that moment. This ensures an even distribution of traffic among servers based on their real-time load.

B. Round Robin: This method distributes connections sequentially to each pool member in a circular order, without considering the current connection load.

C. Ratio (member): This method distributes connections based on a static, administrator-defined weight or ratio, not on the dynamic number of active connections.

D. Ratio (node): This is similar to Ratio (member) but applies the static ratio to the entire node (server) rather than a specific service port.

F5 Networks. (2021). BIG-IP LTM Local Traffic Manager: Concepts, 16.1. "Load Balancing Pools," Section: Load balancing methods. This section explicitly describes the "Least Connections" method as one that distributes connections to the pool member that has the lowest number of active connections.

F5 Knowledge Base. (2022). K8986: The BIG-IP LTM load balancing methods. This article provides a detailed description of each method, stating that Least Connections (member) "selects the pool member that currently has the least number of active connections."

To verify if an iRule is affecting traffic for a specific virtual server, an administrator needs to check which iRules are associated with it. An iRule can contain logic to select a pool or node, overriding the virtual server's default pool. The list /ltm virtual TMSH command displays the virtual server's configuration, including a "rules" section listing all applied iRules. In the GUI, navigating to the virtual server's properties and selecting the "Resources" tab shows the same list of assigned iRules.

Via TMSH with the list /ltm rule command.: This command shows the content of a specific iRule but does not show which virtual server it is applied to.

Via the GUI at the iRule tab for the virtual server.: There is no "iRule tab" on the virtual server properties page; iRules are managed under the "Resources" tab.

1. F5 Networks. (2021). Traffic Management Shell (tmsh) Reference Guide. Section: ltm virtual. The reference for the list /ltm virtual command shows that the output includes the rules attribute, which lists associated iRules.

2. F5 Networks. (2021). BIG-IP System: Getting Started Guide. Chapter: Virtual Servers. The guide's screenshots and instructions for configuring a virtual server show that iRules are assigned on the "Resources" tab of the virtual server's properties page.

3. F5 Networks. (2021). BIG-IP LTM Concepts. Chapter 11: iRules. "You manage iRules on a virtual server by way of the Resources tab on the Virtual Server screen."

To secure traffic between users and the virtual server, a Client SSL profile is required on the BIG-IP. This profile terminates the client's SSL/TLS connection. When multiple hostnames resolve to the same virtual server IP address, Server Name Indication (SNI) must be used. SNI allows the client to specify the intended hostname in the TLS handshake. The BIG-IP uses this information to select and present the correct server certificate. This functionality is enabled in the Client SSL profile by configuring the "Server Name" setting, which makes the profile SNI-aware.

A. Client SSL is the correct profile type, but "Client Name" is not the setting used for SNI; the correct setting is "Server Name".

B. A Server SSL profile is used to re-encrypt traffic from the BIG-IP to backend servers, not for user-to-virtual-server communication.

C. A Server SSL profile is for BIG-IP to backend server communication, and while it has a "Server Name" setting for SNI, it's the wrong profile for this scenario.

1. F5 Networks. (2021). BIG-IP System: SSL Administration, version 16.1. "Configuring the BIG-IP System to use SNI to secure traffic for multiple sites". This section details using a Client SSL profile with the Server Name setting to support multiple hostnames on a single virtual server.

2. F5 Networks. (2021). BIG-IP System: SSL Administration, version 16.1. "Client SSL profile settings". The documentation specifies the "Server Name" setting as the field for the fully-qualified domain name of the server, used for SNI.

By default, with all members online, a BIG-IP system uses its configured load balancing method (e.g., Round Robin) to distribute new connections across all available pool members. Adding a persistence profile fundamentally alters this behavior. Persistence instructs the BIG-IP system to send subsequent requests from the same client to the same pool member that serviced the client's initial request. This overrides the load balancing decision for the duration of the persistence entry, ensuring session continuity for the client at the expense of pure load distribution.

A. A OneConnect profile optimizes server-side TCP connections by reusing them but does not override the initial load balancing decision for a new client session.

B. SNAT Automap modifies the source IP address of traffic for routing purposes. It does not directly influence the server selection logic of the load balancing algorithm.

C. An HTTP fallback host is a feature used only when all pool members are marked 'down'. The scenario specifies all members are online.

- F5 Networks (2021). BIG-IP LTM: Concepts, F5-BIG-LTM-CON, Version 16.1. Chapter 6: Persistence, Section: Introducing connection persistence, p. 6-1. "Persistence is a feature of the BIG-IP system that allows the system to direct a client's requests to the same pool member... This is because persistence overrides the load balancing method."

- F5 Networks. (n.d.). K7392: Overview of the OneConnect profile. F5 Support. This article explains OneConnect's function as a connection pooling mechanism, distinct from load balancing or persistence logic.

A Performance (Layer 4) virtual server operates at the transport layer (TCP/UDP) and does not have visibility into application-layer data. Therefore, persistence methods requiring application data inspection, such as cookies or host headers, cannot be used. Source Address Affinity persistence works by tracking the client's source IP address, which is available at Layer 3. This makes it a compatible and effective persistence method for a Performance (L4) virtual server, as it does not require any application-layer processing.

B. Cookie persistence requires an HTTP profile to inspect and insert HTTP cookies, which is not available on a Performance (L4) virtual server.

C. Microsoft RDP persistence is specific to the RDP protocol and requires application-layer inspection, which is incompatible with a Performance (L4) virtual server.

D. Host persistence uses the HTTP Host header for persistence decisions, requiring an HTTP profile not present on a Performance (L4) virtual server.

1. F5 Networks. (2021). BIG-IP Local Traffic Manager: Concepts, Chapter 3: Virtual Servers. F5 Cloud Docs. Retrieved from https://techdocs.f5.com/kb/en-us/products/big-ipltm/manuals/product/ltm-concepts-13-1-0/3.html. (See section: "Virtual server types", specifically "Performance (Layer 4) virtual server").

2. F5 Networks. (2021). K7786: Overview of BIG-IP LTM persistence profiles. F5 Support. Retrieved from https://support.f5.com/csp/article/K7786. (See section: "Source address affinity persistence").

The "Least Connections (node)" method is the most appropriate choice. This algorithm tracks the number of active connections for each node (a specific IP address representing a server) rather than for each member (a specific IP:port combination). When multiple services (members) run on the same server (node), this method ensures that new connections are sent to the server with the fewest total connections across all its services, achieving an even distribution of load on the physical backend servers.

A. Least Connections (member): This method only considers connections to a specific service (IP:port), not the total load on the server, leading to imbalanced server utilization.

C. Predictive (member): This method forecasts server performance based on recent trends for a specific service, not the overall connection count on the server.

D. Predictive (node): This method forecasts performance for the entire node but is more complex and focuses on performance trends rather than simply equalizing connection counts.

1. F5 Networks. (2021). BIG-IP Local Traffic Manager: Concepts. Chapter 4: Load Balancing Pools, Section: Load balancing methods. "The Least Connections (node) method causes the BIG-IP system to select the node that currently has the least number of connections."

2. F5 Knowledge Center. (2022). K14171524: Overview of BIG-IP LTM load balancing methods. Section: Least Connections (node). "This method is best for an environment where nodes are load balancing traffic for multiple virtual servers and you want to equalize the number of connections to that node."

To handle encrypted traffic from users to the virtual server, a Client SSL profile is required. When multiple hostnames resolve to the same virtual server IP, the BIG-IP system must present the correct SSL certificate for the requested hostname. This is achieved using the Transport Layer Security (TLS) extension called Server Name Indication (SNI). Within the BIG-IP Client SSL profile, the "Server Name" setting is used to specify the hostname that corresponds to the certificate and key, enabling the system to serve the correct certificate based on the name provided by the client in the TLS handshake.

A. Client SSL, Client Name: "Client Name" is not a valid setting in a Client SSL profile for selecting a server certificate based on hostname.

B. Server SSL, Server Name: A Server SSL profile is used to re-encrypt traffic from the BIG-IP to the backend servers, not for the client-to-BIG-IP connection.

D. Server SSL, Client Name: This uses the incorrect profile type for the client-facing connection and an invalid setting for SNI.

- F5 Networks. (2021). BIG-IP LTM Local Traffic Manager: Implementations. Chapter 4: Implementing SSL/TLS, Section: Configuring the BIG-IP system to use SNI to secure traffic to multiple sites.

- F5 Knowledge Base. (2022). K13452: Configure a virtual server to serve multiple HTTPS sites using the TLS Server Name Indication feature. This article details the procedure, specifying the use of a Client SSL profile and configuring the "Server Name" field.

- F5 Networks. (2021). BIG-IP System: SSL Administration. Chapter: SSL Profiles, Section: Client SSL profiles, Subsection: Certificate and Key. This section describes the "Server Name" setting for SNI support.

The VLAN Fail-safe feature is a high-availability mechanism that monitors a VLAN for network traffic. If no traffic is detected on a failsafe-enabled VLAN for a specified timeout period, the BIG-IP system assumes a network failure has occurred on that link and initiates a failover to its peer device. When a new VLAN is created and Fail-safe is enabled on it, but no devices are communicating on it yet, the failsafe timer will expire, triggering an unintended failover. To prevent this, the administrator should disable Fail-safe on the new VLAN until it is actively passing traffic.

A. Auto Last Hop is a routing feature that ensures return packets use the same MAC address they arrived from, unrelated to HA failover.

B. Source Check is a security feature on a VLAN to prevent IP spoofing and is not a failover trigger.

D. A Customer Tag is simply a user-defined metadata tag for a VLAN and has no impact on system operations or failover.

- F5 Networks. (2021). BIG-IP Device Service Clustering: Administration. BIG-IP 16.1. Chapter 5: High Availability Features. Section: Understanding Fail-safe. "VLAN failsafe is a feature where the BIG-IP system monitors for traffic on a specified VLAN. If the system detects a loss of traffic... it initiates a failover."

- F5 Support. (2022). K13297: Overview of VLAN failsafe (11.x - 17.x). AskF5. "If the BIG-IP system does not receive any packets on the VLAN for half of the configured VLAN failsafe timeout value, the system may initiate a failover."

- F5 Networks. (2021). BIG-IP TMOS: Routing Administration. BIG-IP 16.1. Chapter 1: VLANs and Trunks. Section: Configuring fail-safe for a VLAN. This section details the configuration and purpose of VLAN failsafe.