F5CAB5 Practice Questions

According to official F5 documentation (K52015891 – Troubleshooting BIG-IP power supply issues),

hardware-related alerts for power supplies, fans, and chassis components are logged in /var/log/ltm.

When a BIG-IP device experiences a power supply issue—such as failure, intermittent outages, or

fan-related faults—the system generates alerts through internal platform monitoring services. These

alerts are written to the /var/log/ltm file and often appear with messages similar to:

Chassis power supply 2 has experienced an issue. Status is as follows: FAN=bad; STATUS=bad.

This makes /var/log/ltm the authoritative log file for identifying and verifying power supply and

chassis-related problems on BIG-IP systems.

The other log files are not appropriate for this purpose:

/var/log/daemon.log contains general daemon messages but is not the primary source for chassis

hardware alerts.

/var/log/kern.log logs kernel-level events, not platform power status.

/var/log/audit records administrative actions and configuration changes.

Conclusion:

Per F5-supported guidance, when suspecting power supply outages or chassis hardware issues, the

BIG-IP Administrator should always check /var/log/ltm first.

To view performance statistics for a specific virtual server, such as current connections, packets, and throughput, the administrator must navigate to the Virtual Servers statistics screen. While this screen does not show CPU utilization per virtual server (as CPU is a system-wide resource), it is the designated location within the Configuration Utility for all traffic-related metrics and performance data specific to that virtual server object. This is the most appropriate location to begin investigating the performance of a particular virtual server.

A. This section shows statistics for the virtual IP address object, not the virtual server configuration which includes profiles, pools, and iRules.

B. This provides a high-level, system-wide summary of traffic, lacking the granular detail needed for a single virtual server.

C. This shows CPU usage by system daemons (e.g., tmm, mcpd), not statistics attributable to a specific virtual server object.

1. F5 Networks. (2021). BIG-IP Local Traffic Manager: Implementations. Chapter 10: Monitoring BIG-IP LTM Objects. The guide details navigating the GUI to Statistics > Module Statistics > Local Traffic to view statistics for different LTM objects, including Virtual Servers.

2. F5 Networks. (2021). BIG-IP Systems: Administration and Diagnostics. Chapter 2: BIG-IP System Utilities and Tools. This document describes using the Configuration Utility for monitoring, specifying the path Statistics > Module Statistics > Local Traffic for LTM-specific data.

Uneven load balancing where one member receives all traffic can be caused by two primary factors. First, if health monitors have marked all other pool members as 'down', the BIG-IP system will direct all new connections to the single remaining 'up' member. Second, a persistence profile can cause this behavior. If a single client establishes a persistent session and then generates a high volume of traffic, all of that traffic will be "stuck" to the same pool member, creating an imbalance, even if other members are available.

A. A virtual server marked down would not process any traffic, so no connections would be sent to any pool member.

D. If all pool members are marked down, the virtual server would also be marked down (by default) and no traffic would be forwarded.

1. F5 Networks (2021). BIG-IP Local Traffic Manager: Concepts, K00451023, Chapter 4: Pools, Section: 'Understanding pool, pool member, and node status'.

2. F5 Networks (2021). BIG-IP Local Traffic Manager: Concepts, K00451023, Chapter 6: Persistence, Section: 'Understanding persistence'.

3. F5 Networks (2021). BIG-IP Local Traffic Manager: Monitors, K51452193, Chapter 1: Introducing BIG-IP Monitors, Section: 'About health and performance monitors'.

The exhibit shows a Virtual Server configured with an HTTP profile, but the intended traffic is SSH. An HTTP profile instructs the BIG-IP system to parse traffic according to RFC standards for HTTP. When non-HTTP traffic like SSH is sent to this virtual server, the system cannot parse it, leading to a connection reset. To allow raw TCP traffic like SSH to pass through correctly, the HTTP profile must be removed by setting it to 'None'.

A. Set Protocol to UDP: SSH is a TCP-based protocol, not UDP. Changing the protocol to UDP would prevent any TCP-based SSH connection from being established.

C. Set Source Address to 10.1.1.2: This would restrict access to a single source IP address and does not address the underlying protocol-level incompatibility causing the failure.

D. Set Destination Addresses/Mask to 0.0.0.0/0: This changes the virtual server to a wildcard listener, which is not the issue. The problem is the incorrect profile handling the traffic.

1. F5 Networks. (2021). BIG-IP LTM: Implementations - Chapter 3: F5 LTM Profiles. F5 Support (AskF5), K00809333. (This guide explains that profiles must match the type of traffic being processed.)

2. F5 Networks. (2023). About Virtual Servers. BIG-IP Local Traffic Manager: Concepts, 17.1.x. F5 Cloud Docs. (Section: "Virtual server components," which details the function of profiles.)

3. F5 Networks. (2017). SOL14783: The BIG-IP LTM system may drop or reset connections that do not match the virtual server's protocol profile. F5 Support (AskF5), K14783. (This article explicitly describes connection failures when traffic does not match the applied profile.)

The "Connection Limit" setting on a virtual server defines the maximum number of concurrent connections it can handle. If this limit is reached on a busy virtual server, the BIG-IP system will, by default, reset any new connection attempts. Since the problem states pool member resources are not a factor, a misconfigured (too low) connection limit on the BIG-IP itself is a direct and likely cause for the observed connection resets during peak traffic.

A. The Connection Rate Limit is set too high: A high connection rate limit would allow more new connections per second, which is the opposite of what would cause resets on a busy system.

B. The server SSL Profile has NOT been reconfigured.: While an SSL profile issue can cause connection failures, it is not directly tied to the server being "busy" or the number of concurrent connections.

D. The Rewrite Profile has NOT been configured.: A rewrite profile modifies URI paths. Its absence would not cause connection resets based on the number of concurrent connections.

- F5 Networks. (2021). BIG-IP Local Traffic Manager: Concepts. Chapter: "Virtual Servers". Section: "Virtual server settings". The documentation specifies that the Connection Limit setting "specifies a maximum number of concurrent connections allowed for a virtual server. The default value of 0 (zero) specifies that there is no limit."

- F5 Support. (2020). K7543: The BIG-IP LTM can be configured to limit the number of concurrent connections to a virtual server. This article explicitly states, "When the connection limit is reached, the BIG-IP system resets subsequent TCP connection requests to the virtual server."

The log messages indicate the BIG-IP system's Traffic Management Microkernel (TMM) has exceeded its high-water memory threshold, triggering the "Aggressive mode" of the connection sweeper. This is a protective mechanism to reclaim memory under heavy load. The second log line, "1 Connections killed," explicitly confirms that the system has started terminating (reaping) existing connections to free up memory resources. This action is a direct result of the TMM memory exhaustion.

B. The log explicitly states "1 Connections killed," not that all connections are dropped. The sweeper selectively reaps connections, typically starting with the oldest and idlest ones.

D. The log message specifies "(global memory)," which refers to TMM memory, not the host's swap memory. While related, they are distinct memory pools with different triggers.

- F5 Networks. (2021). BIG-IP TMM and system memory limits. AskF5 article K15740. "When TMM memory usage exceeds the high-water mark (85 percent by default), the system invokes the aggressive sweeper to reap connections."

- F5 Networks. (2021). The BIG-IP system may log the 'Aggressive mode sweeper' message. AskF5 article K15475. "This message indicates that the BIG-IP system is experiencing high TMM memory utilization... the system begins to terminate connections to reclaim memory."

- F5 Networks. (2017). BIG-IP LTM Concepts. Chapter: Memory Management. "The aggressive sweeper is activated when memory utilization reaches the high-water mark... it begins to drop connections."

A Fallback Persistence Profile is used when the primary persistence method fails (e.g., a client browser rejects a cookie). In this scenario, the BIG-IP system needs a reliable, alternative method to maintain session integrity. Source Address Affinity persistence, which uses the client's IP address, is the most common and recommended choice for a fallback profile. It is a "universal" method that does not depend on application-layer data and will almost always be available, ensuring connections from the same client are sent to the same pool member.

A. SSL: SSL persistence relies on the SSL Session ID. If the primary persistence failed, there is no guarantee the SSL session ID would be a reliable fallback.

B. Hash: Hash is a method used within various persistence profiles (including source address) to distribute traffic, not a standalone profile type suitable for fallback.

C. Universal: Universal persistence requires a custom iRule to define the persistence key. While powerful, it is more complex than necessary for a simple, reliable fallback mechanism.

- F5 Networks. (2021). BIG-IP Local Traffic Manager: Concepts. Chapter: "Understanding Persistence". Section: "Using fallback persistence". The documentation states, "A common profile to use as a fallback persistence profile is a source address affinity persistence profile... This is useful when the client is a browser that does not accept cookies, preventing cookie persistence from being used."

- F5 Networks. (2021). BIG-IP Local Traffic Manager: Implementations. Chapter: "Configuring Persistence". Section: "Implementing fallback persistence". This guide provides examples and reinforces that source address affinity is the typical choice for the fallback profile.

A QKView file is the primary diagnostic data collection utility used for troubleshooting and for providing information to F5 Support. To generate a QKView file using the BIG-IP Configuration Utility (the web-based GUI), an administrator must navigate to the System > Support menu. This page provides the interface for creating a new support snapshot (QKView) and managing existing ones.

A. The System > Configuration menu is used for managing device-level settings like hostname, NTP, and DNS, not for generating support files.

B. The System > Archive menu is used for creating and restoring User Configuration Set (UCS) archives, which are system backups.

D. The System > Logs menu provides access to view various system log files directly but does not have the function to generate a QKView bundle.

1. F5 Knowledge Base, K12878: "Generating BIG-IP diagnostic data using the qkview utility," F5 Networks, Inc. The section "Generate a qkview file from the Configuration utility" explicitly states the navigation path is System > Support.

2. BIG-IP System: Essentials, "Chapter 10: Maintaining the BIG-IP System," Section: "Working with BIG-IP system support data." This chapter details the procedure and confirms the menu location.

A red diamond icon next to a virtual server indicates its status is "Unavailable." This means the virtual server is enabled but cannot process traffic because its required resources are not available. This status typically occurs when the associated pool(s) are also marked as unavailable. A pool becomes unavailable if all of its members are marked "down" (e.g., by a failed health monitor) or have been administratively "disabled." Therefore, both all pool members being down and all pool members being disabled are valid causes for this issue.

B. Receiving incorrect traffic might cause connection resets but does not directly change the virtual server's availability status icon to red.

C. A disabled virtual server is marked with a black diamond (or black circle), indicating it has been administratively taken offline.

1. F5 Networks. (2021). BIG-IP Local Traffic Manager: Concepts. Chapter 3: Virtual Servers. The section on "Virtual Server Status" describes the various status icons.

2. F5 Knowledge Center. (2022). K13310: BIG-IP object status icons. This article explicitly defines the red diamond as "Unavailable - The object is not available for load balancing." It clarifies this state for a virtual server is often due to all associated pool members being unavailable.

3. F5 Networks. (2021). TMOS Management Guide for BIG-IP Systems. Chapter 15: Monitoring the Health of the System. This guide explains how health monitors mark pool members down, which in turn affects pool and virtual server status.

Creating a trunk (link aggregation) combines multiple physical interfaces into a single logical interface, effectively multiplying the available bandwidth. This is the standard method for increasing bandwidth beyond a single interface's capacity. The trunk appears as a single logical interface to the system while providing the combined bandwidth of all member interfaces.

A: Multiple interfaces on a VLAN provide redundancy, not bandwidth aggregation.

B: Media speed is constrained by hardware capabilities and cannot exceed physical limits.

D: MTU changes affect packet efficiency, not the total bandwidth capacity.

- F5 BIG-IP TMOS Operations Guide, Chapter on Trunks and Link Aggregation

- F5 Networks Official Documentation: "Configuring Trunks" section in BIG-IP System: Platform Guide

- F5 BIG-IP LTM Concepts Guide, Network Interface Configuration section