Get Ready to Boost your Prepare for your F5CAB2 Exam with 68 Questions
Use Free F5CAB2 Exam Questions that Stimulates Actual EXAM
F5 F5CAB2 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 24
The network architecture for a BIG-IP consists of an external VLAN and an internal VLAN with two interfaces connected to the upstream switch. The design requires fault tolerance in the case that one of the interfaces is down. Which deployment architecture meets these requirements? (Choose one answer)
- A. One network trunk with both VLANs and LACP enabled, and both VLANs configured as untagged
- B. One network trunk with both VLANs and LACP enabled, and both VLANs configured as tagged
- C. Two network trunks each with one VLAN and LACP disabled, and one VLAN configured as tagged and one VLAN configured as untagged
- D. Two network trunks each with one VLAN and LACP enabled, and both VLANs configured as tagged
Answer: B
Explanation:
To meet the requirement of fault tolerance when one interface goes down, BIG-IP must use link aggregation so that loss of a single physical link does not isolate the VLAN(s).
How the objects relate (data plane view)
* Interfaces = physical links.
* Trunk (LACP) = bundles multiple interfaces into one logical link that provides redundancy (and possibly bandwidth aggregation).
* VLANs are assigned to interfaces or trunks. If you need multiple VLANs on the same trunk, they must use 802.1Q tagging (because you can only have one untagged VLAN per interface/trunk).
* Self IPs are then placed on the VLANs to provide BIG-IP presence and routing/ARP functions, but self IPs are not what provides link resiliency-the trunk does.
Why Option D is correct
* You have two physical interfaces and you want resiliency if one fails # put both interfaces into one trunk with LACP enabled.
* You need both external and internal VLANs on those same two links # both VLANs should be configured as tagged on that trunk, so they can coexist on the same aggregated link.
* If either physical interface fails, the trunk remains up via the remaining interface, keeping both VLANs operational.
Why the other options are incorrect
* A: Two VLANs cannot both be untagged on the same trunk/interface. Only one untagged VLAN is possible; additional VLANs must be tagged.
* B: Two trunks "each with one VLAN" would typically mean splitting VLANs across separate trunks.
With only two interfaces total, that becomes one interface per trunk-if one interface goes down, the VLAN on that interface is down (no redundancy for that VLAN).
* C: Same redundancy problem as B, and disabling LACP removes the negotiated aggregation behavior expected when the switch engineer specifically requested LACP.
NEW QUESTION # 25
An application is configured so that the same pool member must be used for an entire session, and this behavior must persist across HTTP and FTP traffic. A user reports that a session terminates and must be restarted after the active BIG-IP device fails over to the standby device.
Which configuration settings should the BIG-IP Administrator verify to ensure proper behavior when BIG-IP failover occurs? (Choose one answer)
- A. SYN-cookie insertion threshold and connection low-water mark
- B. Cookie persistence and session timeout
- C. Stateful failover and Network Failover detection
- D. Persistence mirroring and Match Across Services
Answer: D
Explanation:
These are DoS / SYN flood protection settings, unrelated to persistence or HA behavior.
Explanation:
Comprehensive and Detailed Explanation (BIG-IP Administration - Data Plane Concepts):
This scenario combines session continuity, multiple protocols (HTTP and FTP), and HA failover behavior, which directly implicates persistence handling across devices and services.
Key Requirements Breakdown
Same pool member for entire session
Session must survive failover
Session must span multiple services (HTTP and FTP)
Why Persistence Mirroring + Match Across Services Is Required
Persistence Mirroring
Ensures persistence records are synchronized from the active BIG-IP to the standby BIG-IP.
Without mirroring:
After failover, the standby device has no persistence table
Clients are load-balanced again
Sessions break, forcing users to restart
Persistence mirroring is essential for session continuity during failover Match Across Services Allows a single persistence record to be shared across multiple virtual servers / protocols Required when:
HTTP and FTP must use the same pool member
Multiple services are part of a single application session
Together, these settings ensure:
Persistence survives device failover
Persistence is honored across HTTP and FTP
Why the Other Options Are Incorrect
A . Cookie persistence and session timeout
Cookie persistence only applies to HTTP and does not address FTP or failover synchronization.
B . Stateful failover and Network Failover detection
Stateful failover applies to connection state, not persistence records, and does not link HTTP and FTP sessions.
NEW QUESTION # 26
A BIG-IP Administrator has acluster of devices.
What should the administrator doafter creating a new Virtual Server on device 1? (Choose one answer)
- A. Synchronize the settings of thegroup to device 1
- B. Create a new cluster on device 1
- C. Synchronize the settings ofdevice 1 to the group
- D. Create a new virtual server on device 2
Answer: C
Explanation:
In a BIG-IPdevice service cluster, configuration objects such asvirtual servers, pools, profiles, and iRules are maintained throughconfiguration synchronization (config-sync).
Key BIG-IP concepts involved:
* Device Service Cluster (DSC)A cluster is a group of BIG-IP devices that share configuration data. One device is typically used to make changes, which are then synchronized to the rest of the group.
* Config-Sync Direction Matters
* Changes are made on alocal device
* Those changes must bepushed to the group
* The correct operation is"Sync Device to Group"
WhyCis correct:
* The virtual server was createdonly on device 1
* Other devices in the cluster do not yet have this object
* To propagate the new virtual server to all cluster members, the administrator mustsynchronize device 1 to the group Why the other options are incorrect:
* A. Synchronize the settings of the group to device 1This would overwrite device 1's configuration with the group's existing configuration and mayremove the newly created virtual server.
* B. Create a new cluster on device 1The cluster already exists. Creating a new cluster is unnecessary and disruptive.
* D. Create a new virtual server on device 2This defeats the purpose of centralized configuration management and risks configuration drift.
Conclusion:
After creating a new virtual server on a BIG-IP device that is part of a cluster, the administrator must synchronize the configuration from that device to the groupso all devices share the same ADC application objects.
NEW QUESTION # 27
Active connections to pool members are unevenly distributed. The load balancing method is Least Connections (member). Priority Group Activation is disabled.
What is a potential cause of the uneven distribution? (Choose one answer)
- A. Incorrect load balancing method
- B. A persistence profile is applied
- C. SSL Profile Server is applied
- D. Priority Group Activation is disabled
Answer: B
Explanation:
Comprehensive and Detailed Explanation (BIG-IP Administration - Data Plane Concepts):
With Least Connections (member), BIG-IP attempts to send new connections to the pool member with the fewest current connections. In a perfectly "stateless" scenario (no affinity), this often trends toward a fairly even distribution over time.
However, persistence overrides load balancing:
When a persistence profile is applied, BIG-IP will continue sending a client (or client group) to the same pool member based on the persistence record (cookie / source address / SSL session ID, etc.).
This means even if another pool member has fewer connections, BIG-IP may still select the persisted member to honor session affinity.
The result can be uneven active connection counts, even though the configured load balancing method is Least Connections.
Why the other options are not the best cause:
A . Priority Group Activation is disabled
Priority Group Activation only affects selection when priority groups are configured; disabling it does not inherently create uneven distribution under Least Connections.
B . SSL Profile Server is applied
A server-side SSL profile affects encryption to pool members, but it does not by itself cause skewed selection across pool members. (Skew could happen indirectly if members have different performance/latency, but that's not the primary, expected exam answer.) D . Incorrect load balancing method Least Connections is a valid method and does not itself explain unevenness unless something is overriding it (like persistence) or pool members are not all eligible.
Conclusion:
A persistence profile is the most common and expected reason that active connections become unevenly distributed, because persistence takes precedence over the Least Connections load-balancing decision.
NEW QUESTION # 28
Which virtual server type is being configured in the screenshot? (Choose one answer.)
- A. Forwarding IP
- B. Performance Layer 4
- C. Standard
Answer: B
Explanation:
The configuration shown matches a Performance Layer 4 virtual server because it is explicitly using a FastL4 profile:
* The screenshot shows Protocol: TCP and Protocol Profile (Client): fastL4.In BIG-IP data plane terms, FastL4 is the hallmark of a Performance (Layer 4) virtual server, designed to process connections at Layer 4 with minimal overhead (high throughput/low latency) compared to full proxy L7 processing.
* The screenshot also shows HTTP Profile (Client): None (and HTTP server profile effectively not in use).A Standard virtual server commonly uses full-proxy features and frequently includes L7 profiles (like HTTP) when doing HTTP-aware load balancing, header manipulation, cookie persistence, etc. In contrast, a Performance L4 virtual server typically does not use an HTTP profile because it is not doing HTTP-aware (Layer 7) processing.
* It is not a Forwarding IP virtual server:A Forwarding (IP) virtual server is used to route/forward packets (often without load balancing to pool members in the same way as Standard/Performance VS) and is selected by choosing a forwarding type. The presence of a TCP protocol with a FastL4 client profile aligns with a Layer 4 load-balancing style virtual server, not a packet-forwarding virtual server type.
Conclusion: Because the configuration is TCP-based and explicitly uses fastL4 with no HTTP profile, the expected BIG-IP virtual server type is Performance Layer 4 (Option C).
NEW QUESTION # 29
The network architecture for a BIG-IP consists of an external VLAN and an internal VLAN with two interfaces connected to the upstream switch. The design requires fault tolerance in the case that one of the interfaces is down. Which deployment architecture meets these requirements? (Choose one answer)
- A. One network trunk with both VLANs and LACP enabled, and both VLANs configured as untagged
- B. One network trunk with both VLANs and LACP enabled, and both VLANs configured as tagged
- C. Two network trunks each with one VLAN and LACP disabled, and one VLAN configured as tagged and one VLAN configured as untagged
- D. Two network trunks each with one VLAN and LACP enabled, and both VLANs configured as tagged
Answer: B
Explanation:
Comprehensive and Detailed Explanation From BIG-IP Administration Data Plane Concepts documents:
To meet the requirement of fault tolerance when one interface goes down, BIG-IP must use link aggregation so that loss of a single physical link does not isolate the VLAN(s).
How the objects relate (data plane view)
Interfaces = physical links.
Trunk (LACP) = bundles multiple interfaces into one logical link that provides redundancy (and possibly bandwidth aggregation).
VLANs are assigned to interfaces or trunks. If you need multiple VLANs on the same trunk, they must use 802.1Q tagging (because you can only have one untagged VLAN per interface/trunk).
Self IPs are then placed on the VLANs to provide BIG-IP presence and routing/ARP functions, but self IPs are not what provides link resiliency-the trunk does.
Why Option D is correct
You have two physical interfaces and you want resiliency if one fails → put both interfaces into one trunk with LACP enabled.
You need both external and internal VLANs on those same two links → both VLANs should be configured as tagged on that trunk, so they can coexist on the same aggregated link.
If either physical interface fails, the trunk remains up via the remaining interface, keeping both VLANs operational.
Why the other options are incorrect
A: Two VLANs cannot both be untagged on the same trunk/interface. Only one untagged VLAN is possible; additional VLANs must be tagged.
B: Two trunks "each with one VLAN" would typically mean splitting VLANs across separate trunks. With only two interfaces total, that becomes one interface per trunk-if one interface goes down, the VLAN on that interface is down (no redundancy for that VLAN).
C: Same redundancy problem as B, and disabling LACP removes the negotiated aggregation behavior expected when the switch engineer specifically requested LACP.
NEW QUESTION # 30
What type of virtual server should be used to load balance UDP traffic without considering previous connections?
- A. Stateless
- B. Reject
- C. Standard
- D. Forwarding
Answer: A
Explanation:
When handling high-volume UDP traffic where the BIG-IP does not need to maintain any session history or relationship between packets, aStatelessvirtual server is the appropriate choice.
* No Connection Tracking:A stateless virtual server does not create or maintain entries in the BIG-IP connection table. This means the system processes each packet as an individual event, without
"considering previous connections" or packets from the same source.
* High Performance:Because the system bypasses the overhead of state management, stateless virtual servers provide the highest possible throughput for UDP and ICMP traffic.
* Use Cases:This is ideal for services like DNS (stateless queries) or some types of syslog traffic where each packet is independent and doesn't require the persistence or protocol inspection typically provided by a full-proxy.
Why other options are incorrect:
* Forwarding:While a Forwarding (IP) virtual server can handle UDP, it still maintains a state entry in the connection table to ensure return traffic is handled correctly.
* Standard:This is a full-proxy virtual server. It is inherently stateful and requires a connection table entry for every flow it manages.
* Reject:This is a special virtual server type that simply drops incoming traffic and, in the case of TCP, sends a reset (RST) or, for UDP, sends an ICMP unreachable message. It is not a load balancing type.
NEW QUESTION # 31
An application is configured so that the same pool member must be used for an entire session, as well as for HTTP and FTP traffic. A user reports that a session has terminated, and the user must restart the session. The BIG-IP Administrator determines that the active BIG-IP device failed over to the standby BIG-IP device.
Which configuration settings should the BIG-IP Administrator verify to ensure proper behavior when BIG-IP failover occurs?
- A. syn-cookie insertion threshold and connection low-water mark
- B. Cookie persistence and session timeout
- C. Stateful failover and network failover detection
- D. Persistence mirroring and Match Across Services
Answer: D
Explanation:
In this scenario, two specific High Availability and Persistence requirements must be met to ensure session continuity during a failover.
* Persistence Mirroring:By default, persistence records (which map a client to a specific server) exist only on the memory of the active BIG-IP. If a failover occurs, the standby unit has no knowledge of these sessions and will re-load-balance the client, likely to a different server. EnablingPersistence Mirroringensures that the persistence table is synchronized in real-time to the standby peer.
* Match Across Services:The requirement specifies that the session must persist across bothHTTPand FTP. These are different Virtual Servers (and likely different ports). TheMatch Across Servicessetting in the persistence profile allows the BIG-IP to use the same persistence record for any Virtual Server that shares the same IP address and pool, regardless of the service port.
NEW QUESTION # 32
What type of virtual server will have a destination IP address of 0.0.0.0 and listen on a specific VLAN for requests?
- A. Standard
- B. Forwarding (Layer 2)
- C. Forwarding (IP)
- D. Wildcard
Answer: D
Explanation:
In BIG-IP LTM, aWildcardvirtual server is defined by using a destination IP address of 0.0.0.0. These virtual servers are designed to handle traffic that does not match any more specific Virtual Server destination address.
* 0.0.0.0 Destination:This address acts as a "catch-all" for IP traffic.
* VLAN Specificity:While the destination address is generic, a Wildcard virtual server is typically restricted to a specificVLAN(such as the Internal VLAN) to process outbound traffic from backend servers.
* Service Ports:A wildcard virtual server can be configured for a specific port (e.g., 0.0.0.0:80) or for all ports (0.0.0.0:0).
* Data Plane Usage:It is commonly used for transparently intercepting outbound traffic for the purpose of Source NAT (SNAT), bandwidth shaping, or directing traffic to a gateway pool.
NEW QUESTION # 33
Refer to the exhibit.
The BIG-IP Administrator needs to avoid overloading any of the pool members with connections when they become active. What should the BIG-IP Administrator configure to meet this requirement? (Choose one answer)
- A. Slow Ramp Time to the Pool
- B. Same Priority Group to each member
- C. Action On Service Down to Reselect
- D. Different Ratio for each member
Answer: A
Explanation:
This question focuses on connection behavior when pool members transition from down to up, which is a classic data plane consideration in BIG-IP environments.
What problem is being solved?
When a pool member:
* Recovers from a failure
* Is enabled after maintenance
* Transitions from inactive to active
...it can suddenly receive a large burst of new connections, especially when using load-balancing methods such as Least Connections. This sudden surge can overload the server.
Why Slow Ramp Time is the correct solution:
Slow Ramp Time is a pool-level setting that:
* Gradually increases the number of connections sent to a newly available pool member
* Prevents sudden spikes in traffic
* Allows the server to warm up (application cache, JVM, DB connections, etc.) From BIG-IP Administration Data Plane Concepts:
* Slow Ramp Time controls the rate at which BIG-IP increases load to a pool member that has just become available
* During the ramp period, BIG-IP artificially increases the member's connection count, making it appear
"busier" and therefore less attractive for new connections
This directly satisfies the requirement to avoid overloading pool members when they become active.
Why the Other Options Are Incorrect:
* B. Different Ratio for each member
* Ratios control relative distribution under normal operation
* They do not prevent a sudden surge when a member becomes active
* C. Action On Service Down to Reselect
* Controls persistence behavior when a member goes down
* Has no impact on connection ramp-up when a member comes back online
* D. Same Priority Group to each member
* Affects failover logic between priority groups
* Does not control connection rate or ramp-up behavior
Key Data Plane Concept Reinforced:
To protect backend servers during recovery events, BIG-IP provides Slow Ramp Time, ensuring graceful reintroduction of traffic and preventing connection storms that can occur during high-load scenarios.
NEW QUESTION # 34
Active connections to pool members are unevenly distributed. The load balancing method is Least Connections (member). Priority Group Activation is disabled. What is a potential cause of the uneven traffic distribution?
- A. SSL Profile (Server) is applied
- B. Incorrect load balancing method
- C. Persistence profile is applied
- D. Priority Group Activation is disabled
Answer: C
Explanation:
In a BIG-IP environment, load balancing and persistence work together but serve different purposes. While a load balancing method likeLeast Connectionsattempts to distribute traffic based on current connection counts, apersistence profileoverrides this logic for returning clients.
* Persistence Overrides Load Balancing:When a persistence profile (such as Source Address or Cookie persistence) is applied to a Virtual Server, the BIG-IP system tracks which client was sent to which backend member.
* Sticky Sessions:If a client with a valid persistence record returns, the BIG-IP will send that client to the same pool memberit was previously assigned to, regardless of the load balancing algorithm's current preference.
* Uneven Distribution:If certain clients generate significantly more traffic or stay connected longer than others, the persistence table will "lock" those high-volume flows to specific members, resulting in an uneven distribution of connections across the pool.
NEW QUESTION # 35
A BIG-IP Administrator explicitly creates a traffic group on a BIG-IP device. Which two types of configuration objects can be associated with this traffic group? (Choose two.)
- A. Application Instances
- B. Floating Self IPs
- C. VLANs
- D. Virtual Addresses
- E. iRules
Answer: B,D
Explanation:
ATraffic Groupis a collection of related configuration objects that fail over together from one BIG-IP device to another. Only "floating" objects can be members of a traffic group.
* Virtual Addresses (C):A virtual address (the IP part of a Virtual Server) is a floating object. It is assigned to a traffic group so that the entire IP moves to the standby unit during a failover.
* Floating Self IPs (E):These are used as gateways for backend servers or SNAT addresses. By associating them with a traffic group, they remain reachable by the backend network regardless of which BIG-IP is currently active.
Why other options are incorrect:
* iRules (A):iRules are configuration logic files; they are synchronized across devices but are not
"hosted" by a traffic group.
* VLANs (D):VLANs are local to the hardware interfaces/trunks of each specific device and do not fail over.
NEW QUESTION # 36
Refer to the exhibit above.
A BIG-IP pool is configured with Priority Group Activation = Less than 2 available members. The pool members have different priority groups and availability states. Which pool members are receiving traffic? (Choose one answer)
- A. serv1, serv2, serv3, serv4
- B. serv1
- C. serv1, serv3, serv4
- D. serv1, serv3
Answer: C
Explanation:
Comprehensive and Detailed Explanation From BIG-IP Administration Data Plane Concepts documents:
This question tests understanding of Priority Group Activation (PGA) and how BIG-IP determines which pool members are eligible to receive traffic.
Key BIG-IP Priority Group Concepts:
Higher priority group numbers = higher priority
BIG-IP will only send traffic to the highest priority group that meets the Priority Group Activation condition Lower priority groups are activated only when the condition is met Only available (green) members count toward the activation threshold Configuration from the Exhibit:
Priority Group Activation: Less than 2 available members
Pool Members and Status:
Pool Member Priority Group Status
serv1 2 Active (available)
serv2 2 Inactive (down)
serv3 1 Active (available)
serv4 1 Active (available)
Step-by-Step Traffic Decision:
BIG-IP first evaluates the highest priority group (Priority Group 2)
Priority Group 2 has:
serv1 → available
serv2 → unavailable
Total available members = 1
Activation rule is Less than 2 available members
Condition is true (1 < 2)
BIG-IP activates the next lower priority group (Priority Group 1)
Traffic is now sent to:
serv1 (Priority Group 2)
serv3 and serv4 (Priority Group 1)
Final Result:
Traffic is distributed to serv1, serv3, and serv4
Why the Other Options Are Incorrect:
A - Ignores activation of the lower priority group
B - serv4 is also active and eligible
C - serv2 is down and cannot receive traffic
Key Data Plane Concept Reinforced:
Priority Group Activation controls when lower-priority pool members are allowed to receive traffic, based strictly on the number of available members in the higher-priority group. In this case, the failure of one high-priority member caused BIG-IP to expand traffic distribution to lower-priority members to maintain availability.
NEW QUESTION # 37
The BIG-IP appliance fails to boot. The BIG-IP Administrator needs to run the End User Diagnostics (EUD) utility to collect data to send to F5 Support. Where can the BIG-IP Administrator access this utility?
- A. External VLAN interface3
- B. Internal VLAN interface2
- C. Management Port4
- D. Console Port1
Answer: D
Explanation:
6
The End7 User Diagnostics (EUD) utility is a software tool designed to test the hardware components of a BIG-IP system. Because the EUD must run when the standard Traffic Management Microkernel (TMM) and Operating System (TMOS) are not fully loaded (especially in "fail to boot" scenarios), it is accessed at the boot level.
* Access Requirements: To run the EUD, the administrator must reboot the BIG-IP system and select the EUD option from the GRUB boot menu. Because the network interfaces (Internal, External, and Management) require a running operating system and drivers to function, they are unavailable during this pre-boot phase.
* The Console Port: The Console Port provides a direct out-of-band serial connection to the hardware's BIOS and bootloader. This is the only interface that allows an administrator to interact with the system during the early stages of the power-on self-test (POST) and boot sequence to initiate diagnostic tests.
* Purpose: The EUD performs a series of tests on the CPU, memory, hard drives, and physical interfaces to identify hardware-level failures before the data plane is even initialized.
NEW QUESTION # 38
What type of Virtual Server is configured with no Pool-members, and proxies traffic to the destination IP address specified by the client device?
- A. Stateless
- B. Standard
- C. Performance (Layer 4)
- D. Forwarding (IP)
Answer: D
NEW QUESTION # 39
A BIG-IP Administrator assigns the default HTTP health monitor to a pool that has three members listening on port 80. When the administrator connects to each pool member using the curl utility, two of the members respond with a status of 404 Not Found, while the third responds with 200 OK. What will the pool show for member availability? (Choose one answer)
- A. All members online
- B. All members offline
- C. Two members offline and one member online
- D. Two members online and one member offline
Answer: C
Explanation:
Comprehensive and Detailed Explanation From BIG-IP Administration Data Plane Concepts documents:
In BIG-IP LTM, pool member availability is determined by health monitors, which continuously test application responsiveness and correctness.
For the default HTTP monitor, the behavior is defined as follows:
BIG-IP sends an HTTP request (by default, GET /)
The monitor expects a response with HTTP status 200 OK
Any HTTP response code other than 200 is considered a monitor failure
A failed monitor causes the associated pool member to be marked offline (down) Applying this to the scenario:
Two pool members return 404 Not Found
A 404 response indicates the requested object is missing
This response does not satisfy the success criteria of the default HTTP monitor BIG-IP marks these two members as offline One pool member returns 200 OK This matches the expected response code BIG-IP marks this member as online Resulting Pool Status:
2 members: Offline
1 member: Online
Why the Other Options Are Incorrect:
B - Members returning 404 responses cannot be considered healthy
C - At least one member responds with 200 OK, so the entire pool is not offline D - Not all members meet the monitor success criteria Key Data Plane Concept Reinforced:
BIG-IP health monitors validate not just reachability, but application correctness. For HTTP monitors, the response code is critical-404 is treated as a failure, even though the service is reachable.
NEW QUESTION # 40
A BIG-IP Administrator has a cluster of devices. What should the administrator do after creating a new Virtual Server on device 1?
- A. create a new cluster on device 1
- B. synchronize the settings of the group to device 1
- C. create the new virtual server on device 2
- D. synchronize the settings of device 1 to the group
Answer: D
Explanation:
F5 BIG-IP uses aConfigSyncmechanism to ensure that all members of a Device Service Cluster (DSC) share the same configuration.
* Manual Synchronization:By default, configuration changes made on one device (the "source") do not automatically propagate to other members.
* Direction of Sync:Once a Virtual Server is created on device 1, that device's configuration is now
"newer" than the rest of the group. The administrator must initiate a synchronization from themodified device (device 1) to the Sync-Failover group.
* Consistency:This ensures that if a failover occurs, device 2 (the standby) will have the exact same Virtual Server configuration and can take over traffic immediately without interruption.
NEW QUESTION # 41
Refer to the exhibit.
The network team creates a new VLAN on the switches. The BIG-IP Administrator creates a new VLAN and a Self IP on the BIG-IP device, but the servers on the new VLAN are NOT reachable from the BIG-IP device.
Which action should the BIG-IP Administrator take to resolve this issue? (Choose one answer)
- A. Create a Floating Self IP address
- B. Set Port Lockdown of the Self IP to Allow All
- C. Assign a physical interface to the new VLAN
- D. Change Auto Last Hop to enabled
Answer: C
Explanation:
For BIG-IP to send or receive traffic on a VLAN, that VLAN must be bound to a physical interface or a trunk. Creating a VLAN object and a Self IP alone is not sufficient to establish data-plane connectivity.
From the exhibit:
* The VLAN (vlan_1033) exists and has a tag defined.
* A Self IP is configured and associated with the VLAN.
* However, traffic cannot reach servers on that VLAN.
This indicates a Layer 2 connectivity issue, not a Layer 3 or HA issue.
Why assigning a physical interface fixes the problem:
* BIG-IP VLANs do not carry traffic unless they are explicitly attached to:
* A physical interface (e.g., 1.1), or
* A trunk
* Without an interface assignment, the VLAN is effectively isolated and cannot transmit or receive frames, making servers unreachable regardless of correct IP addressing.
Why the other options are incorrect:
* A. Set Port Lockdown to Allow AllPort Lockdown controls which services can be accessed on the Self IP (management-plane access), not whether BIG-IP can reach servers on that VLAN.
* B. Change Auto Last Hop to enabledAuto Last Hop affects return traffic routing for asymmetric paths. It does not fix missing Layer 2 connectivity.
* D. Create a Floating Self IP addressFloating Self IPs are used for HA failover. They do not resolve reachability issues on a single device when the VLAN itself is not connected to an interface.
Conclusion:
The servers are unreachable because the VLAN has no physical interface assigned. To restore connectivity, the BIG-IP Administrator must assign a physical interface (or trunk) to the VLAN, enabling Layer 2 traffic flow.
NEW QUESTION # 42
The diagram below shows the TCP connection setup for an application.
Which of the following virtual server types applies? (Choose one answer)
- A. Standard virtual server
- B. Forwarding IP virtual server
- C. Stateless virtual server
Answer: B
Explanation:
The diagram illustrates a specific TCP handshake sequence where the BIG-IP system acts as a transparent forwarder rather than a full proxy. The key indicators that identify this as aForwarding (IP) virtual server are as follows:
* Initial Packet Processing: The diagram explicitly states that the LTM evaluates the packet lookingonly at the destination IP address. This is the fundamental characteristic of a Forwarding IP virtual server, which uses the system's routing table to make forwarding decisions instead of load balancing to a pool of members.
* Handshake Sequence: Unlike aStandardvirtual server, which completes the three-way handshake with the client (SYN, SYN-ACK, ACK)beforeinitiating a separate connection to the server, the Forwarding IP virtual server passes the client's originalSYNpacket directly to the destination node.
* Response Timing: The BIG-IP system waits for theSYN-ACKfrom the destination node before it sends a SYN-ACK back to the client. It essentially "passes through" the handshake signals while still maintaining a state entry in the connection table to track the flow.
* Packet-by-Packet Logic: While it tracks the state, it does not perform address translation (unless SNAT is specifically configured) or deep packet inspection like a full proxy would.
Why other options are incorrect:
* Standard virtual server: A Standard virtual server is a "full proxy." It would finish the handshake with the client first and only then open a second, independent TCP connection to the backend server.
* Stateless virtual server: A stateless virtual server does not track connections in the connection table.
The diagram shows the system meticulously passing sequence numbers ($seq\_num$) and acknowledgment numbers ($ack\_num$) between the two sides, which requires stateful tracking of the TCP flow.
NEW QUESTION # 43
A BIG-IP Administrator is making adjustments to an iRule and needs to identify which of the 235 Virtual Servers configured on the BIG-IP device will be affected. How should the administrator obtain this information in an efficient way?
- A. Local Traffic > iRules
- B. Local Traffic > Virtual Servers
- C. Local Traffic > Pools
- D. Local Traffic > Network Map
Answer: A
Explanation:
When managing a large environment with hundreds of Virtual Servers, the most efficient way to identify the relationship between an iRule and the objects it manages is to view the properties of the iRule itself.
* iRule Properties:Within the BIG-IP Configuration Utility, navigating toLocal Traffic > iRulesand selecting a specific iRule provides a "Statistics" or "Usage" tab (depending on the version). This view explicitly lists all Virtual Servers currently associated with that specific iRule.
* Centralized Management:Instead of manually checking 235 individual Virtual Servers under the
"Virtual Servers" menu, the iRules menu acts as a central point of reference for that specific logic.
* Data Plane Impact:Because iRules can modify traffic flow, headers, and load balancing decisions, seeing the full list of affected Virtual Servers is critical before making adjustments to avoid unintended side effects across the application portfolio.
NEW QUESTION # 44
A BIG-IP is configured with a pool member located on a different subnet that is not local to the BIG-IP. To ensure that the return traffic from the pool member is sent to the client through the BIG-IP, a Source NAT (SNAT) is used and configured for SNAT Automap. The BIG-IP has a default gateway on the external VLAN, a floating and non-floating self-IP address on each VLAN, and a management address. Which IP address will the BIG-IP use as the source address for the traffic to the pool member when client traffic is sent through the virtual server?
- A. The source address will be the management IP address.
- B. The source address will be the floating self-IP address on the egress VLAN.
- C. The source address will be the non-floating self-IP address on the egress VLAN.
- D. The source address will be the first address available in the list of self-IPs.
Answer: B
Explanation:
SNAT Automapis a feature that automatically selects a self-IP address to use as the source address for translated packets. The selection logic follows a strict hierarchy to ensure that traffic is routable back to the BIG-IP:
* Egress VLAN Priority:The BIG-IP first looks at the VLAN through which the traffic is exiting toward the pool member (the egress VLAN).
* Floating Self-IP Preference:If the egress VLAN has afloating self-IP address, the BIG-IP will always prefer it for SNAT Automap. This is critical for High Availability (HA) because, during a failover, the floating IP moves to the new active device, allowing existing connections to be maintained or correctly timed out.
* Non-Floating Fallback:If no floating self-IP is available on the egress VLAN, the system will use a floating self-IP from a different VLAN. If no floating IPs exist at all, it will then fall back to the non- floating self-IP.
Key Data Plane Concept:
The management IP is never used for data plane traffic. In this scenario, since the administrator has configured a floating self-IP, that specific address becomes the source for all SNAT Automap traffic leaving that VLAN to ensure symmetric routing during HA events.
NEW QUESTION # 45
Which statement is true concerning cookie persistence?
- A. If a client's browser accepts cookies, cookie persistence will always cause a cookie to be written to the client's file system.
- B. Cookie persistence uses a cookie that stores the virtual server, pool name, and member IP address in clear text.
- C. Cookie persistence allows persistence independent of IP addresses.
- D. Cookie persistence allows persistence even if the data are encrypted from client to pool member.
Answer: C
Explanation:
Cookie Persistence is a Layer 7 persistence method that leverages an HTTP cookie to track a user session.
* IP Independence: Unlike "Source Address Affinity" (which relies on the client's IP), Cookie persistence identifies the session base16d on a unique token provided by the BIG-IP system. This is crucial for environments where many users share a single gateway (NAT) or where a client's IP might change mid-session.
* Encryption and Decryption: For the BIG-IP to insert or read a cookie, it must be able to see the HTTP header. If the traffic is encrypted end-to-end (SSL Pass-through), the BIG-IP cannot use cookie persistence. SSL must be terminated at the BIG-IP (Option B is false).
* Security: By default, BIG-IP cookies are encoded, not clear text. Modern versions allow for easy encryption of these cookies to prevent information leakage (Option C is false).
* Memory vs. Disk: The default behavior is "session-based" (In-memory). A cookie is only written to the client's file system (disk) if an Expiration is configured in the persistence profile (Option D is false).
NEW QUESTION # 46
Which event is always triggered when a client initially connects to a virtual server configured with an HTTP profile?
- A. HTTP_DATA
- B. CLIENT_DATA
- C. HTTP_REQUEST
- D. CLIENT_ACCEPTED
Answer: D
NEW QUESTION # 47
What is the result when a BIG-IP Administrator manually disables a pool member? (Choose one answer)
- A. The disabled pool member stops processing persistent connections.
- B. All pool members continue to process persistent connections.
- C. All pool members stop accepting new connections.
- D. The disabled pool member stops processing existing connections.
Answer: A
Explanation:
In BIG-IP LTM, a pool member state directly affects how traffic is handled at the data plane level. When a pool member is manually disabled, BIG-IP changes the member's availability state to disabled, which has specific and predictable traffic-handling consequences.
According to BIG-IP Administration Data Plane Concepts:
* A disabled pool member:
* Does not accept new connections
* Continues to process existing non-persistent connections until they naturally close
* Is removed from load-balancing decisions, including persistence lookups Most importantly for this question:
* Persistent connections (such as those created using source-address persistence, cookie persistence, or SSL persistence) are not honored for a disabled pool member
* BIG-IP will not send new persistent traffic to a disabled member, even if persistence records exist Therefore, when a pool member is manually disabled, it stops processing persistent connections, while allowing existing non-persistent flows to drain gracefully.
Why the Other Options Are Incorrect:
* B - Persistent connections are not honored for a disabled pool member
* C - Existing connections are not immediately terminated when a pool member is disabled
* D - Only the disabled pool member stops accepting new connections, not all pool members Key Data Plane Concept Reinforced:
Manually disabling a pool member is a graceful administrative action that prevents new and persistent traffic from reaching the member while allowing existing connections to complete, which is critical for maintenance and troubleshooting scenarios.
NEW QUESTION # 48
What should a BIG-IP Administrator configure to minimize impact during a failover?
- A. OneConnect profile
- B. Clone pool
- C. External monitors
- D. MAC masquerading
Answer: D
Explanation:
In a High Availability (HA) environment, a failover event occurs when the active BIG-IP system stops processing traffic and the standby unit takes over. This transition can cause a brief disruption in network traffic because the surrounding switches need to update their ARP tables to associate the Virtual IP (VIP) and floating Self-IPs with the MAC address of the new active unit.
* MAC Masquerade Functionality:To minimize this impact, an administrator can configureMAC masquerading. This feature allows the administrator to assign a unique, "shared" MAC address to a traffic group.
* Seamless Transition:When a failover occurs, the new active unit begins using this shared MAC address immediately. Since the MAC address for the traffic group remains the same regardless of which physical device is active, the upstream switches do not need to update their ARP tables or learn a new MAC-to-port mapping.
* Packet Loss Reduction:By maintaining a constant MAC address, MAC masquerading significantly reduces the time it takes for traffic to resume, effectively eliminating the "gratuitous ARP" dependency and minimizing packet loss during the handover.
Why other options are incorrect:
* External monitors:These are used for advanced health checking of pool members and do not directly impact the speed or smoothness of a device-level failover.
* OneConnect profile:This is a performance optimization tool that aggregates multiple client-side requests into a single server-side TCP connection; it is not a failover mechanism.
* Clone pool:This is used to replicate traffic for IDS or monitoring purposes and has no role in high availability or failover optimization.
NEW QUESTION # 49
......
BEST Verified F5 F5CAB2 Exam Questions (2026) : https://freetorrent.itpass4sure.com/F5CAB2-practice-exam.html
