Free F5 F5CAB2 Practice Exam with Questions & Answers

12

In the BIG-IP system, pool selection must occur on the client-side of the connection, before the system attempts to connect to a pool 3member. The events listed 4are the primary entry points for making these decisions:

CLIENT_ACCEPTED (E): This is a Layer 4 event triggered when the BIG-IP accepts a TCP connection. It is the earliest point where a pool can be assigned based on the client's source IP address or the destination port.

CLIENT_DATA (A): This event is triggered when the system receives a "chunk" of data on the client-side. It is often used for non-HTTP protocols (like custom TCP protocols) to inspect the payload and select a pool based on its contents.

HTTP_REQUEST (C): This is a Layer 7 event. It occurs once the BIG-IP has fully parsed the HTTP headers. This is the most common event for pool selection, allowing the administrator to route traffic based on the URI, Host header, or cookies.

Events like SERVER_SELECTED or SERVER_CONNECTED occur after the load balancing decision has already been made, and HTTP_RESPONSE or SERVER_DATA occur after the server has already started communicating back, making them too late for initial pool selection.

BIG-IP uses a virtual server matching and precedence algorithm to determine which virtual server processes an incoming connection. This decision is made entirely in the data plane and is based on how specifically a virtual server matches the destination IP address and port.

BIG-IP Virtual Server Selection Rules (Simplified):

When multiple virtual servers could match a packet, BIG-IP selects the most specific match, using the following precedence:

Exact IP address and exact port

Exact IP address with wildcard port (port 0 / any)

Wildcard IP address with exact port

Wildcard IP address and wildcard port

Applying the Rules to This Scenario:

Incoming traffic destination: 1.0.0.10:8080

Option C: 1.0.0.10:8080

Exact IP match

Exact port match

Highest possible specificity

If the virtual server is available (green), it wins the match

Option B: 1.0.0.10:any

Exact IP match, but wildcard port

Lower priority than an exact IP + exact port match

Option D: 0.0.0.0:8080

Wildcard IP, exact port

Lower priority than an exact IP match

Option A: 0.0.0.0:any

Wildcard IP and wildcard port

Lowest priority, used only if no more specific virtual server exists

Final Determination:

Because a virtual server configured with destination 1.0.0.10:8080 exactly matches both the IP address and port of the incoming connection—and is available—it will always be selected to process the traffic.

Key Data Plane Concept Reinforced:

BIG-IP always processes traffic using the most specific matching virtual server. Exact destination IP and port matches take precedence over any wildcard or forwarding virtual server definitions.

===========

4647

Virtual Servers have a setting called VLAN and Tunnel Traffic which defines where the BIG-IP "listens" for new connections.4849

Ingress Logic: A virtual server is an entry point. It must be enab50led on the VLAN where the Client resides. If a client is on the "51Internal" VLAN, the Virtual Server must be enabled there to receive the traffic.

Egress Logic: The BIG-IP system uses the TMM Routing Table and Self-IPs to reach pool members. It does not need the Virtual Server to be "enabled" on the destination VLAN (External) to send traffic there.

Default Behavior: By default, Virtual Servers are enabled on "All VLANs." However, if restricted for security, the administrator must ensure the Virtual Server is active on the client-facing (ingress) VLAN.

In BIG-IP high availability (HA) configurations, MAC Masquerade is used to speed up failover by allowing traffic-group-associated Self IPs to retain the same MAC address when moving between devices. This prevents upstream switches and routers from having to relearn ARP entries during a failover event, resulting in near-instant traffic recovery.

By default, MAC masquerade applies one MAC address per traffic group, regardless of how many VLANs the traffic group spans. This can create problems in some network designs because the same MAC address appearing on multiple VLANs may violate network policies or confuse switching infrastructure.

To address this, BIG-IP provides Per-VLAN MAC Masquerade, enabled by the database variable:

`tm.macmasqaddr_per_vlan = true`

When this feature is enabled:

BIG-IP derives a unique MAC address per VLAN

The base MAC address configured on the traffic group remains the first four octets

The last two octets are replaced with the VLAN ID expressed in hexadecimal

The VLAN ID is encoded in network byte order (high byte first, low byte second)

### VLAN ID Conversion:

VLAN ID: 1501 (decimal)

Convert to hexadecimal:

1501₁₀ = 0x05DD

High byte: 05

Low byte: DD

### Resulting MAC Address:

Base MAC: `02:12:34:56:00:00`

Per-VLAN substitution → last two bytes = `05:DD`

Final MAC address:

`02:12:34:56:05:dd`

### Why the Other Options Are Incorrect:

A (01:15) – Incorrect hexadecimal conversion of 1501

B (dd:05) – Byte order reversed (little-endian, not used by BIG-IP)

D (15:01) – Uses decimal values instead of hexadecimal

### Key BIG-IP HA Concept Reinforced:

Per-VLAN MAC Masquerade ensures Layer 2 uniqueness per VLAN while preserving the fast failover benefits of traffic groups, making it the recommended best practice in multi-VLAN HA deployments.

The BIG-IP system uses a specific precedence algorithm to determine which virtual server (listener) should process an incoming packet when multiple virtual servers might match the criteria. Since BIG-IP version 11.3.0, the system evaluates three primary factors in a fixed order of importance:

Destination Address: The system first looks for the most specific destination match. A "Host" address (mask /32) is preferred over a "Network" address (mask /24, /16, etc.), which is preferred over a "Wildcard" (0.0.0.0/0).

Source Address: If multiple virtual servers have identical destination masks, the system then evaluates the source address criteria. Again, a specific source host match is preferred over a source network or a wildcard source.

Service Port: Finally, if both destination and source specifications are equal, the system checks the port. A specific port match (e.g., 80) is preferred over a wildcard port (e.g., or 0).

Following this logic, a virtual server configured with a specific destination host, a specific source host, and a specific service port represents the highest level of specificity and thus the highest preference.

With Least Connections (member), BIG-IP attempts to send new connections to the pool member with the fewest current connections. In a perfectly “stateless” scenario (no affinity), this often trends toward a fairly even distribution over time.

However, persistence overrides load balancing:

When a persistence profile is applied, BIG-IP will continue sending a client (or client group) to the same pool member based on the persistence record (cookie / source address / SSL session ID, etc.).

This means even if another pool member has fewer connections, BIG-IP may still select the persisted member to honor session affinity.

The result can be uneven active connection counts, even though the configured load balancing method is Least Connections.

Why the other options are not the best cause:

A. Priority Group Activation is disabledPriority Group Activation only affects selection when priority groups are configured; disabling it does not inherently create uneven distribution under Least Connections.

B. SSL Profile Server is appliedA server-side SSL profile affects encryption to pool members, but it does not by itself cause skewed selection across pool members. (Skew could happen indirectly if members have different performance/latency, but that’s not the primary, expected exam answer.)

D. Incorrect load balancing methodLeast Connections is a valid method and does not itself explain unevenness unless something is overriding it (like persistence) or pool members are not all eligible.

Conclusion:

A persistence profile is the most common and expected reason that active connections become unevenly distributed, because persistence takes precedence over the Least Connections load-balancing decision.

On BIG-IP systems, physical interface bandwidth is fixed by the link speed (for example, 1GbE or 10GbE). When traffic demand exceeds the capacity of a single interface, BIG-IP provides link aggregation through trunks.

Key concepts involved:

InterfacesA single physical interface (such as 1.1) is limited to its negotiated link speed. You cannot exceed this capacity through software tuning alone.

Trunks (Link Aggregation)A trunk combines multiple physical interfaces into a single logical interface.

BIG-IP supports LACP and static trunks.

Traffic is distributed across member interfaces, increasing aggregate bandwidth and providing redundancy.

VLANs are then assigned to the trunk, not directly to individual interfaces.

Why option B is correct:

Creating a trunk with two interfaces allows BIG-IP to use both physical links simultaneously.

This increases total available bandwidth (for example, two 10Gb interfaces → up to 20Gb aggregate capacity).

This is the documented and supported method for scaling bandwidth on BIG-IP.

Why the other options are incorrect:

A. Increase the MTUMTU changes affect packet size and efficiency, not total bandwidth capacity.

C. Assign two interfaces to the VLANBIG-IP does not support assigning a VLAN to multiple interfaces directly. VLANs must be associated with one interface or one trunk.

D. Set the media speed manuallyMedia speed can only be set up to the physical capability of the interface and connected switch port. It cannot exceed the hardware limit.

Conclusion:

To increase total available bandwidth on BIG-IP when a single interface is insufficient, the administrator must create a trunk object with multiple interfaces and move the VLAN onto the trunk. This aligns directly with BIG-IP data plane design and best practices.

According to F5 BIG-IP documentation regarding High Availability and MAC Masquerade behavior, the system allows for more granular control over Layer 2 addresses during failover events.

Standard MAC Masquerade: By default, when a traffic group is assigned a MAC masquerade address (like 02:12:34:56:00:00), the BIG-IP system uses that exact MAC address for all traffic associated with that traffic group across all VLANs. This ensures that upstream switches do not need to relearn ARP entries for the Virtual IP, but it can cause issues in environments where multiple VLANs share the same physical infrastructure or monitoring tools that flag identical MACs across segments.

Per-VLAN MAC Masquerade: When the system database variable tm.macmasqaddr_per_vlan is set to true, the BIG-IP system calculates a unique MAC address for each VLAN. It does this by taking the base MAC masquerade address configured in the traffic group and adding the VLAN ID (tag) to it.

Calculation Logic:

Base MAC: 02:12:34:56:00:00

VLAN ID: 1501

To find the suffix, the VLAN ID is converted from decimal to hexadecimal:

$1501$ in decimal = 05DD in hex.

The system then applies this offset to the last two octets of the base MAC address.

00:00 + 05:DD = 05:DD.

Result: The final MAC address for VLAN 1501 becomes 02:12:34:56:05:dd.

This ensures that every VLAN has a unique Layer 2 identity while still reaping the benefits of "gratuitous ARP-less" failover provided by MAC masquerading.

When troubleshooting performance and latency issues on BIG-IP, especially under peak load conditions, it is critical to identify which Virtual Servers are consuming the most resources. This is a core data plane analysis task.

BIG-IP provides multiple views of configuration and status, but only certain areas expose real-time and historical traffic statistics that correlate directly with CPU usage and throughput.

Why Option C Is Correct:

Statistics > Module Statistics > Local Traffic > Virtual Servers provides:

Real-time and cumulative statistics per Virtual Server

Metrics such as:

Bits in / Bits out

Packets in / Packets out

Current connections

Connection rate

Total requests

The ability to identify high-traffic or high-connection Virtual Servers, which are the most likely contributors to elevated CPU utilization

These statistics allow the administrator to objectively determine which Virtual Servers are the top consumers of system resources and therefore good candidates for migration to a dedicated BIG-IP device.

Why the Other Options Are Incorrect:

A. Local Traffic > Virtual Servers > Virtual Server List

Primarily a configuration view

Does not provide sufficient performance or utilization statistics to identify CPU-heavy Virtual Servers

B. System > Platform

Displays hardware-level information such as CPU cores, memory, disk, and platform type

Does not break down utilization by Virtual Server

D. Local Traffic > Network Map

Provides a logical topology view of Virtual Servers, pools, and pool members

Useful for understanding relationships, but not for identifying high-utilization Virtual Servers

Key Data Plane Concept Reinforced:

To diagnose performance problems and plan traffic redistribution, BIG-IP administrators must rely on Module and object-level statistics, not configuration screens. The Virtual Server statistics view is the authoritative location for identifying traffic hotspots that directly impact CPU and latency during peak events such as Black Friday.

===========

In an Active/Standby BIG-IP design, application availability during failover depends on both units having equivalent data-plane connectivity for the networks that carry application traffic. Specifically:

VLANs are bound to specific interfaces (and optionally VLAN tags).

Floating self IPs / traffic groups move to the new Active device during failover.

For traffic to continue flowing after failover, the new Active device must have the same VLANs available on the correct interfaces that connect to the upstream/downstream networks.

What the symptom tells you:

Traffic works when Device A is Active

Traffic fails when Device B becomes Active

Failback immediately restores traffic

This pattern strongly indicates the Standby unit does not have the VLAN connected the same way (wrong physical interface assignment), so when it becomes Active, it owns the floating addresses but cannot actually pass traffic on the correct network segment.

Why Interface mismatch is the best match:

If the Active unit is already working, its interface mapping is correct.

The fix is to make the Standby unit’s VLAN/interface assignment match the Active unit.

That corresponds to changing the Standby device interface to 1.1.

Why the Tag options are less likely here (given the choices and the exhibit intent):

Tag issues can also break failover traffic, but the question/options are clearly driving toward the classic HA requirement: consistent VLAN-to-interface mapping on both devices so the data plane remains functional after the traffic group moves.

Conclusion: To avoid an outage on the next failover, the BIG-IP Administrator must ensure the Standby device uses the same interface (1.1) for the relevant VLAN(s) that carry the application traffic, so when it becomes Active it can forward/receive traffic normally.