Free F5 F5CAB2 Practice Exam with Questions & Answers | Set: 2

Configuring networking objects in BIG-IP requires using the correct TMSH module path and verb .

Module Path: Trunks are networking objects, so they reside under the /net module, not /sys.

Verb: Since the trunk already exists, the modify verb must be used to update its properties rather than create.

Syntax: The correct syntax to append physical interfaces to an existing trunk is tmsh modify /net trunk [name] interfaces add { [port list] }.

Data Plane Impact: Adding interfaces to a trunk (Link Aggregation) increases the total aggregate bandwidth available to the system and provides additional hardware redundancy.

The Forced Offline state is a critical administrative tool used during maintenance to ensure a device remains in a non-functional state relative to the traffic group.

Preventing Active Status: When a device is in " Forced Offline, " it is effectively disqualified from the HA election process. Even if the other peer fails, a device in Forced Offline will not become active. This is vital during maintenance (like firmware upgrades or hardware replacement) to prevent an unstable or half-configured device from attempting to process traffic.

Traffic Termination: Placing a device in Forced Offline triggers the system to stop accepting new connections and, depending on the configuration, can facilitate the termination of existing connections so that the administrator can perform work without the data plane actively utilizing system resources.

Persistence Handling: Unlike the " Disabled " state, Forced Offline ignores persistence records, ensuring that no new traffic is steered to the device via session affinity.

When troubleshooting performance and latency issues on BIG-IP, especially under peak load conditions, it is critical to identify which Virtual Servers are consuming the most resources . This is a core data plane analysis task .

BIG-IP provides multiple views of configuration and status, but only certain areas expose real-time and historical traffic statistics that correlate directly with CPU usage and throughput.

Why Option C Is Correct:

Statistics > Module Statistics > Local Traffic > Virtual Servers provides:

Real-time and cumulative statistics per Virtual Server

Metrics such as:

Bits in / Bits out

Packets in / Packets out

Current connections

Connection rate

Total requests

The ability to identify high-traffic or high-connection Virtual Servers , which are the most likely contributors to elevated CPU utilization

These statistics allow the administrator to objectively determine which Virtual Servers are the top consumers of system resources and therefore good candidates for migration to a dedicated BIG-IP device.

Why the Other Options Are Incorrect:

A. Local Traffic > Virtual Servers > Virtual Server List

Primarily a configuration view

Does not provide sufficient performance or utilization statistics to identify CPU-heavy Virtual Servers

B. System > Platform

Displays hardware-level information such as CPU cores, memory, disk, and platform type

Does not break down utilization by Virtual Server

D. Local Traffic > Network Map

Provides a logical topology view of Virtual Servers, pools, and pool members

Useful for understanding relationships, but not for identifying high-utilization Virtual Servers

Key Data Plane Concept Reinforced:

To diagnose performance problems and plan traffic redistribution, BIG-IP administrators must rely on Module and object-level statistics , not configuration screens. The Virtual Server statistics view is the authoritative location for identifying traffic hotspots that directly impact CPU and latency during peak events such as Black Friday.

===========

In a BIG-IP device service cluster , configuration objects such as virtual servers, pools, profiles, and iRules are maintained through configuration synchronization (config-sync) .

Key BIG-IP concepts involved:

Device Service Cluster (DSC) A cluster is a group of BIG-IP devices that share configuration data. One device is typically used to make changes, which are then synchronized to the rest of the group.

Config-Sync Direction Matters

Changes are made on a local device

Those changes must be pushed to the group

The correct operation is “Sync Device to Group”

Why C is correct:

The virtual server was created only on device 1

Other devices in the cluster do not yet have this object

To propagate the new virtual server to all cluster members, the administrator must synchronize device 1 to the group

Why the other options are incorrect:

A. Synchronize the settings of the group to device 1 This would overwrite device 1’s configuration with the group’s existing configuration and may remove the newly created virtual server .

B. Create a new cluster on device 1 The cluster already exists. Creating a new cluster is unnecessary and disruptive.

D. Create a new virtual server on device 2 This defeats the purpose of centralized configuration management and risks configuration drift.

Conclusion:

After creating a new virtual server on a BIG-IP device that is part of a cluster, the administrator must synchronize the configuration from that device to the group so all devices share the same ADC application objects.

The BIG-IP processing flow follows a specific sequence of events as a packet moves through the system.

TCP Handshake: Before any application-layer data (like HTTP) can be processed, a TCP connection must be established.

The First Event: The very first event triggered when a client completes the 3-way handshake with the virtual server is CLIENT_ACCEPTED .

Profile Influence: Even if an HTTP profile is attached, the system must first " accept " the connection at the protocol level. HTTP_REQUEST only triggers after the client sends data that the BIG-IP recognizes as a valid HTTP request. If a client connects but never sends a request, CLIENT_ACCEPTED will have fired, but HTTP_REQUEST will not.

On BIG-IP, a disabled pool member is deliberately treated differently from a member that is unavailable because of a failed health monitor or one that has been forced offline . Disabling a pool member removes it from normal load-balancing selection for new, unrelated sessions, but BIG-IP can continue sending traffic associated with existing active connections and existing persistence sessions to that member.

F5 documentation states specifically that when a pool member is disabled, it continues to process active connections and connections belonging to the current persistence session. F5 also describes the disabled state as allowing “persistent or active connections” while preventing ordinary new load-balanced connections.

The relevant persistence configuration is attached to the virtual server , making A correct. When a client has an existing persistence record—for example, source-address affinity—the persistence decision can continue directing that client ' s connections to its previously selected pool member even though that member has subsequently been disabled.

Slow Ramp Time serves a different purpose: it gradually increases connection allocation to a newly available pool member so that it is not immediately overwhelmed. It does not explain continued access to disabled members. A persistence profile is not configured on the pool itself, eliminating D.

Study Guide References/Topics: Pool Member States; Disabled versus Forced Offline; Persistence Profiles; Virtual Server Persistence; Connection Processing; Slow Ramp Time.

For an interface to be used as a physical member of a BIG-IP trunk , it must be free from conflicting Layer 2 assignments. In this question, the correct condition is that the interface is not assigned to a VLAN .

BIG-IP trunks aggregate multiple physical interfaces into one logical interface. The normal configuration sequence is to create the trunk from eligible physical interfaces and then assign the trunk itself to one or more VLANs. F5 documentation specifies that an interface assigned to a trunk must be an untagged interface and cannot simultaneously belong to another trunk. The Configuration utility therefore restricts which physical interfaces are presented as eligible trunk members.

An interface that is already directly participating in VLAN configuration is not treated as an available standalone interface for the intended trunk configuration. Instead, the physical interfaces are first aggregated, after which the resulting trunk becomes the VLAN member.

Option A is incorrect because a tagged interface has VLAN association and is not the prerequisite state for adding the physical interface to a trunk. Option B is also incorrect: an interface being administratively or operationally DOWN does not define trunk eligibility and may prevent it from becoming an active working link.

Study Guide References/Topics: Physical Interfaces; Trunk Configuration; Link Aggregation; VLAN Membership; Tagged and Untagged Interfaces; Interface Availability.

===============

iRules are event-driven scripts that allow for advanced traffic manipulation.

Universality of Events: Every packet that passes through t 21 he BIG-IP data plane triggers events. Even non-HTTP traffic triggers events such as CLIENT_ACCEPTED (when the TCP connection is established 22 ) or CLIENT_DATA (when raw data is received). Therefore, all client traffic—regardless of protocol—has data that can trigger an iRule event.

Event Specificity: Events are not universal (Option C is false). For example, HTTP_REQUEST only occurs after a full HTTP header is parsed. You cannot trigger an HTTP_RESPONSE event before a request has been sent to a server.

Protocol Agnostic: iRules are not limited to HTTP (Option A is false); they can handle TCP, UDP, DNS, FTP, SIP, and more.

Error Handling: If an iRule references an event that never triggers (e.g., an HTTP_REQUEST event in a purely TCP virtual server), the iRule code for that event simply never executes. It does not terminate the connection (Option D is false).

The behavior of a health monitor is determined by its Send String and Receive String .

Default HTTP Monitor: The pre-configured default HTTP monitor on a BIG-IP system has an empty Receive String .

Success Criteria: When the Receive String is blank, the BIG-IP system considers the health check successful if it receives any valid HTTP response from the server.

Status Code Interpretation: Because a 404 Not Found is a valid HTTP status code (it is a properly formatted response from a running web server process), the BIG-IP interprets this as the application being " alive " .

Result: All three members (including the two returning 404s and the one returning 200) will be marked as UP/Available (Green).