Free F5 F5CAB2 Practice Exam with Questions & Answers | Set: 2

To meet the requirement offault tolerance when one interface goes down, BIG-IP must uselink aggregationso that loss of a single physical link does not isolate the VLAN(s).

How the objects relate (data plane view)

Interfaces= physical links.

Trunk (LACP)= bundles multiple interfaces into one logical link that providesredundancy(and possibly bandwidth aggregation).

VLANsare assigned to interfaces or trunks. If you needmultiple VLANs on the same trunk, they must use802.1Q tagging(because you can only have one untagged VLAN per interface/trunk).

Self IPsare then placed on the VLANs to provide BIG-IP presence and routing/ARP functions, but self IPs are not what provides link resiliency—the trunk does.

Why Option D is correct

You havetwo physical interfacesand you want resiliency if one fails → put both interfaces intoone trunk with LACP enabled.

You needboth external and internal VLANson those same two links → both VLANs should be configured astaggedon that trunk, so they can coexist on the same aggregated link.

If either physical interface fails, the trunk remains up via the remaining interface, keepingboth VLANs operational.

Why the other options are incorrect

A: Two VLANs cannot both beuntaggedon the same trunk/interface. Only one untagged VLAN is possible; additional VLANs must be tagged.

B: Two trunks “each with one VLAN” would typically mean splitting VLANs across separate trunks. With only two interfaces total, that becomes one interface per trunk—if one interface goes down, the VLAN on that interface is down (no redundancy for that VLAN).

C: Same redundancy problem as B, and disabling LACP removes the negotiated aggregation behavior expected when the switch engineer specifically requested LACP.

===========

In a large-scale BIG-IP environment with hundreds of virtual servers, theNetwork Mapis the most effective tool for visualizing and auditing the relationships between various ADC objects.

The Network Map Functionality:The Network Map provides a hierarchical view of the local traffic objects. It allows an administrator to see the status and dependencies of Virtual Servers, Pools, Pool Members, and associatediRulesall in one screen.

Search and Filter:By navigating toLocal Traffic > Network Map, the administrator can use theAdvanced Filter. This feature allows for searching specifically for an iRule name or a string within an iRule definition. Once the filter is applied, the system displays only the Virtual Servers that are associated with that specific iRule.

Efficiency:While the "Virtual Server List" (Option D) can be customized to show columns for iRules, it is often cumbersome to scroll through hundreds of entries. The "iRules List" (Option B) displays the scripts themselves but does not provide a reverse-lookup list of all associated virtual servers in a single view as efficiently as the Network Map.

Summary of Relationships:The Network Map is specifically designed to answer the question, "What is this object connected to?" making it the primary administrative interface for impact analysis during configuration changes.

4647

Virtual Servers have a setting calledVLAN and Tunnel Trafficwhich defines where the BIG-IP "listens" for new connections.4849

Ingress Logic:A virtual server is an entry point. It must be enab50led on the VLAN where theClientresides. If a client is on the "51Internal" VLAN, the Virtual Server must be enabled there to receive the traffic.

Egress Logic:The BIG-IP system uses theTMM Routing TableandSelf-IPsto reach pool members. It doesnotneed the Virtual Server to be "enabled" on the destination VLAN (External) to send traffic there.

Default Behavior:By default, Virtual Servers are enabled on "All VLANs." However, if restricted for security, the administrator must ensure the Virtual Server is active on the client-facing (ingress) VLAN.

To select the correct virtual server type, an administrator must balance the need for L7 intelligence versus raw throughput and hardware offloading:

Performance (Layer 4) Virtual Server:This type is designed for maximum speed. It uses thefastL4profile, which allows the BIG-IP system to leverage theePVA (Embedded Packet Velocity Accelerator)hardware chip. When a Performance (L4) virtual server is used, the system processes packets at the network layer (L4) without looking into the application payload (L7). This fulfills the requirement for hardware acceleration and avoids the overhead of HTTP optimization features, which are not needed in this scenario.

Performance (HTTP) Virtual Server:While fast, this type uses thefasthttpprofile to provide some L7 awareness and optimization (like header insertion or small-scale multiplexing). Since the requirement specifically states HTTP optimization isnotrequired, the L4 variant is more efficient.

Standard Virtual Server:This is a full-proxy type. While it offers the most features (SSL offload, iRules, Compression), it processes traffic primarily in the TMOS software layer (or via high-level hardware assistance), which is "slower" than the pure hardware switching path of the Performance (L4) type.

Stateless Virtual Server:This is typically used for specific UDP/ICMP traffic where the system does not need to maintain a connection table. It is not appropriate for standard HTTP (TCP) applications requiring persistent sessions or stateful load balancing.

By choosingPerformance (Layer 4)with thefastL4profile, the organization ensures that the traffic is handled by the hardware acceleration chips, providing the lowest latency and highest throughput possible for their HTTP application.

According to F5 BIG-IP documentation regarding High Availability and MAC Masquerade behavior, the system allows for more granular control over Layer 2 addresses during failover events.

Standard MAC Masquerade:By default, when a traffic group is assigned a MAC masquerade address (like 02:12:34:56:00:00), the BIG-IP system uses that exact MAC address for all traffic associated with that traffic group across all VLANs. This ensures that upstream switches do not need to relearn ARP entries for the Virtual IP, but it can cause issues in environments where multiple VLANs share the same physical infrastructure or monitoring tools that flag identical MACs across segments.

Per-VLAN MAC Masquerade:When the system database variable tm.macmasqaddr_per_vlan is set to true, the BIG-IP system calculates a unique MAC address for each VLAN. It does this by taking the base MAC masquerade address configured in the traffic group and adding theVLAN ID (tag)to it.

Calculation Logic:

Base MAC: 02:12:34:56:00:00

VLAN ID: 1501

To find the suffix, the VLAN ID is converted from decimal to hexadecimal:

$1501$ in decimal = 05DD in hex.

The system then applies this offset to the last two octets of the base MAC address.

00:00 + 05:DD = 05:DD.

Result:The final MAC address for VLAN 1501 becomes 02:12:34:56:05:dd.

This ensures that every VLAN has a unique Layer 2 identity while still reaping the benefits of "gratuitous ARP-less" failover provided by MAC masquerading.

ASelf IPis an IP address on the BIG-IP system that you associate with a specificVLAN.

VLAN Association:A Self IP cannot exist independently; it must be bound to a VLAN to define which network segment the BIG-IP can communicate with.

Layer 2 to Layer 3 Mapping:While a VLAN is associated with physical interfaces or trunks (Layer 2), the Self IP provides the Layer 3 identity for the BIG-IP on that VLAN.

Traffic Processing:Self IPs are used by the BIG-IP for health checking backend servers, acting as a default gateway for servers, and for HA heartbeat communication.

The BIG-IP system supports various remote authentication methods like LDAP, Active Directory, and RADIUS.

Fallback to Local:This is a specific security and availability feature within theSystem > Users > Authenticationconfiguration.

Redundancy:When "Fallback to Local" is enabled, the BIG-IP will first attempt to authenticate a user against the configured remote server. If that remote server is unreachable or fails to respond, the system will then check its internalLocal User databasefor credentials.

Administrative Access:This is standard practice for the "admin" or emergency accounts to ensure the system remains accessible even if the corporate directory service (e.g., AD) is offline.

The BIG-IP system uses a specific precedence algorithm to determine which virtual server (listener) should process an incoming packet when multiple virtual servers might match the criteria. Since BIG-IP version 11.3.0, the system evaluates three primary factors in a fixed order of importance:

Destination Address:The system first looks for the most specific destination match. A "Host" address (mask /32) is preferred over a "Network" address (mask /24, /16, etc.), which is preferred over a "Wildcard" (0.0.0.0/0).

Source Address:If multiple virtual servers have identical destination masks, the system then evaluates the source address criteria. Again, a specific source host match is preferred over a source network or a wildcard source.

Service Port:Finally, if both destination and source specifications are equal, the system checks the port. A specific port match (e.g., 80) is preferred over a wildcard port (e.g., or 0).

Following this logic, a virtual server configured with a specificdestination host, a specificsource host, and a specificservice portrepresents the highest level of specificity and thus the highest preference.