Free F5 F5CAB3 Practice Exam with Questions & Answers | Set: 2

An F5 iApp is a template-driven system used to deploy complex applications by grouping all necessary BIG-IP objects (Virtual Servers, Pools, Profiles) into a single management entity. Objects created by an iApp are distinguished by their naming convention and metadata. In the provided exhibit, the Virtual Server configuration in Option A is clearly identified as an iApp-managed object through two primary indicators. First, the object resides within a sub-directory or partition ending in .app (/Common/vmware_test.app/). Second, the configuration explicitly includes the attribute app-service /Common/vmware_test.app/vmware_test, which serves as the system ' s internal pointer linking the LTM object back to the parent iApp Application Service. Furthermore, several profiles associated with this virtual server also reside within the same .app container, such as /Common/vmware_test.app/vmware_test_http.

In contrast, Options B, C, and D represent standard, manually created Virtual Servers. While they may have complex configurations (such as the APM profiles in app2_vs and app1_vs), they lack the folder-based naming hierarchy and the app-service metadata attribute that denotes iApp ownership. Standard objects like app1_vs are managed individually, whereas the objects within vmware_test.app are typically protected by " Strict Updates. " This means their configuration is controlled by the iApp ' s template logic; any manual attempt to modify these specific parameters directly via the Virtual Server menu would result in an error message stating the service must be updated via the application management interface. Identifying these objects is a critical procedural step for administrators to determine whether a configuration should be edited through the standard LTM menus or through the iApp ' s " Reconfigure " tab to ensure consistency and prevent manual changes from being overwritten by the template.

Standard BIG-IP administration dictates that hardware-level physical attributes are managed within the Network section of the configuration. When a network switch and a BIG-IP fail to successfully negotiate speed and duplex settings (Auto-Negotiation), it can result in CRC errors, late collisions, or a total lack of link. To resolve this manually, the administrator must navigate to the Configuration Utility (GUI) and go to Network > Interfaces.

Within the Interfaces list, the administrator can select the specific physical port (e.g., 1.1 or 1.2) and modify its properties. By default, the media speed is set to " Auto, " but the drop-down menu allows for manual selection of specific speeds (e.g., 100Mb/s, 1Gb/s, 10Gb/s) and duplex settings (Full or Half). While these changes can also be made via the TMOS Shell (TMSH) (Option B) using the modify net interface command, the question asks for the standard location, which in most administrative contexts refers to the primary GUI path. System > Configuration (Option D) is used for global device settings like NTP, DNS, and licensing, not for interface-specific physical layer parameters. The Front Console (Option A), referring to the LCD panel on physical appliances, is primarily used for initial management IP setup and viewing system alerts, but does not provide the granular interface configuration required for media speed adjustments.

The virtual server is configured for destination 192.168.21.50 , service port 53 , but its Protocol is TCP . Standard DNS query traffic is normally sent using UDP port 53 . Because virtual-server traffic matching includes the configured IP protocol, UDP DNS packets will not match a virtual server configured exclusively for TCP, causing the queries to fail.

F5 ' s DNS configuration guidance explicitly instructs administrators creating a DNS query virtual server to configure service port 53 and select UDP as the protocol. F5 also recommends separate TCP and UDP virtual servers when both forms of DNS traffic must be supported; TCP port 53 is particularly relevant for operations such as DNS zone transfers.

Option C is not required. The existing source network 192.168.100.0/23 spans addresses from 192.168.100.0 through 192.168.101.255, so both 192.168.101.100 and 192.168.101.200 are already permitted by the source-address criterion. F5 documents that the Source Address setting can specify the network from which a virtual server accepts traffic.

Therefore, changing the virtual server ' s Protocol from TCP to UDP corrects the traffic-matching problem.

Reference Topics: Virtual Server traffic matching; Protocol selection; DNS over UDP/TCP; Source Address matching; Service Port 53.

In BIG-IP systems, iRules influence traffic only when they are attached to a Virtual Server. If application traffic is being sent to nodes or pool members that are not defined in the pool, this typically indicates that an iRule is overriding the default load-balancing behavior by explicitly selecting a pool or node.

According to BIG-IP Administration: Data Plane Configuration and official F5 guidance:

iRules are associated with Virtual Servers, not directly with pools or nodes.

To determine whether an iRule is actively affecting traffic, the administrator must inspect the Virtual Server configuration.

Explanation of the correct answers:

B. Via the GUI at the Resources tab for the virtual serverThe Resources tab in the Configuration Utility displays all traffic-handling objects applied to the Virtual Server, including assigned iRules. This is the primary GUI location to verify whether an iRule is influencing data plane traffic.

C. Via TMSH with the list /ltm virtual < virtual_server > commandThis TMSH command displays the full Virtual Server configuration, including any iRules listed under the rules section. It is the authoritative CLI method to confirm iRule usage.

Why the other options are incorrect:

A. Via TMSH with the list /ltm rule < irule > commandThis command only shows the contents of an iRule and does not indicate whether the iRule is attached to or used by any Virtual Server.

D. Via the GUI at the iRule tab for the virtual serverBIG-IP does not provide a dedicated “iRule” tab on Virtual Servers. iRules are viewed and managed under the Resources tab.

Correct Conclusion:

To verify whether an iRule is responsible for unexpected node selection, the BIG-IP Administrator must examine the Virtual Server configuration, either through the Resources tab in the GUI or by using TMSH to list the Virtual Server configuration.

The configuration error is the HTTP Profile = http setting. The virtual server is intended to load balance SSH , which operates over TCP port 22 and is not an HTTP application protocol. The configured TCP protocol and TCP profile are therefore appropriate, but an HTTP profile should not be attached to this SSH virtual server.

F5 documentation states that an HTTP profile defines how BIG-IP manages HTTP traffic . The standard http profile operates in Reverse proxy mode by default and invokes BIG-IP ' s HTTP protocol processing. F5 separately documents Transparent HTTP proxy mode as the mode that can forward invalid HTTP traffic instead of dropping it. This distinction is important because an SSH protocol exchange is not syntactically valid HTTP traffic.

Setting HTTP Profile to None removes unnecessary Layer 7 HTTP parsing and leaves the virtual server handling the SSH connection through its TCP profile. The other changes are inappropriate: SSH requires TCP rather than UDP; the source address does not need to equal the virtual server ' s destination IP; and changing the destination to 0.0.0.0/0 is unrelated to the application-protocol mismatch.

Reference Topics: Local Traffic Profiles → HTTP Profiles , Proxy Mode , TCP profiles , Virtual Server profile assignment .

The two load balancing methods that consider all connections between the BIG-IP and each backend node — not just connections to a specific pool member — are Least Connections (node) and Weighted Least Connections (node) .

The critical distinction here lies in the node-level scope of evaluation. A node represents the backend server ' s IP address, regardless of how many services or ports it may be serving. Therefore:

Least Connections (node) directs new connections to the node with the fewest total active connections across all services on that server, providing a holistic connection-count perspective.

Weighted Least Connections (node) operates identically but factors in an administrator-defined ratio weight, allowing servers with greater capacity to proportionally absorb more connections while still evaluating total node-level connection counts.

By contrast:

Ratio (member) distributes traffic based on a static weight ratio and does not dynamically evaluate current connection counts.

Round Robin distributes traffic sequentially in rotation, completely ignoring current connection states on any node or member.

The node-based methods are particularly valuable in environments where a single backend server hosts multiple pool members across different ports, ensuring the server ' s overall load — not just per-service load — governs balancing decisions.

To fulfill the requirement of " SSL Offload " limited to " TLSv1.2 only, " the administrator must focus on the client-side of the connection. SSL Offload means the BIG-IP terminates the encrypted connection from the user, processes the traffic (often as plain text internally), and optionally sends it to the backend. The profile responsible for this termination and the initial negotiation with the client ' s browser is the Client SSL Profile.

A custom Client SSL Profile must be created because the default clientssl profile typically allows a broad range of protocols for compatibility (including TLS 1.0, 1.1, and 1.2). To restrict communication specifically to TLS 1.2, the administrator modifies the Ciphers string within the profile. Using a string such as DEFAULT:!SSLv3:!TLSv1:!TLSv1.1 or specifically defining TLSv1.2-only suites ensures that the BIG-IP will reject any handshake attempts from older, less secure protocols.

Server SSL Profiles (Options B and C) are used for the encryption between the BIG-IP and the backend nodes, which is not what is requested here. Simply selecting " no TLSv1 " in an options list (Option D) is insufficient and often refers to older versions of the software; the modern and standard way to control protocol negotiation on a BIG-IP is through the precise application of Cipher Strings within the Client SSL profile. This ensures compliance with security standards like PCI-DSS while providing the offloading benefits to the backend infrastructure.

X-Forwarded-For inserts the original client IP into HTTP headers while SNAT is enabled.

The issue of " lost shopping carts " in an ecommerce environment is a classic symptom of a missing or improperly configured Persistence Profile. In modern web applications, session data—such as items added to a cart—is often stored locally on the specific web server that initially handled the user ' s request. If the BIG-IP system load balances a user ' s subsequent request (like clicking " Checkout " ) to a different server among the 50 webservers, the new server will not have the session data, and the user will appear to have an empty cart.

While Least Connections (node) is an efficient load balancing algorithm, it makes a new decision for every connection unless persistence is enabled. To resolve this, the administrator must implement a persistence mechanism. HTTP Cookie Persistence (Option A) is the industry standard for web applications. By assigning a cookie persistence profile to the Virtual Server, the BIG-IP inserts a unique cookie into the HTTP response. When the user ' s browser returns that cookie in future requests, the BIG-IP identifies the specific server that handled the first request and c onsistently directs the user back to that same server for the duration of their session.

Sip_info (Option B) is a persistence method for VOIP traffic and is not applicable to web traffic. Ratio load balancing (Options C and D) merely changes the distribution frequency but still does not guarantee that a specific user will stay on the same server across multiple requests. Therefore, adding a cookie persistence profile is the direct procedural fix to maintain session state and ensure ecommerce functionality.

BIG-IP provides several built-in TCP profiles optimized for different traffic patterns and network conditions. When attempting to improve general TCP performance, the recommended starting point is f5-tcp-progressive.

According to the BIG-IP Administration: Data Plane Configuration documentation:

f5-tcp-progressive is designed as a balanced, general-purpose TCP optimization profile.

It dynamically adjusts TCP behavior to improve throughput and latency for most enterprise applications.

It is the recommended first-choice profile when tuning TCP performance before moving to more specialized profiles.

Why the other options are incorrect:

A. f5-tcp-legacyThis profile exists for backward compatibility and does not include modern TCP optimizations.

C. f5-tcp-mobileThis profile is optimized specifically for high-latency, lossy mobile networks and is not suitable for general-purpose environments.

D. No optionBIG-IP explicitly provides built-in TCP profiles for performance tuning; using none would forgo optimization opportunities.

Correct Resolution:

The administrator should first apply f5-tcp-progressive to evaluate potential TCP performance improvements before considering more specialized profiles.