F5 F5CAB3 Study Guide Archives Updated on Sep 14, 2026
Download F5CAB3 Mock Test Study Material
NEW QUESTION # 32
A node is a member of multiple pools and hosts different applications. If one application becomes unavailable, only that pool member should be marked down.
What should the BIG-IP Administrator deploy?
- A. HTTP monitor with custom send/receive
- B. TCP monitor
- C. ICMP + TCP monitor
- D. UDP monitor
Answer: A
Explanation:
Application-level monitors ensure that only the affected service is marked down, not the entire node.
NEW QUESTION # 33
A BIG-IP Administrator needs to apply a health monitor for a pool of database servers named DB_Pool that uses TCP port 1521. Where should the BIG-IP Administrator apply this monitor?
- A. Local Traffic > Pools > DB.Pool > Members
- B. Local Traffic > Nodes > Default Monitor
- C. Local Traffic > Profiles > Protocol > TCP
- D. Local Traffic > Pools > DB.Pool > Properties
Answer: D
Explanation:
In BIG-IP configuration, health monitors can be applied at three distinct levels: the node, the pool, or the individual pool member. To ensure that a specific application service-in this case, a database service on port
1521-is functioning correctly for the entire pool, the administrator should apply the monitor at the pool level. Navigating to Local Traffic > Pools > DB.Pool > Properties allows the administrator to select one or more monitors from the "Available" list and move them to the "Active" list.
Applying a monitor at the pool property level ensures that the BIG-IP checks the health of every member assigned to that pool using the same logic. If a database-specific monitor (such as a TCP handshake or an Oracle/SQL check) fails for a specific member, the BIG-IP marks that member as "offline" for that specific pool, preventing new connections from being sent to it. While monitors can be applied to Pool Members (Option D) to give different members unique monitoring logic, it is more administratively efficient to apply it to the pool properties when all servers are expected to behave identically. Applying it to Nodes (Option C) would only verify that the IP address is up (typically via ICMP), which does not guarantee that the database service on port 1521 is actually responding. Finally, Profiles (Option A) are used to define how traffic is handled once it is accepted by a Virtual Server, not for the proactive health checking of backend resources.
Therefore, the pool properties page is the standard location for configuring service-specific availability requirements.
NEW QUESTION # 34
Application administrators are reporting that nodes different from those configured in the pool are selected.
The use of an iRule is suspected. How can the BIG-IP Administrator check if an iRule is used for this traffic?
(Pick the 2 correct responses below)
- A. Via the GUI at the Resources tab for the virtual server.
- B. Via TMSH with the list /ltm virtual <virtual_server> command.
- C. Via the GUI at the iRule tab for the virtual server.
- D. Via TMSH with the list /ltm rule <irule> command.
Answer: A,B
Explanation:
To determine if an iRule is influencing traffic for a specific Virtual Server, the administrator must verify the association between the Virtual Server object and any applied scripts. In the BIG-IP Configuration Utility (GUI), this association is found under the Resources tab of the specific Virtual Server. While there is an
"iRules" sub-menu under Local Traffic, checking the Virtual Server's Resources tab is the definitive way to see which specific rules are currently active and in what order they are being processed for that particular traffic flow.
From the Command Line Interface (CLI), the tmsh list /ltm virtual <virtual_server> command provides a full text-based output of the virtual server's configuration. If iRules are applied, they will appear within a "rules {
... }" block in the command output. This is more effective than Option A, which only lists the contents of the iRule itself but does not show if or where it is applied. Option C is a common misconception; while some versions of the GUI have reorganized menus, the standard location for managing the association of profiles, policies, and iRules to a Virtual Server remains the "Resources" section. By identifying the applied iRule, an administrator can then review the script logic-often containing commands like pool or node-to see if it is overriding the default pool selection based on specific HTTP headers, URI paths, or client IP addresses.
NEW QUESTION # 35
An organization reports slow performance accessing an Intranet website. All employees use a single proxy IP.
What should the BIG-IP Administrator do?
- A. Change Fallback Persistence to source_addr
- B. Change Default Persistence to cookie
- C. Change Load Balancing to Least Connections
- D. Change Source Address to proxy IP
Answer: B
Explanation:
When many users share one source IP, source-address persistence fails. Cookie persistence uniquely identifies clients at Layer 7.
NEW QUESTION # 36
The BIG-IP Administrator has to provide encrypted communication between the users and the virtual server they access. Multiple hostnames are configured in DNS with the same IP address. Which profile type and setting in the profile should be used?
- A. Server SSL, Server Name
- B. Client SSL, Server Name
- C. Server SSL, Client Name
- D. Client SSL, Client Name
Answer: B
Explanation:
When a single IP address (Virtual Server) must host multiple hostnames (e.g., site1.com, site2.com) over HTTPS, the BIG-IP must be able to present the correct SSL certificate for each site during the initial handshake. This requirement is handled by a technology called Server Name Indication (SNI).
To implement this on the BIG-IP, the administrator must use a Client SSL profile because the encryption is occurring between the user (Client) and the Virtual Server. Within the Client SSL profile settings, there is a field called Server Name. By creating multiple Client SSL profiles-each with a different "Server Name" (the hostname) and its corresponding certificate-and attaching them all to the same Virtual Server, the BIG-IP can inspect the SNI extension in the client's "Client Hello" packet. It then selects the specific profile that matches the requested hostname.
Option A is incorrect because "Client Name" is not the standard field name used for SNI hostname matching in the profile. Options B and C refer to Server SSL profiles, which manage the connection between the BIG- IP and the backend servers. While Server SSL profiles also have a "Server Name" field (used to send SNI to a backend server), the requirement here is to provide encrypted communication for "users" accessing the virtual server, which definitively requires a Client-side SSL configuration.
NEW QUESTION # 37
In a pool there are 2 pool members out of the 5 members that are older servers. The number of connections these can handle is less than the other 3 pool members. Which load balancing method would allow more traffic to be directed to the newer servers? (Choose one answer)
- A. Round Robin
- B. Global Availability
- C. Weighted Least Connections (member)
- D. Least Connections (member)
Answer: C
Explanation:
When a pool contains servers with heterogeneous hardware capabilities (differing CPU, RAM, or connection limits), a static load balancing method like Round Robin is ineffective because it distributes requests equally, regardless of the server's capacity. To optimize traffic distribution for newer, more powerful servers, a dynamic or weighted method is required.
Weighted Least Connections (member): This is the ideal method for this scenario. It combines two factors:
Least Connections: It first checks the current active connection count to ensure traffic goes to the least busy server.
Weight (Ratio): It allows the administrator to assign a "Ratio" value to each pool member. Newer servers can be assigned a higher ratio (e.g., 3) while older servers are assigned a lower ratio (e.g., 1). The BIG-IP system uses these weights to disproportionately favor the newer servers even when connection counts are similar.
Why other options are incorrect:
Global Availability: This is primarily a GSLB (Global Server Load Balancing) or specific LTM priority group concept where traffic is sent to the first available member in a list until it fails, then moves to the next. It does not load balance based on capacity.
Round Robin: This passes each new connection request to the next server in line, treating the old and new servers exactly the same.
Least Connections (member): While this sends traffic to the server with the fewest active connections, it assumes all servers are equal. If an old server and a new server both have 10 connections, they are treated as equally capable of taking the 11th, which is not true in this scenario.
NEW QUESTION # 38
All pool members are online and all other settings are default.
What might alter the load balancing behavior?
- A. Enabling SNAT Automap
- B. Adding a OneConnect profile
- C. Adding a persistence profile
- D. Enabling an HTTP fallback host
Answer: C
Explanation:
Persistence overrides load balancing decisions by maintaining client-to-server affinity.
NEW QUESTION # 39
A BIG-IP Administrator creates an HTTP Virtual Server using an iApp template. After the Virtual Server is created, the user requests to change the destination IP addresses. The BIG-IP Administrator tries to change the destination IP address from 10.1.1.1 to 10.2.1.1 in Virtual Server settings, but receives the following error:
"The application service must be updated using an application management interface." What is causing this error?
- A. The Application Service was NOT deleted before making the IP address change.
- B. The IP addresses used are NOT from the same subnet as the Self IP.
- C. The IP addresses are already in use.
- D. The Application Services have Strict Updates enabled.
Answer: D
Explanation:
In F5 BIG-IP administration, iApps are designed to manage complex application configurations as a single unit. When an iApp is deployed, it creates an "Application Service" object that owns all the associated LTM objects, such as Virtual Servers, Pools, and Nodes. By default, these iApps are created with Strict Updates enabled. Strict Updates is a safety mechanism that prevents administrators from making manual "out-of-band" changes to the individual objects created by the iApp. The system enforces this because manual changes would be overwritten the next time the iApp template is updated or re-entered.
When the administrator attempts to change the destination IP address directly on the Virtual Server object, the BIG-IP system checks the "Strict Updates" flag. If it is set to "Enabled," the system blocks the modification and generates the error message stating the service must be updated via the application management interface.
To resolve this, the administrator must navigate to the iApp >> Application Services menu, select the specific application service, and go to the "Reconfigure" tab. Within the iApp configuration form, the destination IP can be safely changed. Alternatively, if the administrator specifically wants to manage the objects manually and forgo the benefits of the iApp template management, they could disable "Strict Updates" in the iApp properties, though this is generally discouraged as it breaks the template's logic. The error is not related to subnetting or duplicate IPs, but strictly to the configuration authority assigned to the iApp service.
NEW QUESTION # 40
All pool members are online. All other virtual server settings are at default. What might alter the load balancing behavior?
- A. Adding a persistence profile
- B. Enabling a fallback host in the http profile
- C. Adding a oneconnect profile
- D. Enabling SNAT automap
Answer: A
Explanation:
In a default BIG-IP configuration, the system utilizes the Load Balancing Method (typically Round Robin) to distribute each new connection across available pool members. However, the introduction of a persistence profile fundamentally changes this behavior. Persistence (also known as "stickiness") ensures that once a client has been load balanced to a specific pool member, all subsequent requests from that same client during a defined session or timeout period are directed to that same member, bypassing the standard load balancing algorithm. This is critical for applications that maintain state, such as shopping carts or authenticated sessions, where moving a user to a different server would result in a loss of session data.
While other options affect traffic handling, they do not "alter" the fundamental load balancing decision in the same way. A OneConnect profile (Option A) optimizes connection management by pooling idle server-side connections; while it changes how connections are reused, the initial load balancing decision still follows the configured method. A fallback host (Option C) is only utilized when the primary pool is unavailable, and since the question states all pool members are online, it remains inactive. SNAT Automap (Option D) changes the source IP address of the packet as it exits the BIG-IP toward the server to ensure return traffic passes back through the ADC, but it does not dictate which server is chosen for the request. Therefore, the persistence profile is the primary configuration element that overrides the load balancing algorithm to maintain a client-to- server relationship.
NEW QUESTION # 41
Refer to the exhibit.
A BIG-IP Administrator creates a new Virtual Server to load balance SSH traffic. Users are unable to log on to the servers.
What should the BIG-IP Administrator do to resolve the issue? (Choose one answer)
- A. Set Destination Address/Mask to 0.0.0.0/0
- B. Set Source Address to 10.1.1.2
- C. Set Protocol to UDP
- D. Set HTTP Profile to None
Answer: D
Explanation:
SSH is a Layer 4 TCP-based protocol that operates on TCP port 22 and does not use HTTP in any capacity. In the exhibit, the Virtual Server is configured with an HTTP Profile applied, which is inappropriate for SSH traffic and causes connection failures.
According to the BIG-IP Administration: Data Plane Configuration documentation:
An HTTP profile must only be applied to Virtual Servers handling HTTP or HTTPS traffic.
When an HTTP profile is attached, BIG-IP expects HTTP headers and attempts to parse application-layer data.
Non-HTTP protocols such as SSH, FTP (control), SMTP, and other raw TCP services will fail if an HTTP profile is enabled.
Why the other options are incorrect:
A). Set Protocol to UDPSSH uses TCP, not UDP. Changing the protocol would break SSH entirely.
B). Set Source Address to 10.1.1.2The source address setting controls client access restrictions and is unrelated to protocol parsing issues.
C). Set Destination Address/Mask to 0.0.0.0/0The destination address is already valid for a specific SSH service and does not impact protocol handling.
Correct Resolution:
The BIG-IP Administrator should remove the HTTP Profile (set it to None) so the Virtual Server functions as a pure Layer 4 TCP service, allowing SSH connections to pass through successfully.
NEW QUESTION # 42
What is the status of a pool member when manual resume is enabled and a health check first fails and then passes?
- A. Offline (Disabled)
- B. Available (Disabled)
- C. Offline (Enabled)
- D. Available (Enabled)
Answer: A
Explanation:
With manual resume enabled, BIG-IP does not automatically return a pool member to service after recovery.
The member remains offline until manually re-enabled.
NEW QUESTION # 43
A BIG-IP Administrator configures an SSH pool with five members.
Which health monitor should be applied?
- A. TCP
- B. HTTP
- C. HTTPS
- D. UDP
Answer: A
Explanation:
SSH is a TCP-based service. A TCP monitor validates service availability without requiring application-layer inspection.
NEW QUESTION # 44
Application administrators are reporting that nodes different from those configured in the pool are selected.
The use of an iRule is suspected.
How can the BIG-IP Administrator check if an iRule is used for this traffic? (Choose two answers)
- A. Via the GUI at the Resources tab for the virtual server.
- B. Via TMSH with the list /ltm virtual <virtual_server> command.
- C. Via the GUI at the iRule tab for the virtual server.
- D. Via TMSH with the list /ltm rule <irule> command.
Answer: A,B
Explanation:
In BIG-IP systems, iRules influence traffic only when they are attached to a Virtual Server. If application traffic is being sent to nodes or pool members that are not defined in the pool, this typically indicates that an iRule is overriding the default load-balancing behavior by explicitly selecting a pool or node.
According to BIG-IP Administration: Data Plane Configuration and official F5 guidance:
* iRules are associated with Virtual Servers, not directly with pools or nodes.
* To determine whether an iRule is actively affecting traffic, the administrator must inspect the Virtual Server configuration.
Explanation of the correct answers:
* B. Via the GUI at the Resources tab for the virtual serverThe Resources tab in the Configuration Utility displays all traffic-handling objects applied to the Virtual Server, including assigned iRules. This is the primary GUI location to verify whether an iRule is influencing data plane traffic.
* C. Via TMSH with the list /ltm virtual <virtual_server> commandThis TMSH command displays the full Virtual Server configuration, including any iRules listed under the rules section. It is the authoritative CLI method to confirm iRule usage.
Why the other options are incorrect:
* A. Via TMSH with the list /ltm rule <irule> commandThis command only shows the contents of an iRule and does not indicate whether the iRule is attached to or used by any Virtual Server.
* D. Via the GUI at the iRule tab for the virtual serverBIG-IP does not provide a dedicated "iRule" tab on Virtual Servers. iRules are viewed and managed under the Resources tab.
Correct Conclusion:
To verify whether an iRule is responsible for unexpected node selection, the BIG-IP Administrator must examine the Virtual Server configuration, either through the Resources tab in the GUI or by using TMSH to list the Virtual Server configuration.
NEW QUESTION # 45
A configuration change is made on the standby member of a device group. What is displayed as " Recommended Action " on the Device Management Overview screen?
- A. Synchronize the standby member configuration to the group
- B. Synchronize the active member configuration to the group
- C. Activate device with the most recent configuration
- D. Force active member of device group to standby
Answer: A
Explanation:
The BIG-IP system uses a centralized management framework to ensure that all devices within a Sync- Failover group share a consistent configuration. When an administrator makes a change on any member of the group-whether it is the active or the standby device-the system detects a " ConfigSync " mismatch. The " Device Management > > Overview " screen tracks these changes by comparing the commit ID and timestamps of the configurations across all peers.
If a change is made on the standby member, that device now possesses a more recent configuration than the other members of the group. Consequently, the BIG-IP GUI will display a status of " Changes Pending " and suggest a Recommended Action to resolve the discrepancy. In this scenario, the correct action is to Synchronize the standby member configuration to the group. This push operation will copy the updated configuration from the standby device to the active device (and any other peers), bringing the entire cluster back into a " In Sync " status. It is important to note that BIG-IP allows bi-directional synchronization; you do not have to be on the active device to push a configuration. However, administrators must be cautious:
choosing Option C (Synchronizing the active member to the group) would overwrite the changes just made on the standby device with the older configuration from the active device, effectively reverting the changes. The Recommended Action always points toward the direction that propagates the most recent change to the rest of the group.
NEW QUESTION # 46
A BIG-IP Administrator creates an HTTP Virtual Server using an iApp template. After the Virtual Server is created, the user requests to change the destination IP addresses. The BIG-IP Administrator tries to change the destination IP address from 10.1.1.1 to 10.2.1.1 in Virtual Server settings, but receives the following error: " The application service must be updated using an application management interface. " What is causing this error?
- A. The Application Service was NOT deleted before making the IP address change.
- B. The IP addresses used are NOT from the same subnet as the Self IP.
- C. The IP addresses are already in use.
- D. The Application Services have Strict Updates enabled.
Answer: D
Explanation:
In F5 BIG-IP administration, iApps are designed to manage complex application configurations as a single unit. When an iApp is deployed, it creates an " Application Service " object that owns all the associated LTM objects, such as Virtual Servers, Pools, and Nodes. By default, these iApps are created with Strict Updates enabled. Strict Updates is a safety mechanism that prevents administrators from making manual " out-of-band
" changes to the individual objects created by the iApp. The system enforces this because manual changes would be overwritten the next time the iApp template is updated or re-entered.
When the administrator attempts to change the destination IP address directly on the Virtual Server object, the BIG-IP system checks the " Strict Updates " flag. If it is set to " Enabled, " the system blocks the modification and generates the error message stating the service must be updated via the application management interface.
To resolve this, the administrator must navigate to the iApp > > Application Services menu, select the specific application service, and go to the " Reconfigure " tab. Within the iApp configuration form, the destination IP can be safely changed. Alternatively, if the administrator specifically wants to manage the objects manually and forgo the benefits of the iApp template management, they could disable " Strict Updates " in the iApp properties, though this is generally discouraged as it breaks the template ' s logic. The error is not related to subnetting or duplicate IPs, but strictly to the configuration authority assigned to the iApp service.
NEW QUESTION # 47
Users are unable to reach an application. The Virtual Server shows a red diamond status in the Configuration Utility.
What is the cause?
- A. HTTPS traffic sent to HTTP Virtual Server
- B. All pool members are down
- C. Virtual Server is disabled
- D. All pool members are disabled
Answer: B
Explanation:
A red diamond indicates the Virtual Server is enabled but unavailable due to all pool members being down.
NEW QUESTION # 48
Where in the configuration utility should the BIG-IP Administrator verify the pool member currently assigned to a pool is on port 80?
- A. Local Traffic > Pools: Pool List. Select the pool in question, select Members tab, view the configured Health Monitor.
- B. Local Traffic > Nodes: Node List. Select the node in question, view the Health Monitor next to Configuration.
- C. Local Traffic > Pools: Pool List. Select the pool in question, select the Members tab, view the configured Service Port.
Answer: C
Explanation:
The BIG-IP Configuration Utility (GUI) organizes information hierarchically to allow for granular management of application objects. A Pool is a collection of backend servers (pool members) that provide the same service. To verify the specific network parameters-such as the IP address and the service port-of the servers within a pool, the administrator must navigate to the specific pool's configuration.
The standard procedural path to verify this is Local Traffic > Pools: Pool List, where the administrator selects the specific pool name. Once inside the pool's configuration, the Members tab displays a list of all IP addresses and service ports associated with that pool. Under the "Service Port" column, the administrator can confirm if the member is listening on port 80 (HTTP).
Options A and B are incorrect for this specific verification task. While Nodes (Option A) show the health of a physical server, a node represents only an IP address and does not have a "Service Port" associated with it until it is defined as a pool member. Verifying the Health Monitor (Option B) would tell the administrator how the system is checking the member's status, but it does not definitively show the port on which the member is actually receiving application traffic. In a BIG-IP environment, a pool member is uniquely identified by the combination of its Node IP and its Service Port, and the Members tab is the primary interface for managing and auditing these specific member attributes.
NEW QUESTION # 49
Refer to the exhibit.
A BIG-IP Administrator needs to configure health monitors for a newly configured server pool named Pool_B. Which health monitor settings will ensure that all pool members will be accurately marked as available or unavailable?
- A. HTTPS, HTTP, FTP, and ICMP, with the Availability Requirement of all health monitors
- B. HTTPS, HTTP, FTP, and SSH with the Availability Requirement of all health monitors
- C. HTTPS, HTTP, FTP, and SSH, with the Availability Requirement of at least one monitor
- D. HTTPS and HTTP with the Availability Requirement of at least one health monitor
Answer: C
Explanation:
The pool member list in the exhibit shows servers listening on four distinct service ports: 80 (HTTP), 21 (FTP), 443 (HTTPS), and 22 (SSH). To accurately monitor a pool where members provide different services, the administrator must apply monitors that correspond to each of those specific services.
The key to this configuration is the Availability Requirement (also known as " Monitor Rule " ). If the administrator sets the requirement to " All health monitors, " every single monitor (HTTP, HTTPS, FTP, and SSH) must pass for a member to be marked " Up. " This would cause an immediate failure: for example, a server listening only on port 80 would fail the HTTPS, FTP, and SSH checks, resulting in the member being marked " Down " even if the HTTP service is healthy.
To ensure accuracy, the administrator should apply all four relevant monitors and set the Availability Requirement to at least one monitor. With this setting, the BIG-IP marks a member as " Up " if any of the assigned monitors return a successful response. Therefore, the member at 10.200.50.210:80 will stay " Up " as long as the HTTP monitor passes, even though it fails the FTP, HTTPS, and SSH monitors. This configuration allows a single pool to contain diverse service types while ensuring that the specific port defined for each member is verified correctly. Option C is incorrect because ICMP only checks if the IP is alive, not if the specific service port is functioning.
NEW QUESTION # 50
Which persistence profile would be the most appropriate to ensure an HTTP web request connects to the same pool member? (Choose one answer)
- A. Cookie persistence
- B. SSL persistence
- C. Hash persistence
- D. Destination address
Answer: A
Explanation:
For HTTP-based applications, cookie persistence is the most appropriate and commonly recommended persistence method.
According to the BIG-IP Administration: Data Plane Configuration documentation:
Cookie persistence inserts or uses an HTTP cookie to maintain session affinity.
It operates at Layer 7 (HTTP) and is application-aware.
It allows persistence to be maintained even when multiple clients are behind a NAT device.
Why the other options are incorrect:
A . Destination address
Destination address persistence is generally used for inbound traffic patterns such as firewall or proxy scenarios.
B . Hash persistence
Hash persistence is less granular and not HTTP-specific.
C . SSL persistence
SSL persistence is typically used when SSL session IDs are reused and is less reliable than cookies for HTTP applications.
Correct Resolution:
Using cookie persistence ensures that HTTP web requests are consistently directed to the same pool member.
NEW QUESTION # 51
To increase available bandwidth of an existing Trunk, the BIG-IP Administrator is adding additional interfaces. Which command should the BIG-IP Administrator run from within the bash shell?
- A. tmsh modify /net trunk trunk_A interfaces add {1.3 1.4}
- B. tmsh modify /sys trunk trunk_A interfaces add {1.3 1.4}
- C. tmsh create /net trunk trunk_A interfaces add {1.3 1.4}
- D. tmsh create /sys trunk trunk_A interfaces add {1.3 1.4}
Answer: A
Explanation:
This question tests precise knowledge of both TMSH command syntax and BIG-IP object namespace hierarchy . Two critical distinctions must be correctly identified:
1. create vs. modify: Since the Trunk already exists and the administrator is adding interfaces to it, the correct verb is modify - not create . Using create on an existing object would either throw an error or attempt to overwrite the object entirely, neither of which is the desired outcome.
2. /sys vs. /net namespace: Trunk objects in BIG-IP reside within the /net namespace, which encompasses network-layer constructs including Trunks, VLANs, Self IPs, and Routes. The /sys namespace is reserved for system-level objects such as management settings, software, and licensing - it does not contain Trunk objects.
Therefore, the only syntactically and functionally correct command is:
tmsh modify /net trunk trunk_A interfaces add {1.3 1.4}
This command appends interfaces 1.3 and 1.4 to the existing trunk_A object without disrupting currently assigned interfaces, increasing aggregated bandwidth accordingly.
Options A and C use the incorrect /sys namespace, and options A and B incorrectly use the create verb for an existing object.
Reference: BIG-IP Administration - Data Plane Configuration, Module: TMSH Command Syntax - Network Object Management.
NEW QUESTION # 52
A BIG-IP Administrator adds new pool members into a highly utilized pool. Users report application failures.
Which pool-level setting should be checked?
- A. Availability Requirement
- B. Slow Ramp Time
- C. Allow SNAT
- D. Action On Service Down
Answer: B
Explanation:
Slow Ramp Time prevents new pool members from receiving full traffic immediately, avoiding overload.
NEW QUESTION # 53
In a pool there are 2 pool members (older servers) that can handle fewer connections than the other 3 newer servers.
Which load balancing method would allow more traffic to be directed to the newer servers? (Choose one answer)
- A. Round Robin
- B. Global Availability
- C. Weighted Least Connections (member)
- D. Least Connections (member)
Answer: C
Explanation:
This scenario requires unequal load distribution based on server capacity. The newer servers must receive more connections than the older ones, while still dynamically accounting for active connection counts.
According to BIG-IP Administration: Data Plane Configuration documentation:
Weighted Least Connections (member) combines:
Connection awareness (least connections)
Administrator-defined weights (ratios) to reflect server capacity
Pool members with higher weights receive proportionally more new connections than members with lower weights, even when using the same load balancing algorithm.
Why B is correct:
Allows assigning higher weights to newer servers and lower weights to older servers Ensures smarter traffic distribution based on both capacity and real-time load Why the other options are incorrect:
A). Global AvailabilityUsed for disaster recovery and site failover, not intra-pool load distribution.
C). Round RobinDistributes connections evenly without considering server capacity.
D). Least Connections (member)Balances only by current connection count and does not account for differences in server performance or capacity.
Correct Resolution:
Use Weighted Least Connections (member) and assign higher weights to newer servers so they receive more traffic while protecting older servers from overload.
NEW QUESTION # 54
For a given Virtual Server, the BIG-IP must perform SSL Offload and negotiate secure communication over TLSv1.2 only. What should the BIG-IP Administrator do to meet this requirement?
- A. Configure a custom SSL Profile (Server) and select no TLSv1 in the options list
- B. Configure a custom SSL Profile (Server) with a custom TLSv1.2 cipher string
- C. Configure a custom SSL Profile (Client) with a custom TLSv1.2 cipher string
- D. Configure a custom SSL Profile (Client) and select no TLSv1 in the options list
Answer: C
Explanation:
To fulfill the requirement of "SSL Offload" limited to "TLSv1.2 only," the administrator must focus on the client-side of the connection. SSL Offload means the BIG-IP terminates the encrypted connection from the user, processes the traffic (often as plain text internally), and optionally sends it to the backend. The profile responsible for this termination and the initial negotiation with the client's browser is the Client SSL Profile.
A custom Client SSL Profile must be created because the default clientssl profile typically allows a broad range of protocols for compatibility (including TLS 1.0, 1.1, and 1.2). To restrict communication specifically to TLS 1.2, the administrator modifies the Ciphers string within the profile. Using a string such as DEFAULT:!SSLv3:!TLSv1:!TLSv1.1 or specifically defining TLSv1.2-only suites ensures that the BIG-IP will reject any handshake attempts from older, less secure protocols.
Server SSL Profiles (Options B and C) are used for the encryption between the BIG-IP and the backend nodes, which is not what is requested here. Simply selecting "no TLSv1" in an options list (Option D) is insufficient and often refers to older versions of the software; the modern and standard way to control protocol negotiation on a BIG-IP is through the precise application of Cipher Strings within the Client SSL profile. This ensures compliance with security standards like PCI-DSS while providing the offloading benefits to the backend infrastructure.
NEW QUESTION # 55
......
F5CAB3 Questions Prepare with Learning Information: https://www.testinsides.top/F5CAB3-dumps-review.html
Practice Material for F5CAB3 Exam Question Preparation: https://drive.google.com/open?id=1_y_zGprjc-oiIwScCMzpi6dI4yeukU-r