Instant Download F5CAB3 Dumps Q&As Provide PDF&Test Engine
Fast Exam Updates F5CAB3 dumps with PDF Test Engine Practice
F5 F5CAB3 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
NEW QUESTION # 45
Refer to the exhibit.
A BIG-IP Administrator creates a new Virtual Server to load balance SSH traffic. Users are unable to log on to the servers.
What should the BIG-IP Administrator do to resolve the issue? (Choose one answer)
- A. Set HTTP Profile to None
- B. Set Protocol to UDP
- C. Set Source Address to 10.1.1.2
- D. Set Destination Address/Mask to 0.0.0.0/0
Answer: A
Explanation:
SSH is a Layer 4 TCP-based protocol that operates on TCP port 22 and does not use HTTP in any capacity. In the exhibit, the Virtual Server is configured with an HTTP Profile applied, which is inappropriate for SSH traffic and causes connection failures.
According to the BIG-IP Administration: Data Plane Configuration documentation:
An HTTP profile must only be applied to Virtual Servers handling HTTP or HTTPS traffic.
When an HTTP profile is attached, BIG-IP expects HTTP headers and attempts to parse application-layer data.
Non-HTTP protocols such as SSH, FTP (control), SMTP, and other raw TCP services will fail if an HTTP profile is enabled.
Why the other options are incorrect:
A). Set Protocol to UDPSSH uses TCP, not UDP. Changing the protocol would break SSH entirely.
B). Set Source Address to 10.1.1.2The source address setting controls client access restrictions and is unrelated to protocol parsing issues.
C). Set Destination Address/Mask to 0.0.0.0/0The destination address is already valid for a specific SSH service and does not impact protocol handling.
Correct Resolution:
The BIG-IP Administrator should remove the HTTP Profile (set it to None) so the Virtual Server functions as a pure Layer 4 TCP service, allowing SSH connections to pass through successfully.
NEW QUESTION # 46
For a given Virtual Server, the BIG-IP must perform SSL Offload and negotiate secure communication over TLSv1.2 only. What should the BIG-IP Administrator do to meet this requirement?
- A. Configure a custom SSL Profile (Client) with a custom TLSv1.2 cipher string
- B. Configure a custom SSL Profile (Server) and select no TLSv1 in the options list
- C. Configure a custom SSL Profile (Server) with a custom TLSv1.2 cipher string
- D. Configure a custom SSL Profile (Client) and select no TLSv1 in the options list
Answer: A
Explanation:
To fulfill the requirement of "SSL Offload" limited to "TLSv1.2 only," the administrator must focus on the client-side of the connection. SSL Offload means the BIG-IP terminates the encrypted connection from the user, processes the traffic (often as plain text internally), and optionally sends it to the backend. The profile responsible for this termination and the initial negotiation with the client's browser is the Client SSL Profile.
A custom Client SSL Profile must be created because the default clientssl profile typically allows a broad range of protocols for compatibility (including TLS 1.0, 1.1, and 1.2). To restrict communication specifically to TLS 1.2, the administrator modifies the Ciphers string within the profile. Using a string such as DEFAULT:!SSLv3:!TLSv1:!TLSv1.1 or specifically defining TLSv1.2-only suites ensures that the BIG-IP will reject any handshake attempts from older, less secure protocols.
Server SSL Profiles (Options B and C) are used for the encryption between the BIG-IP and the backend nodes, which is not what is requested here. Simply selecting "no TLSv1" in an options list (Option D) is insufficient and often refers to older versions of the software; the modern and standard way to control protocol negotiation on a BIG-IP is through the precise application of Cipher Strings within the Client SSL profile. This ensures compliance with security standards like PCI-DSS while providing the offloading benefits to the backend infrastructure.
NEW QUESTION # 47
A set of servers is used for an FTP application as well as an HTTP website via separate BIG-IP Pools. The server support team reports that some servers are receiving a lot more traffic than others. Which Load Balancing Method should the BIG-IP Administrator apply to even out the connection count?
- A. Least Connections (Node)
- B. Least Connections (Member)
- C. Ratio (Member)
- D. Ratio (Node)
Answer: A
Explanation:
Similar to the logic required for managing multi-service backend environments, the issue described-where servers hosting multiple protocols like FTP and HTTP are experiencing uneven distribution-stems from the BIG-IP's default behavior of treating each pool independently. If the administrator uses a member-based load balancing method, the BIG-IP distributes HTTP traffic regardless of how much FTP traffic that same physical server is currently processing.
To resolve this, the administrator must utilize the Least Connections (Node) method. By switching both the HTTP and FTP pools to this algorithm, the BIG-IP begins to make load balancing decisions based on the total combined connection count for the IP address of each server. When a new HTTP request arrives, the BIG-IP checks which server has the fewest total connections (including existing FTP sessions). This prevents a server that is already busy with long-lived FTP transfers from being overwhelmed by a sudden burst of HTTP requests.
Ratio methods (Options A and C) are static and rely on the administrator manually assigning weights to servers based on their perceived capacity; they do not adapt to real-time fluctuations in traffic volume across different pools. Least Connections (Member) (Option B) remains blind to the "cross-pool" traffic on the same hardware. Only the Node-based Least Connections approach provides the global visibility necessary to "even out" the total resource utilization across servers supporting multiple distinct applications.
NEW QUESTION # 48
A BIG-IP Administrator uses backend servers to host multiple services per server. There are multiple virtual servers and pools defined, referencing the same backend servers. Which load balancing algorithm is most appropriate to have an equal number of connections on each backend server?
- A. Least Connections (member)
- B. Least Connections (node)
- C. Predictive (member)
- D. Predictive (node)
Answer: B
Explanation:
This question addresses the critical architectural distinction between "member-based" and "node-based" load balancing in environments where servers are multi-homed or host multiple virtualized services. On a BIG-IP, a node represents the underlying IP address of a physical or virtual server, while a pool member represents a specific combination of that IP and a service port (e.g., 10.1.1.10:80).
When multiple pools reference the same IP address across different ports or Virtual Servers, using Least Connections (member) (Option D) only balances connections relative to that specific pool. For example, if Pool_A and Pool_B both use Server_X, and Pool_A has 100 connections while Pool_B has only 5, a member- based algorithm for Pool_B only sees the 5 connections and may continue to send traffic there even if Server_X is CPU-saturated by Pool_A.
The Least Connections (node) algorithm (Option B) solves this by tracking the aggregate total of all active connections directed to that specific node (IP address) across every pool on the system. By selecting the node with the absolute lowest total connection count, the BIG-IP ensures a more equitable distribution of work at the hardware resource level. Predictive methods (Options A and C) use a ranking system based on the trend of connection counts over time, but for the specific requirement of maintaining an equal number of current connections on multi-service servers, the direct Least Connections (node) calculation is the standard and most effective procedural choice.
NEW QUESTION # 49
The BIG-IP Administrator has to provide encrypted communication between users and the virtual server they access. Multiple hostnames are configured in DNS with the same IP address.
Which profile type and setting in the profile should be used? (Choose one answer)
- A. Client SSL, Client Name
- B. Server SSL, Client Name
- C. Client SSL, Server Name
- D. Server SSL, Server Name
Answer: C
Explanation:
When multiple hostnames resolve to the same IP address and encrypted communication is required, the BIG-IP must be able to present the correct SSL certificate based on the hostname requested by the client. This is accomplished using Server Name Indication (SNI).
According to BIG-IP Administration: Data Plane Configuration documentation:
SNI is a client-side TLS extension, where the client includes the requested hostname during the SSL handshake.
BIG-IP evaluates this hostname using the Client SSL profile, not the Server SSL profile.
The "Server Name" setting in the Client SSL profile enables BIG-IP to select the appropriate SSL certificate for the requested hostname.
Why option C is correct:
Client SSL profile handles inbound (client-side) encryption.
Server Name enables SNI-based certificate selection when multiple DNS names share the same virtual server IP.
Why the other options are incorrect:
A . Client SSL, Client Name
There is no Client SSL setting called Client Name for SNI certificate selection.
B . Server SSL, Server Name
Server SSL is used for encryption between BIG-IP and backend servers, not for client-side hostname identification.
D . Server SSL, Client Name
Server SSL does not process client-requested hostnames during TLS negotiation.
Correct Resolution:
Configure a Client SSL profile and enable the Server Name (SNI) setting to support multiple encrypted hostnames on the same virtual server IP.
NEW QUESTION # 50
An organization reports slow performance accessing an Intranet website. All employees use a single proxy IP.
What should the BIG-IP Administrator do?
- A. Change Default Persistence to cookie
- B. Change Load Balancing to Least Connections
- C. Change Fallback Persistence to source_addr
- D. Change Source Address to proxy IP
Answer: A
Explanation:
When many users share one source IP, source-address persistence fails. Cookie persistence uniquely identifies clients at Layer 7.
NEW QUESTION # 51
Users report that traffic is negatively affected every time a BIG-IP device fails over. The traffic becomes stabilized after a few minutes. What should the BIG-IP Administrator do to reduce the impact of future failovers?
- A. Configure MAC Masquerade
- B. Configure a global SNAT Listener
- C. Enable Failover Multicast Configuration
- D. Set up Failover Method to HA Order
Answer: A
Explanation:
When a failover occurs in a standard BIG-IP High Availability (HA) pair, the newly active device takes over the floating IP addresses (Virtual Servers, Self IPs). By default, the new active device sends Gratuitous ARP (GARP) messages to the local network switch to inform it that these IP addresses are now associated with its own physical MAC addresses. However, network switches and intermediate routers often have ARP aging timers or security features that may delay the updating of their ARP tables, leading to "black-holed" traffic or dropped packets for several seconds or minutes until the network infrastructure correctly relearns the new path.
To eliminate this delay and ensure a seamless transition, a BIG-IP Administrator should Configure MAC Masquerade. MAC Masquerade allows the administrator to assign a unique, "virtual" MAC address to a specific traffic group. Instead of using the hardware-burned MAC address of the individual appliance, the active device uses this shared virtual MAC address for all communication involving floating IPs. When a failover occurs, the standby device assumes control of the traffic group and begins using the exact same virtual MAC address. Because the MAC address associated with the VIPs never changes from the switch's perspective, there is no need for the switch to update its MAC address table or for the surrounding infrastructure to update its ARP caches. This effectively eliminates the "stabilization period" reported by users, as the data plane transition happens almost instantaneously at Layer 2, maintaining continuous traffic flow without being hindered by external network re-convergence times.
NEW QUESTION # 52
A node is a member of multiple pools and hosts different applications. If one application becomes unavailable, only that pool member should be marked down.
What should the BIG-IP Administrator deploy?
- A. ICMP + TCP monitor
- B. TCP monitor
- C. UDP monitor
- D. HTTP monitor with custom send/receive
Answer: D
Explanation:
Application-level monitors ensure that only the affected service is marked down, not the entire node.
NEW QUESTION # 53
Application administrators are reporting that nodes different from those configured in the pool are selected.
The use of an iRule is suspected.
How can the BIG-IP Administrator check if an iRule is used for this traffic? (Choose two answers)
- A. Via TMSH with the list /ltm rule <irule> command.
- B. Via the GUI at the Resources tab for the virtual server.
- C. Via TMSH with the list /ltm virtual <virtual_server> command.
- D. Via the GUI at the iRule tab for the virtual server.
Answer: B,C
Explanation:
In BIG-IP systems, iRules influence traffic only when they are attached to a Virtual Server. If application traffic is being sent to nodes or pool members that are not defined in the pool, this typically indicates that an iRule is overriding the default load-balancing behavior by explicitly selecting a pool or node.
According to BIG-IP Administration: Data Plane Configuration and official F5 guidance:
* iRules are associated with Virtual Servers, not directly with pools or nodes.
* To determine whether an iRule is actively affecting traffic, the administrator must inspect the Virtual Server configuration.
Explanation of the correct answers:
* B. Via the GUI at the Resources tab for the virtual serverThe Resources tab in the Configuration Utility displays all traffic-handling objects applied to the Virtual Server, including assigned iRules. This is the primary GUI location to verify whether an iRule is influencing data plane traffic.
* C. Via TMSH with the list /ltm virtual <virtual_server> commandThis TMSH command displays the full Virtual Server configuration, including any iRules listed under the rules section. It is the authoritative CLI method to confirm iRule usage.
Why the other options are incorrect:
* A. Via TMSH with the list /ltm rule <irule> commandThis command only shows the contents of an iRule and does not indicate whether the iRule is attached to or used by any Virtual Server.
* D. Via the GUI at the iRule tab for the virtual serverBIG-IP does not provide a dedicated "iRule" tab on Virtual Servers. iRules are viewed and managed under the Resources tab.
Correct Conclusion:
To verify whether an iRule is responsible for unexpected node selection, the BIG-IP Administrator must examine the Virtual Server configuration, either through the Resources tab in the GUI or by using TMSH to list the Virtual Server configuration.
NEW QUESTION # 54
A BIG-IP Administrator needs to apply persistence to a virtual server that is configured as a Performance (Layer 4) virtual server that allows access to a secure (TLS) e-commerce website.
What type of persistence profile can be used? (Choose one answer)
- A. Source Address Affinity
- B. Microsoft RDP persistence
- C. Host persistence
- D. Cookie persistence
Answer: A
Explanation:
A Performance (Layer 4) virtual server does not inspect or process application-layer data such as HTTP headers or cookies. Therefore, only Layer 4-compatible persistence methods can be used.
According to the BIG-IP Administration: Data Plane Configuration documentation:
* Source Address Affinity persistence operates at Layer 4 and uses the client IP address to maintain session persistence.
* It is fully compatible with Performance (Layer 4) virtual servers.
* It works regardless of encryption, making it suitable for TLS-secured applications.
Why the other options are incorrect:
* B. Cookie persistenceRequires an HTTP profile and Layer 7 inspection, which is not supported on Performance virtual servers.
* C. Microsoft RDP persistenceIs protocol-specific and not applicable to web-based TLS traffic.
* D. Host persistenceRequires HTTP host header inspection, which is not available at Layer 4.
Correct Resolution:
Source Address Affinity persistence is the appropriate choice for maintaining persistence on a Performance (Layer 4) virtual server handling TLS traffic.
Below is Batch 1 (Questions 1-10) extracted only from your uploaded document that are directly related to BIG-IP Administration: Data Plane Configuration topics (Virtual Servers, Pools, Load Balancing, Monitors, Persistence, SNAT, Profiles).
I have excluded system-only, licensing, support, hardware, HA management-only, and admin UI questions that are not Data Plane-focused.
Source: Your uploaded TMOS Administration v2.0 document
# BATCH 1 (10 Questions)
NEW QUESTION # 55
Refer to the exhibit.
A BIG-IP Administrator creates a new Virtual Server to load balance SSH traffic. Users are unable to log on to the servers.
What should the BIG-IP Administrator do to resolve the issue? (Choose one answer)
- A. Set HTTP Profile to None
- B. Set Protocol to UDP
- C. Set Source Address to 10.1.1.2
- D. Set Destination Address/Mask to 0.0.0.0/0
Answer: A
Explanation:
SSH is a Layer 4 TCP-based protocol that operates on TCP port 22 and does not use HTTP in any capacity. In the exhibit, the Virtual Server is configured with an HTTP Profile applied, which is inappropriate for SSH traffic and causes connection failures.
According to the BIG-IP Administration: Data Plane Configuration documentation:
An HTTP profile must only be applied to Virtual Servers handling HTTP or HTTPS traffic.
When an HTTP profile is attached, BIG-IP expects HTTP headers and attempts to parse application-layer data.
Non-HTTP protocols such as SSH, FTP (control), SMTP, and other raw TCP services will fail if an HTTP profile is enabled.
Why the other options are incorrect:
A . Set Protocol to UDP
SSH uses TCP, not UDP. Changing the protocol would break SSH entirely.
B . Set Source Address to 10.1.1.2
The source address setting controls client access restrictions and is unrelated to protocol parsing issues.
C . Set Destination Address/Mask to 0.0.0.0/0
The destination address is already valid for a specific SSH service and does not impact protocol handling.
Correct Resolution:
The BIG-IP Administrator should remove the HTTP Profile (set it to None) so the Virtual Server functions as a pure Layer 4 TCP service, allowing SSH connections to pass through successfully.
NEW QUESTION # 56
Due to a change in application requirements, a BIG-IP Administrator needs to modify the configuration of a Virtual Server to include a Fallback Persistence Profile.
Which persistence profile type should the BIG-IP Administrator use?
- A. Source Address Affinity
- B. Hash
- C. SSL
- D. Universal
Answer: A
Explanation:
Fallback persistence is used when the primary persistence method fails. Source Address Affinity is a Layer 4 persistence method and is fully supported as a fallback option for most virtual server types.
NEW QUESTION # 57
Which persistence profile would be the most appropriate to ensure an HTTP web request connects to the same pool member? (Choose one answer)
- A. SSL persistence
- B. Destination address
- C. Hash persistence
- D. Cookie persistence
Answer: D
Explanation:
For HTTP-based applications, cookie persistence is the most appropriate and commonly recommended persistence method.
According to the BIG-IP Administration: Data Plane Configuration documentation:
Cookie persistence inserts or uses an HTTP cookie to maintain session affinity.
It operates at Layer 7 (HTTP) and is application-aware.
It allows persistence to be maintained even when multiple clients are behind a NAT device.
Why the other options are incorrect:
A . Destination address
Destination address persistence is generally used for inbound traffic patterns such as firewall or proxy scenarios.
B . Hash persistence
Hash persistence is less granular and not HTTP-specific.
C . SSL persistence
SSL persistence is typically used when SSL session IDs are reused and is less reliable than cookies for HTTP applications.
Correct Resolution:
Using cookie persistence ensures that HTTP web requests are consistently directed to the same pool member.
NEW QUESTION # 58
A BIG-IP Administrator adds new pool members into an existing, highly utilized pool. Soon after, there are reports that the application is failing to load for some users.
What pool-level setting should the BIG-IP Administrator check?
- A. Availability Requirement
- B. Action On Service Down
- C. Slow Ramp Time
- D. Allow SNAT
Answer: C
Explanation:
Slow Ramp Time prevents new pool members from receiving a full share of traffic immediately, allowing applications to warm up gradually.
NEW QUESTION # 59
During a high-demand event, the BIG-IP Administrator needs to limit the number of new connections per second to a Virtual Server.
What should be applied?
- A. HTTP Compression profile
- B. Connection Rate Limit
- C. OneConnect profile
- D. Connection Limit
Answer: B
Explanation:
Connection rate limits restrict how many new connections are accepted per second, protecting application resources.
NEW QUESTION # 60
All pool members are online. All other virtual server settings are at default. What might alter the load balancing behavior?
- A. Enabling SNAT automap
- B. Adding a oneconnect profile
- C. Enabling a fallback host in the http profile
- D. Adding a persistence profile
Answer: D
Explanation:
In a default BIG-IP configuration, the system utilizes the Load Balancing Method (typically Round Robin) to distribute each new connection across available pool members. However, the introduction of a persistence profile fundamentally changes this behavior. Persistence (also known as "stickiness") ensures that once a client has been load balanced to a specific pool member, all subsequent requests from that same client during a defined session or timeout period are directed to that same member, bypassing the standard load balancing algorithm. This is critical for applications that maintain state, such as shopping carts or authenticated sessions, where moving a user to a different server would result in a loss of session data.
While other options affect traffic handling, they do not "alter" the fundamental load balancing decision in the same way. A OneConnect profile (Option A) optimizes connection management by pooling idle server-side connections; while it changes how connections are reused, the initial load balancing decision still follows the configured method. A fallback host (Option C) is only utilized when the primary pool is unavailable, and since the question states all pool members are online, it remains inactive. SNAT Automap (Option D) changes the source IP address of the packet as it exits the BIG-IP toward the server to ensure return traffic passes back through the ADC, but it does not dictate which server is chosen for the request. Therefore, the persistence profile is the primary configuration element that overrides the load balancing algorithm to maintain a client-to- server relationship.
NEW QUESTION # 61
A Standard Virtual Server for a web application is configured with SNAT Automap. The original client IP must be known by backend servers.
What should the BIG-IP Administrator configure?
- A. Performance (HTTP) Virtual Server
- B. HTTP Transparent profile
- C. SNAT pool using client IP
- D. HTTP profile with X-Forwarded-For
Answer: D
Explanation:
X-Forwarded-For inserts the original client IP into HTTP headers while SNAT is enabled.
NEW QUESTION # 62
DNS queries from internal DNS servers fail when sent through a BIG-IP Virtual Server.
Which Virtual Server property should be changed?
- A. Source Address to subnet
- B. Type to Performance (HTTP)
- C. Protocol to UDP
- D. Protocol Profile (Client) to DNS_OPTIMIZED
Answer: C
Explanation:
Standard DNS queries use UDP. Configuring the Virtual Server for TCP causes DNS traffic to fail.
NEW QUESTION # 63
Which type of Virtual Server requires the use of a FastL4 profile?
- A. Standard
- B. Performance (Layer 4)
- C. Stateless
- D. Performance (HTTP)
Answer: B
Explanation:
Performance (Layer 4) virtual servers rely on FastL4 profiles for high-speed Layer 4 traffic handling.
NEW QUESTION # 64
Users are unable to reach an application. The Virtual Server shows a red diamond status in the Configuration Utility.
What is the cause?
- A. All pool members are down
- B. All pool members are disabled
- C. HTTPS traffic sent to HTTP Virtual Server
- D. Virtual Server is disabled
Answer: A
Explanation:
A red diamond indicates the Virtual Server is enabled but unavailable due to all pool members being down.
NEW QUESTION # 65
......
Exam Valid Dumps with Instant Download Free Updates: https://www.examcollectionpass.com/F5/F5CAB3-practice-exam-dumps.html
F5CAB3 Dumps First Attempt Guaranteed Success: https://drive.google.com/open?id=1PaJ0L5gYVCpuOo3XvNoY0Her-rqgPK09