F5 Networks BIG-IP Administration Data Plane Configuration F5CAB3 Exam Questions

Answer : D

When a single IP address (Virtual Server) must host multiple hostnames (e.g., site1.com, site2.com) over HTTPS, the BIG-IP must be able to present the correct SSL certificate for each site during the initial handshake. This requirement is handled by a technology called Server Name Indication (SNI).

To implement this on the BIG-IP, the administrator must use a Client SSL profile because the encryption is occurring between the user (Client) and the Virtual Server. Within the Client SSL profile settings, there is a field called Server Name. By creating multiple Client SSL profiles---each with a different 'Server Name' (the hostname) and its corresponding certificate---and attaching them all to the same Virtual Server, the BIG-IP can inspect the SNI extension in the client's 'Client Hello' packet. It then selects the specific profile that matches the requested hostname.

Option A is incorrect because 'Client Name' is not the standard field name used for SNI hostname matching in the profile. Options B and C refer to Server SSL profiles, which manage the connection between the BIG-IP and the backend servers. While Server SSL profiles also have a 'Server Name' field (used to send SNI to a backend server), the requirement here is to provide encrypted communication for 'users' accessing the virtual server, which definitively requires a Client-side SSL configuration.

Answer : A

The pool member list in the exhibit shows servers listening on four distinct service ports: 80 (HTTP), 21 (FTP), 443 (HTTPS), and 22 (SSH). To accurately monitor a pool where members provide different services, the administrator must apply monitors that correspond to each of those specific services.

The key to this configuration is the Availability Requirement (also known as 'Monitor Rule'). If the administrator sets the requirement to 'All health monitors,' every single monitor (HTTP, HTTPS, FTP, and SSH) must pass for a member to be marked 'Up.' This would cause an immediate failure: for example, a server listening only on port 80 would fail the HTTPS, FTP, and SSH checks, resulting in the member being marked 'Down' even if the HTTP service is healthy.

To ensure accuracy, the administrator should apply all four relevant monitors and set the Availability Requirement to at least one monitor. With this setting, the BIG-IP marks a member as 'Up' if any of the assigned monitors return a successful response. Therefore, the member at 10.200.50.210:80 will stay 'Up' as long as the HTTP monitor passes, even though it fails the FTP, HTTPS, and SSH monitors. This configuration allows a single pool to contain diverse service types while ensuring that the specific port defined for each member is verified correctly. Option C is incorrect because ICMP only checks if the IP is alive, not if the specific service port is functioning.

Answer : A

To solve this requirement, we must distinguish between the two 'legs' of an SSL connection in a BIG-IP environment: Client-side and Server-side.

Current State (SSL Bridging): The administrator states the servers currently require encrypted traffic. This means the BIG-IP is likely performing 'SSL Bridging.' In this setup, a Client SSL profile terminates encryption from the user, and a Server SSL profile re-encrypts the traffic before sending it to the back-end servers.

Target State (SSL Offloading): The requirement is to 'offload SSL' to reduce web server load. This means the BIG-IP will continue to handle the encryption for the users (keeping the Client SSL profile) but will communicate with the back-end servers using unencrypted HTTP.

Why Option A is correct:

Remove the Server SSL profile: By removing this profile, the BIG-IP stops attempting to initiate an SSL/TLS handshake with the pool members.

Configure Pool Members to use HTTP: The service port for the pool members must be changed (typically from port 443 to port 80) so that the BIG-IP sends standard HTTP traffic to the servers.

Why other options are incorrect:

B & D: These suggest removing the Client SSL profile. If you remove this, the users can no longer connect via HTTPS, which violates the requirement for encrypted communication between the users and the BIG-IP.

C: Changing the Virtual Server to accept HTTP traffic would mean the user-to-BIG-IP connection is no longer encrypted, which is the opposite of SSL termination/offloading.

Answer : A

In this scenario, each backend node (server) hosts multiple services and is referenced by multiple pools and virtual servers. The goal is to ensure an equal number of total connections per backend server, regardless of how many pool members (services/ports) exist on that server.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Least Connections (node) tracks the total number of active connections to a node across all pool members and services.

This algorithm ensures load distribution is balanced at the server level, not just at the individual service (member) level.

It is specifically recommended when:

Multiple pool members exist on the same backend server

Multiple virtual servers reference the same backend servers

Why the other options are incorrect:

B . Predictive (member)Predictive algorithms are advanced and traffic-pattern based, but they operate at the member level and do not guarantee equal connections per server.

C . Least Connections (member)This balances connections per pool member, which can overload a server hosting multiple members while still appearing ''balanced'' per member.

D . Predictive (node)Although node-aware, predictive algorithms are less deterministic and not the best choice when strict equality of connections is required.

Correct Resolution:

Using Least Connections (node) ensures that each backend server carries an equal connection load across all services and pools.

Answer : B

When clients connect through a single source IP (NAT) --- such as a corporate proxy or carrier-grade NAT --- Source Address Affinity persistence becomes entirely ineffective because all clients share an identical source IP address. This would force every client session to the same pool member, completely eliminating even distribution and defeating the purpose of load balancing.

Cookie Persistence is the optimal solution in this scenario because it operates at Layer 7, inserting a unique cookie into each client's HTTP/HTTPS response. Each individual browser session carries its own distinct cookie value, allowing the BIG-IP to identify and persist individual clients to specific pool members --- regardless of whether they share a common source IP address. This guarantees both session persistence and even load distribution across pool members.

The remaining options are unsuitable because:

Destination Address Affinity persists based on destination IP, irrelevant for client-to-server session stickiness.

SSL Persistence uses the SSL Session ID for persistence, but SSL session IDs are frequently renegotiated and are unreliable for long-term persistence across modern TLS implementations.

Source Address Affinity fails entirely under NAT conditions as described.

Cookie persistence is the industry-standard method for HTTPS application load balancing requiring per-client session affinity.

Answer : B

In the F5 BIG-IP ecosystem, a standard ICMP health monitor functions by sending an ICMP echo request to a target node and expecting an ICMP echo reply within a specified timeout period. When a node is marked 'DOWN' despite the backend server being configured to respond to ICMP, the issue typically lies in the network path or the specific packet exchange between the BIG-IP's self IP and the node's IP. Running a tcpdump is the most effective next step because it provides a real-time packet capture of the actual monitor traffic leaving the BIG-IP and any return traffic coming back from the server. This allows the administrator to verify if the BIG-IP is actually sending the echo request, if the request is reaching the server, and if the server is indeed replying or if the reply is being dropped by an intermediate firewall or a security policy.

While other tools have their place, they are inappropriate for this specific layer 3/4 connectivity issue. A qkview is a comprehensive diagnostic file used primarily for F5 Support to analyze the entire system's state but is overkill for initial connectivity troubleshooting. An ssldump is used for inspecting SSL/TLS handshakes and encrypted payloads, which is irrelevant for a non-encrypted ICMP monitor. A curl command is a tool for testing HTTP/HTTPS application-level responses; it cannot be used to troubleshoot ICMP (ping) connectivity directly. By using tcpdump -ni <vlan_name> host <node_ip>, the administrator can see the ICMP 'type 8' (request) and 'type 0' (reply) packets, immediately identifying if the monitor failure is due to a 'Destination Unreachable' message or a simple lack of response, thereby pinpointing the root cause in the data plane.

Answer : A

With manual resume enabled, BIG-IP does not automatically return a pool member to service after recovery. The member remains offline until manually re-enabled.