F5CAB3 BIG-IP Administration Data Plane Configuration (F5CAB3) exam Questions and Answers

Slow Ramp Time prevents new members from being overwhelmed immediately after activation.

For HTTP-based applications, cookie persistence is the most appropriate and commonly recommended persistence method.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Cookie persistence inserts or uses an HTTP cookie to maintain session affinity.

It operates at Layer 7 (HTTP) and is application-aware.

It allows persistence to be maintained even when multiple clients are behind a NAT device.

Why the other options are incorrect:

A. Destination addressDestination address persistence is generally used for inbound traffic patterns such as firewall or proxy scenarios.

B. Hash persistenceHash persistence is less granular and not HTTP-specific.

C. SSL persistenceSSL persistence is typically used when SSL session IDs are reused and is less reliable than cookies for HTTP applications.

Correct Resolution:

Using cookie persistence ensures that HTTP web requests are consistently directed to the same pool member.

URI-based traffic steering requires inspection of the HTTP request. BIG-IP processes HTTP headers and URIs in the HTTP_REQUEST event. Pool member selection based on URI must occur before the request is sent to the server, making HTTP_REQUEST the correct event.

WAN-optimized TCP profiles improve performance for high-latency Internet clients, while LAN profiles are optimal for backend servers.

A Performance (Layer 4) virtual server does not inspect or process application-layer data such as HTTP headers or cookies. Therefore, only Layer 4–compatible persistence methods can be used.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Source Address Affinity persistence operates at Layer 4 and uses the client IP address to maintain session persistence.

It is fully compatible with Performance (Layer 4) virtual servers.

It works regardless of encryption, making it suitable for TLS-secured applications.

Why the other options are incorrect:

B. Cookie persistenceRequires an HTTP profile and Layer 7 inspection, which is not supported on Performance virtual servers.

C. Microsoft RDP persistenceIs protocol-specific and not applicable to web-based TLS traffic.

D. Host persistenceRequires HTTP host header inspection, which is not available at Layer 4.

Correct Resolution:

Source Address Affinity persistence is the appropriate choice for maintaining persistence on a Performance (Layer 4) virtual server handling TLS traffic.

Below is Batch 1 (Questions 1–10) extracted only from your uploaded document that are directly related to BIG-IP Administration: Data Plane Configuration topics (Virtual Servers, Pools, Load Balancing, Monitors, Persistence, SNAT, Profiles).

I have excluded system-only, licensing, support, hardware, HA management-only, and admin UI questions that are not Data Plane–focused.

Source: Your uploaded TMOS Administration v2.0 document

✅ BATCH 1 (10 Questions)

In BIG-IP systems, iRules influence traffic only when they are attached to a Virtual Server. If application traffic is being sent to nodes or pool members that are not defined in the pool, this typically indicates that an iRule is overriding the default load-balancing behavior by explicitly selecting a pool or node.

According to BIG-IP Administration: Data Plane Configuration and official F5 guidance:

iRules are associated with Virtual Servers, not directly with pools or nodes.

To determine whether an iRule is actively affecting traffic, the administrator must inspect the Virtual Server configuration.

Explanation of the correct answers:

B. Via the GUI at the Resources tab for the virtual serverThe Resources tab in the Configuration Utility displays all traffic-handling objects applied to the Virtual Server, including assigned iRules. This is the primary GUI location to verify whether an iRule is influencing data plane traffic.

C. Via TMSH with the list /ltm virtual commandThis TMSH command displays the full Virtual Server configuration, including any iRules listed under the rules section. It is the authoritative CLI method to confirm iRule usage.

Why the other options are incorrect:

A. Via TMSH with the list /ltm rule commandThis command only shows the contents of an iRule and does not indicate whether the iRule is attached to or used by any Virtual Server.

D. Via the GUI at the iRule tab for the virtual serverBIG-IP does not provide a dedicated “iRule” tab on Virtual Servers. iRules are viewed and managed under the Resources tab.

Correct Conclusion:

To verify whether an iRule is responsible for unexpected node selection, the BIG-IP Administrator must examine the Virtual Server configuration, either through the Resources tab in the GUI or by using TMSH to list the Virtual Server configuration.

Performance (Layer 4) virtual servers rely on FastL4 profiles to provide high-speed L4 processing without full proxy overhead.

Below is BATCH 2 (next 10 questions) extracted only from your uploaded document that are clearly related to BIG-IP Administration: Data Plane Configuration topics.

❗As requested, I have strictly excluded questions related to:

Licensing

HA / Device Trust / Sync-only

Logging destinations

User roles

Hardware, EUD, support processes

System-only administration

Source: Your uploaded TMOS Administration v2.0 document

When a pool contains servers with heterogeneous hardware capabilities (differing CPU, RAM, or connection limits), a static load balancing method like Round Robin is ineffective because it distributes requests equally, regardless of the server's capacity. To optimize traffic distribution for newer, more powerful servers, a dynamic or weighted method is required.

Weighted Least Connections (member): This is the ideal method for this scenario. It combines two factors:

Least Connections: It first checks the current active connection count to ensure traffic goes to the least busy server.

Weight (Ratio): It allows the administrator to assign a "Ratio" value to each pool member. Newer servers can be assigned a higher ratio (e.g., 3) while older servers are assigned a lower ratio (e.g., 1). The BIG-IP system uses these weights to disproportionately favor the newer servers even when connection counts are similar.

Why other options are incorrect:

Global Availability: This is primarily a GSLB (Global Server Load Balancing) or specific LTM priority group concept where traffic is sent to the first available member in a list until it fails, then moves to the next. It does not load balance based on capacity.

Round Robin: This passes each new connection request to the next server in line, treating the old and new servers exactly the same.

Least Connections (member): While this sends traffic to the server with the fewest active connections, it assumes all servers are equal. If an old server and a new server both have 10 connections, they are treated as equally capable of taking the 11th, which is not true in this scenario.

To solve this requirement, we must distinguish between the two "legs" of an SSL connection in a BIG-IP environment: Client-side and Server-side.

Current State (SSL Bridging): The administrator states the servers currently require encrypted traffic. This means the BIG-IP is likely performing "SSL Bridging." In this setup, a Client SSL profile terminates encryption from the user, and a Server SSL profile re-encrypts the traffic before sending it to the back-end servers.

Target State (SSL Offloading): The requirement is to "offload SSL" to reduce web server load. This means the BIG-IP will continue to handle the encryption for the users (keeping the Client SSL profile) but will communicate with the back-end servers using unencrypted HTTP.

Why Option A is correct:

Remove the Server SSL profile: By removing this profile, the BIG-IP stops attempting to initiate an SSL/TLS handshake with the pool members.

Configure Pool Members to use HTTP: The service port for the pool members must be changed (typically from port 443 to port 80) so that the BIG-IP sends standard HTTP traffic to the servers.

Why other options are incorrect:

B & D: These suggest removing the Client SSL profile. If you remove this, the users can no longer connect via HTTPS, which violates the requirement for encrypted communication between the users and the BIG-IP.

C: Changing the Virtual Server to accept HTTP traffic would mean the user-to-BIG-IP connection is no longer encrypted, which is the opposite of SSL termination/offloading.

With manual resume enabled, BIG-IP does not automatically return a pool member to service after recovery. The member remains offline until manually re-enabled.