F5 F5CAB3 - BIG-IP Administration Data Plane Configuration (F5CAB3) exam

When many users share one source IP, source-address persistence fails. Cookie persistence uniquely identifies clients at Layer 7.

WAN-optimized TCP profiles improve performance for high-latency Internet clients, while LAN profiles are optimal for backend servers.

Slow Ramp Time prevents new members from being overwhelmed immediately after activation.

This scenario describes a classic routing issue often encountered during SSL offload deployments. The fact that an SSL connection is established indicates the Client SSL profile is working correctly. The packet trace showing the server " receives and responds " to the request is the most critical diagnostic clue.

When a BIG-IP receives traffic, it typically passes the client ' s original source IP address to the backend server. If the backend server ' s default gateway is not the BIG-IP (a common " one-arm " network topology), the server will attempt to send its response directly back to the client ' s IP via its own default router. The client ' s browser will reject this response because it expects traffic to come from the Virtual Server ' s IP, not the backend server ' s IP.

To resolve this, the administrator must enable SNAT (Source Address Translation), typically using SNAT Automap. When SNAT is enabled, the BIG-IP replaces the client ' s original source IP with one of its own Self IPs before forwarding the request to the server. Because the source of the packet is now the BIG-IP, the backend server is forced to send its response back to the BIG-IP. The BIG-IP then receives the response, translates it back, and delivers the content to the user. Option A is unnecessary if the servers are expecting plain-text traffic after the BIG-IP performs offload. Option D would only worsen the existing routing discrepancy.

This question addresses the critical architectural distinction between " member-based " and " node-based " load balancing in environments where servers are multi-homed or host multiple virtualized services. On a BIG-IP, a node represents the underlying IP address of a physical or virtual server, while a pool member represents a specific combination of that IP and a service port (e.g., 10.1.1.10:80).

When multiple pools reference the same IP address across different ports or Virtual Servers, using Least Connections (member) (Option D) only balances connections relative to that specific pool. For example, if Pool_A and Pool_B both use Server_X, and Pool_A has 100 connections while Pool_B has only 5, a member-based algorithm for Pool_B only sees the 5 connections and may continue to send traffic there even if Server_X is CPU-saturated by Pool_A.

The Least Connections (node) algorithm (Option B) solves this by tracking the aggregate total of all active connections directed to that specific node (IP address) across every pool on the system. By selecting the node with the absolute lowest total connection count, the BIG-IP ensures a more equitable distribution of work at the hardware resource level. Predictive methods (Options A and C) use a ranking system based on the trend of connection counts over time, but for the specific requirement of maintaining an equal number of current connections on multi-service servers, the direct Least Connections (node) calculation is the standard and most effective procedural choice.

A Performance (Layer 4) virtual server does not inspect or process application-layer data such as HTTP headers or cookies. Therefore, only Layer 4–compatible persistence methods can be used.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Source Address Affinity persistence operates at Layer 4 and uses the client IP address to maintain session persistence.

It is fully compatible with Performance (Layer 4) virtual servers.

It works regardless of encryption, making it suitable for TLS-secured applications.

Why the other options are incorrect:

B. Cookie persistenceRequires an HTTP profile and Layer 7 inspection, which is not supported on Performance virtual servers.

C. Microsoft RDP persistenceIs protocol-specific and not applicable to web-based TLS traffic.

D. Host persistenceRequires HTTP host header inspection, which is not available at Layer 4.

Correct Resolution:

Source Address Affinity persistence is the appropriate choice for maintaining persistence on a Performance (Layer 4) virtual server handling TLS traffic.

Below is Batch 1 (Questions 1–10) extracted only from your uploaded document that are directly related to BIG-IP Administration: Data Plane Configuration topics (Virtual Servers, Pools, Load Balancing, Monitors, Persistence, SNAT, Profiles).

I have excluded system-only, licensing, support, hardware, HA management-only, and admin UI questions that are not Data Plane–focused.

Source: Your uploaded TMOS Administration v2.0 document

✅ BATCH 1 (10 Questions)

Using “at least one” ensures each member is marked up based on its relevant service monitor.

The two load balancing methods that consider all connections between the BIG-IP and each backend node — not just connections to a specific pool member — are Least Connections (node) and Weighted Least Connections (node) .

The critical distinction here lies in the node-level scope of evaluation. A node represents the backend server ' s IP address, regardless of how many services or ports it may be serving. Therefore:

Least Connections (node) directs new connections to the node with the fewest total active connections across all services on that server, providing a holistic connection-count perspective.

Weighted Least Connections (node) operates identically but factors in an administrator-defined ratio weight, allowing servers with greater capacity to proportionally absorb more connections while still evaluating total node-level connection counts.

By contrast:

Ratio (member) distributes traffic based on a static weight ratio and does not dynamically evaluate current connection counts.

Round Robin distributes traffic sequentially in rotation, completely ignoring current connection states on any node or member.

The node-based methods are particularly valuable in environments where a single backend server hosts multiple pool members across different ports, ensuring the server ' s overall load — not just per-service load — governs balancing decisions.

In the F5 BIG-IP ecosystem, a standard ICMP health monitor functions by sending an ICMP echo request to a target node and expecting an ICMP echo reply within a specified timeout period. When a node is marked " DOWN " despite the backend server being configured to respond to ICMP, the issue typically lies in the network path or the specific packet exchange between the BIG-IP ' s self IP and the node ' s IP. Running a tcpdump is the most effective next step because it provides a real-time packet capture of the actual monitor traffic leaving the BIG-IP and any return traffic coming back from the server. This allows the administrator to verify if the BIG-IP is actually sending the echo request, if the request is reaching the server, and if the server is indeed replying or if the reply is being dropped by an intermediate firewall or a security policy.

While other tools have their place, they are inappropriate for this specific layer 3/4 connectivity issue. A qkview is a comprehensive diagnostic file used primarily for F5 Support to analyze the entire system ' s state but is overkill for initial connectivity troubleshooting. An ssldump is used for inspecting SSL/TLS handshakes and encrypted payloads, which is irrelevant for a non-encrypted ICMP monitor. A curl command is a tool for testing HTTP/HTTPS application-level responses; it cannot be used to troubleshoot ICMP (ping) connectivity directly. By using tcpdump -ni < vlan_name > host < node_ip > , the administrator can see the ICMP " type 8 " (request) and " type 0 " (reply) packets, immediately identifying if the monitor failure is due to a " Destination Unreachable " message or a simple lack of response, thereby pinpointing the root cause in the data plane.