F5 F5CAB3 - BIG-IP Administration Data Plane Configuration (F5CAB3) exam

Connection rate limits restrict how many new connections are accepted per second, protecting application resources.

SSH is a TCP-based service. A TCP monitor validates service availability without requiring application-layer inspection.

Whenmultiple hostnames resolve to the same IP addressand encrypted communication is required, the BIG-IP must be able to present thecorrect SSL certificate based on the hostname requested by the client. This is accomplished usingServer Name Indication (SNI).

According toBIG-IP Administration: Data Plane Configurationdocumentation:

SNI is a client-side TLS extension, where the client includes the requested hostname during the SSL handshake.

BIG-IP evaluates this hostname using theClient SSL profile, not the Server SSL profile.

The“Server Name” setting in the Client SSL profileenables BIG-IP to select the appropriate SSL certificate for the requested hostname.

Why optionCis correct:

Client SSL profilehandles inbound (client-side) encryption.

Server Nameenables SNI-based certificate selection when multiple DNS names share the same virtual server IP.

Why the other options are incorrect:

A. Client SSL, Client NameThere is no Client SSL setting calledClient Namefor SNI certificate selection.

B. Server SSL, Server NameServer SSL is used for encryption between BIG-IP and backend servers, not for client-side hostname identification.

D. Server SSL, Client NameServer SSL does not process client-requested hostnames during TLS negotiation.

Correct Resolution:

Configure aClient SSL profileand enable theServer Name (SNI)setting to support multiple encrypted hostnames on the same virtual server IP.

From the exhibit, the pool containsdifferent applications on different service ports(for example, HTTP/80, FTP/21, HTTPS/443, SSH/22). To mark pool members correctly, BIG-IP must be able to verify theactual servicerunning on each member’s port.

InBIG-IP Administration: Data Plane Configuration, monitor behavior is described as follows:

Whenmultiple monitorsare assigned to a pool, theAvailability Requirementcontrols how monitor results are evaluated:

At least one= the pool member is markedupifany oneof the assigned monitors succeeds.

All= the pool member is markeduponly ifeveryassigned monitor succeeds.

For pools containing members with different services/ports, usingAllcan incorrectly mark members down because monitors intended for other services will fail on the wrong port.

WhyCis correct:

AssigningHTTPS, HTTP, FTP, and SSHcovers the actual services shown in the pool.

Setting the Availability Requirement toat least oneensures that each pool member is consideredavailablewhen itsappropriateservice monitor succeeds, without being forced to pass unrelated service monitors.

Why the other options are incorrect:

A / D (Availability Requirement = all):would cause members to be markeddownwhen unrelated monitors fail (e.g., SSH monitor against an HTTP member).

B (includes ICMP):ICMP can indicate the host is reachable even if theapplication service is down, which does not “accurately” reflect service availability.

Therefore, the best choice isHTTPS, HTTP, FTP, and SSHwith Availability Requirement ofat least onehealth monitor.

WAN-optimized TCP profiles improve performance for high-latency Internet clients, while LAN profiles are optimal for backend servers.

In this scenario, each backendnode (server)hosts multiple services and is referenced by multiple pools and virtual servers. The goal is to ensure anequal number of total connections per backend server, regardless of how many pool members (services/ports) exist on that server.

According to theBIG-IP Administration: Data Plane Configurationdocumentation:

Least Connections (node)tracks the total number of active connections to anode across all pool members and services.

This algorithm ensures load distribution is balanced at theserver level, not just at the individual service (member) level.

It is specifically recommended when:

Multiple pool members exist on the same backend server

Multiple virtual servers reference the same backend servers

Why the other options are incorrect:

B. Predictive (member)Predictive algorithms are advanced and traffic-pattern based, but they operate at the member level and do not guarantee equal connections per server.

C. Least Connections (member)This balances connections per pool member, which can overload a server hosting multiple members while still appearing “balanced” per member.

D. Predictive (node)Although node-aware, predictive algorithms are less deterministic and not the best choice when strict equality of connections is required.

Correct Resolution:

UsingLeast Connections (node)ensures that each backend server carries an equal connection load across all services and pools.

X-Forwarded-For inserts the original client IP into HTTP headers, preserving client identity while SNAT is enabled.

Standard DNS queries use UDP. Configuring the Virtual Server for TCP causes DNS traffic to fail.

In BIG-IP systems,iRules influence traffic only when they are attached to a Virtual Server. If application traffic is being sent tonodes or pool members that are not defined in the pool, this typically indicates that an iRule is overriding the default load-balancing behavior by explicitly selecting a pool or node.

According toBIG-IP Administration: Data Plane Configurationand official F5 guidance:

iRules areassociated with Virtual Servers, not directly with pools or nodes.

To determine whether an iRule is actively affecting traffic, the administrator must inspect theVirtual Server configuration.

Explanation of the correct answers:

B. Via the GUI at the Resources tab for the virtual serverTheResourcestab in the Configuration Utility displays all traffic-handling objects applied to the Virtual Server, includingassigned iRules. This is the primary GUI location to verify whether an iRule is influencing data plane traffic.

C. Via TMSH with the list /ltm virtual <virtual_server> commandThis TMSH command displays the full Virtual Server configuration, including anyiRules listed under the rules section. It is the authoritative CLI method to confirm iRule usage.

Why the other options are incorrect:

A. Via TMSH with the list /ltm rule <irule> commandThis command only shows the contents of an iRule and does not indicate whether the iRule is attached to or used by any Virtual Server.

D. Via the GUI at the iRule tab for the virtual serverBIG-IP does not provide a dedicated “iRule” tab on Virtual Servers. iRules are viewed and managed under theResourcestab.

Correct Conclusion:

To verify whether an iRule is responsible for unexpected node selection, the BIG-IP Administrator must examine theVirtual Server configuration, either through theResources tab in the GUIor by usingTMSH to list the Virtual Server configuration.