Free Practice Questions for the F5-CA F5CAB3 Exam (2026 Updated)

The BIG-IP Configuration Utility (GUI) organizes information hierarchically to allow for granular management of application objects. A Pool is a collection of backend servers (pool members) that provide the same service. To verify the specific network parameters—such as the IP address and the service port—of the servers within a pool, the administrator must navigate to the specific pool ' s configuration.

The standard procedural path to verify this is Local Traffic > Pools: Pool List, where the administrator selects the specific pool name. Once inside the pool ' s configuration, the Members tab displays a list of all IP addresses and service ports associated with that pool. Under the " Service Port " column, the administrator can confirm if the member is listening on port 80 (HTTP).

Options A and B are incorrect for this specific verification task. While Nodes (Option A) show the health of a physical server, a node represents only an IP address and does not have a " Service Port " associated with it until it is defined as a pool member. Verifying the Health Monitor (Option B) would tell the administrator how the system is checking the member ' s status, but it does not definitively show the port on which the member is actually receiving application traffic. In a BIG-IP environment, a pool member is uniquely identified by the combination of its Node IP and its Service Port, and the Members tab is the primary interface for managing and auditing these specific member attributes.

WAN-optimized TCP profiles improve performance for high-latency Internet clients, while LAN profiles are optimal for backend servers.

In the F5 BIG-IP ecosystem, a standard ICMP health monitor functions by sending an ICMP echo request to a target node and expecting an ICMP echo reply within a specified timeout period. When a node is marked " DOWN " despite the backend server being configured to respond to ICMP, the issue typically lies in the network path or the specific packet exchange between the BIG-IP ' s self IP and the node ' s IP. Running a tcpdump is the most effective next step because it provides a real-time packet capture of the actual monitor traffic leaving the BIG-IP and any return traffic coming back from the server. This allows the administrator to verify if the BIG-IP is actually sending the echo request, if the request is reaching the server, and if the server is indeed replying or if the reply is being dropped by an intermediate firewall or a security policy.

While other tools have their place, they are inappropriate for this specific layer 3/4 connectivity issue. A qkview is a comprehensive diagnostic file used primarily for F5 Support to analyze the entire system ' s state but is overkill for initial connectivity troubleshooting. An ssldump is used for inspecting SSL/TLS handshakes and encrypted payloads, which is irrelevant for a non-encrypted ICMP monitor. A curl command is a tool for testing HTTP/HTTPS application-level responses; it cannot be used to troubleshoot ICMP (ping) connectivity directly. By using tcpdump -ni < vlan_name > host < node_ip > , the administrator can see the ICMP " type 8 " (request) and " type 0 " (reply) packets, immediately identifying if the monitor failure is due to a " Destination Unreachable " message or a simple lack of response, thereby pinpointing the root cause in the data plane.

A 400 Bad Request response from an HTTP/1.1 web server is a definitive indicator that the HTTP request sent by the health monitor is missing a required Host header . In HTTP/1.1, the Host header is mandatory per RFC 7230. Web servers — particularly those hosting named virtual hosts such as www.f5.com — will reject any HTTP/1.1 request that omits the Host header, returning a 400 error, which the BIG-IP monitor interprets as a failed health check, marking all members DOWN.

The correct Send string must include:

The GET request line with HTTP/1.1 protocol declaration

A \r\n (carriage return + line feed) after the request line

The Host: www.f5.com header to satisfy HTTP/1.1 requirements

A \r\n after the Host header

Connection: Close header to instruct the server to close the connection after responding

A final \r\n\r\n to properly terminate the HTTP request headers

Only option C satisfies all these requirements with the correct syntax and Host header inclusion.

Option D (the current configured string) omits the Host header entirely — the root cause of the 400 error. Options A and B are structurally incomplete or syntactically malformed.

When dealing with heterogeneous server hardware where some servers are more powerful than others, a dynamic load balancing method that accounts for both current load and server capacity is required. The Weighted Least Connections (member) method is the most appropriate choice. This method works by tracking the number of active connections to each pool member and then " weighting " that number based on a user-defined Ratio value assigned to the member. For example, the administrator can assign a higher Ratio to the three newer, more powerful servers and a lower Ratio to the two older servers. The BIG-IP then uses a formula to calculate which server should receive the next connection, ensuring that the newer servers handle a proportionately larger share of the total concurrent connections.

Standard Round Robin (Option C) would be ineffective because it distributes connections strictly sequentially (1, 2, 3, 4, 5) without regard for the servers ' capacity or current load, which would eventually overwhelm the older servers. Least Connections (member) (Option D) is better than Round Robin because it picks the server with the fewest active connections, but it still assumes all servers are equal; it would try to keep the connection counts identical across all 5 servers, which would still stress the older hardware more than the new. Global Availability (Option B) is a GSLB (DNS-based) method used for multi-site redundancy, not for local pool member load balancing. By using Weighted Least Connections, the administrator achieves a balance where the more capable servers take the brunt of the work while the older servers are utilized only to their specific safe capacity.

SNAT Automap is a common configuration that replaces the client ' s original source IP address with one of the BIG-IP ' s self IP addresses. This ensures that the backend servers send return traffic back through the BIG-IP, which is necessary for the ADC to process the traffic correctly. However, a side effect of SNAT is that the backend servers only see the BIG-IP ' s IP in their logs, losing visibility into the true identity of the client.

To resolve this while still using SNAT for routing purposes, the administrator must configure the BIG-IP to " pass " the client ' s IP address at the application layer. This is achieved by using an HTTP Profile with the Insert X-Forwarded-For setting enabled. When this profile is applied to the Virtual Server, the BIG-IP intercepts the HTTP request, adds a header (X-Forwarded-For) containing the client ' s original IP, and then forwards the modified request to the server. The backend web server can then be configured to read this header and log the original client IP instead of the BIG-IP ' s SNAT address.

Other options are incorrect for this requirement. Performance (HTTP) (Option A) is a virtual server type optimized for speed but often lacks the full Layer 7 header manipulation capabilities of a Standard Virtual Server. SNAT Pool with the client IP (Option C) is technically impossible as SNAT pools use static, pre-defined IPs. There is no such thing as an HTTP Transparent profile (Option D) in standard BIG-IP administration for this purpose. The X-Forwarded-For header insertion within the HTTP profile is the standard procedural method for maintaining client visibility in SNAT-enabled environments.

The log message " aggressive mode activated " indicates that the BIG-IP ' s adaptive connection management system (the " Sweeper " ) has detected that the system ' s memory or connection limits are reaching a critical threshold. To protect the system from crashing due to memory exhaustion (OOM), the BIG-IP enters Aggressive Mode, where it begins to proactively and rapidly reap (close) idle connections to free up resources for new incoming traffic.

To mitigate this and return the system to a healthy state, the administrator needs to reduce the overall resource footprint of existing connections. Decreasing the TCP profile Idle Timeout value (Option B) is the most effective administrative action. In many environments, the default idle timeout is 300 seconds (5 minutes). If a large number of connections remain " open " in the BIG-IP connection table long after the clients have stopped sending data, they consume valuable TMM (Traffic Management Microkernel) memory. By lowering the timeout (e.g., to 60 or 120 seconds), the BIG-IP can expire and remove these inactive entries much sooner, preventing the connection table from bloating and triggering the Sweeper ' s aggressive mode.

Conversely, increasing the timeout (Option C) would exacerbate the problem by keeping " dead " connections in memory even longer. Connection Mirroring (Option D) actually increases memory usage because every connection must be duplicated on the standby peer. An active-active configuration (Option A) might spread the load but does not address the underlying resource management issue on the individual units. Therefore, tightening the idle timers is the standard procedural fix for memory pressure caused by high connection volumes.

This scenario describes a classic routing issue often encountered during SSL offload deployments. The fact that an SSL connection is established indicates the Client SSL profile is working correctly. The packet trace showing the server " receives and responds " to the request is the most critical diagnostic clue.

When a BIG-IP receives traffic, it typically passes the client ' s original source IP address to the backend server. If the backend server ' s default gateway is not the BIG-IP (a common " one-arm " network topology), the server will attempt to send its response directly back to the client ' s IP via its own default router. The client ' s browser will reject this response because it expects traffic to come from the Virtual Server ' s IP, not the backend server ' s IP.

To resolve this, the administrator must enable SNAT (Source Address Translation), typically using SNAT Automap. When SNAT is enabled, the BIG-IP replaces the client ' s original source IP with one of its own Self IPs before forwarding the request to the server. Because the source of the packet is now the BIG-IP, the backend server is forced to send its response back to the BIG-IP. The BIG-IP then receives the response, translates it back, and delivers the content to the user. Option A is unnecessary if the servers are expecting plain-text traffic after the BIG-IP performs offload. Option D would only worsen the existing routing discrepancy.

This scenario describes a classic case of asymmetric routing in a " one-arm " or non-gateway deployment. When a BIG-IP system is configured for SSL offloading, the following traffic flow occurs:

Client-Side: The client establishes a successful SSL/TLS handshake with the Virtual Server. This explains why the user can " successfully establish an SSL connection. "

Server-Side: The BIG-IP decrypts the traffic and forwards it as plain HTTP to the backend server. The packet trace confirms the server receives the HTTP GET request and responds with the content.

The Routing Failure: By default, the BIG-IP system preserves the client ' s original source IP address. If the backend server ' s default gateway is not the BIG-IP system (or if the server is on the same subnet as the client), the server will attempt to send the response directly back to the client ' s IP address, bypassing the BIG-IP.

Stateful Drop: Because the BIG-IP is a Full Proxy, it expects the response to return through its own internal state table to be encrypted and sent back to the client. Since the response bypasses the BIG-IP, the BIG-IP connection eventually times out, and the client receives no data despite the server having sent it.

Solution (SNAT): Enabling Secure Network Address Translation (SNAT), specifically SNAT Auto Map, ensures that the BIG-IP replaces the client ' s source IP with its own internal self-IP before sending the request to the server. This forces the server to send the response back to the BIG-IP, allowing the BIG-IP to complete the transaction and deliver the content to the user.

The pool member list in the exhibit shows servers listening on four distinct service ports: 80 (HTTP), 21 (FTP), 443 (HTTPS), and 22 (SSH). To accurately monitor a pool where members provide different services, the administrator must apply monitors that correspond to each of those specific services.

The key to this configuration is the Availability Requirement (also known as " Monitor Rule " ). If the administrator sets the requirement to " All health monitors, " every single monitor (HTTP, HTTPS, FTP, and SSH) must pass for a member to be marked " Up. " This would cause an immediate failure: for example, a server listening only on port 80 would fail the HTTPS, FTP, and SSH checks, resulting in the member being marked " Down " even if the HTTP service is healthy.

To ensure accuracy, the administrator should apply all four relevant monitors and set the Availability Requirement to at least one monitor. With this setting, the BIG-IP marks a member as " Up " if any of the assigned monitors return a successful response. Therefore, the member at 10.200.50.210:80 will stay " Up " as long as the HTTP monitor passes, even though it fails the FTP, HTTPS, and SSH monitors. This configuration allows a single pool to contain diverse service types while ensuring that the specific port defined for each member is verified correctly. Option C is incorrect because ICMP only checks if the IP is alive, not if the specific service port is functioning.

Source Address Affinity (Persistence) works by tracking the source IP address of incoming packets to ensure a client stays connected to the same backend server. The " netmask " setting within the persistence profile determines the " granularity " of this tracking. A netmask tells the BIG-IP how many bits of the source IP address to ignore when creating the persistence record. For example, the current setting of 255.0.0.0 (a /8 mask) means the BIG-IP only looks at the first octet of the IP; this results in all users from the same large Class A network (e.g., everyone from 10.0.0.0 to 10.255.255.255) being persisted to the exact same server, which can lead to severe load imbalance.

To ensure that each unique IP address creates its own individual persistence record, the administrator must set the netmask to 255.255.255.255 (for IPv4). This is a " host mask " or /32, which instructs the BIG-IP to evaluate all 32 bits of the client ' s source IP address. With this setting, 10.1.1.1 and 10.1.1.2 will be treated as distinct entities and can be load balanced to different servers, each maintaining their own " stickiness " . While Option A (255.255.255.0) would group users by their local subnet, only the full 255.255.255.255 mask satisfies the requirement for true unique-IP persistence. This configuration is standard for internet-facing applications where users arrive from diverse locations and the administrator wants to maintain the most granular and balanced distribution of traffic possible.

Performance (Layer 4) virtual servers rely on FastL4 profiles to provide high-speed L4 processing without full proxy overhead.

Below is BATCH 2 (next 10 questions) extracted only from your uploaded document that are clearly related to BIG-IP Administration: Data Plane Configuration topics.

❗As requested, I have strictly excluded questions related to:

Licensing

HA / Device Trust / Sync-only

Logging destinations

User roles

Hardware, EUD, support processes

System-only administration

Source: Your uploaded TMOS Administration v2.0 document

WAN TCP profiles are optimized for high latency and packet loss typical of Internet clients, while LAN profiles are ideal for backend servers.

In BIG-IP configuration, health monitors can be applied at three distinct levels: the node, the pool, or the individual pool member. To ensure that a specific application service—in this case, a database service on port 1521—is functioning correctly for the entire pool, the administrator should apply the monitor at the pool level. Navigating to Local Traffic > Pools > DB.Pool > Properties allows the administrator to select one or more monitors from the " Available " list and move them to the " Active " list.

Applying a monitor at the pool property level ensures that the BIG-IP checks the health of every member assigned to that pool using the same logic. If a database-specific monitor (such as a TCP handshake or an Oracle/SQL check) fails for a specific member, the BIG-IP marks that member as " offline " for that specific pool, preventing new connections from being sent to it. While monitors can be applied to Pool Members (Option D) to give different members unique monitoring logic, it is more administratively efficient to apply it to the pool properties when all servers are expected to behave identically. Applying it to Nodes (Option C) would only verify that the IP address is up (typically via ICMP), which does not guarantee that the database service on port 1521 is actually responding. Finally, Profiles (Option A) are used to define how traffic is handled once it is accepted by a Virtual Server, not for the proactive health checking of backend resources. Therefore, the pool properties page is the standard location for configuring service-specific availability requirements.

A Performance (Layer 4) virtual server does not inspect or process application-layer data such as HTTP headers or cookies. Therefore, only Layer 4–compatible persistence methods can be used.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Source Address Affinity persistence operates at Layer 4 and uses the client IP address to maintain session persistence.

It is fully compatible with Performance (Layer 4) virtual servers.

It works regardless of encryption, making it suitable for TLS-secured applications.

Why the other options are incorrect:

B. Cookie persistenceRequires an HTTP profile and Layer 7 inspection, which is not supported on Performance virtual servers.

C. Microsoft RDP persistenceIs protocol-specific and not applicable to web-based TLS traffic.

D. Host persistenceRequires HTTP host header inspection, which is not available at Layer 4.

Correct Resolution:

Source Address Affinity persistence is the appropriate choice for maintaining persistence on a Performance (Layer 4) virtual server handling TLS traffic.

Below is Batch 1 (Questions 1–10) extracted only from your uploaded document that are directly related to BIG-IP Administration: Data Plane Configuration topics (Virtual Servers, Pools, Load Balancing, Monitors, Persistence, SNAT, Profiles).

I have excluded system-only, licensing, support, hardware, HA management-only, and admin UI questions that are not Data Plane–focused.

Source: Your uploaded TMOS Administration v2.0 document

✅ BATCH 1 (10 Questions)

Application-specific health checks must validate application responses, which requires HTTP monitors with custom send/receive strings.

In the BIG-IP object hierarchy, a Pool Member is a child object of a Node . A pool member represents a specific IP:Port combination, while the parent node represents the underlying server IP address. When a node is disabled , all pool members that are children of that node are rendered unavailable — regardless of the individual pool member ' s own health or enabled state.

The Network Map depicted shows the pool member (192.168.212.30:80) with its Parent Node (192.168.212.30) disabled. This parent-child dependency means that even if the pool member itself is healthy and enabled, the disabled node cascades its unavailable state downward, causing the pool to have no available members and rendering VS_HTTP unresponsive to incoming connections.

The other options can be eliminated as follows:

Pool member monitor failed — the monitor status is not indicated as failed in the Network Map display.

Pool member is disabled — the pool member itself is not shown as disabled; the parent node is.

Node monitor failed — no monitor failure is indicated; the node ' s administrative state is explicitly disabled.

Understanding the node-to-member inheritance of availability state is fundamental to accurate BIG-IP traffic troubleshooting.

Using “at least one” ensures each member is marked up based on its relevant service monitor.

Slow Ramp Time prevents new members from being overwhelmed immediately after activation.

Persistence overrides load balancing decisions by maintaining client-to-server affinity.

SSH is a TCP Layer 4 protocol. Applying an HTTP profile causes BIG-IP to expect HTTP headers, breaking SSH sessions. Removing the HTTP profile allows raw TCP forwarding.

HTTP Compression on a BIG-IP system is an optimization feature that reduces the size of HTTP responses sent to clients, thereby saving bandwidth and improving page load times for end-users. To implement this functionality on a Virtual Server, the system requires two specific profiles to work in tandem: an HTTP profile and a Compression profile.

The HTTP profile (Option E) is a prerequisite because compression is an application-layer (Layer 7) operation. The BIG-IP must be " HTTP-aware " to parse the incoming requests and outgoing responses. The HTTP profile allows the BIG-IP to inspect the Accept-Encoding header from the client (to see if the client supports gzip or deflate) and to modify the Content-Encoding and Vary headers in the server ' s response. Without the HTTP profile, the Virtual Server operates at Layer 4 (TCP) and sees the traffic only as an opaque stream of bytes, making compression impossible.

The Compression profile (Option B) contains the actual settings and engine for the task. It defines which content types should be compressed (e.g., text/html, application/javascript), the compression level, and the minimum content length required before compression is applied. While a Stream profile (Option D) is used for data replacement (search and replace) and SSL profiles (Option C) are used for encryption, they do not provide compression logic. By applying both the HTTP and Compression profiles, the BIG-IP can successfully intercept server responses, compress the payload according to the configured policy, and deliver the optimized data to the user, effectively offloading the CPU-intensive compression work from the backend web servers.