F5CAB5 BIG-IP Administration Support and Troubleshooting (F5CAB5) exam Questions and Answers

Comprehensive and Detailed Explanation From BIG-IP Administration Support and Troubleshooting documents: Troubleshooting configuration-related issues requires a clear trail of what was changed and by whom. The BIG-IP system includes a dedicated audit logging feature for this purpose28. Whenever a system object—such as a virtual server, pool, or iRule—is created, modified, or deleted, the system records the event in /var/log/audit29. These logs provide critical context during troubleshooting by showing if a performance drop or traffic failure coincided with a specific administrative action30. Unlike /var/log/ltm, which focuses on local traffic events like pool member status changes, or /var/log/secure, which handles authentication attempts, the audit log specifically tracks the "how" and "when" of configuration changes31. This is a vital resource for administrators to determine if a virtual server is not working as expected due to a recent manual change or an automated system action, allowing for a rapid "rollback" or correction of the configuration.

Comprehensive and Detailed Explanation From BIG-IP Administration Support and Troubleshooting documents:When troubleshooting intermittent connection resets on a "busy" Virtual Server, the administrator must examine the configured thresholds62. A "Connection Limit" is a hard cap on the number of concurrent connections a Virtual Server or pool member can handle63. If this limit is set too low, the BIG-IP will reset any new connection attempts once the threshold is reached64. The key indicator in this scenario is that the problem only affects "some users" and happens when the server is "busy," suggesting that the system is hitting a capacity ceiling rather than suffering from a persistent configuration error65. Unlike a missing SSL profile, which would likely cause all connections to fail, or a "Connection Rate Limit," which throttles how fast connections arrive, a "Connection Limit" focuses on the total volume66. Identifying this as the cause requires reviewing the Virtual Server's statistics to see if the "Current Connections" count is consistently peaking at the configured limit value.

The pool member is markedDOWNbecause it is monitored bymultiple health monitors, specifically anHTTPmonitor and anHTTP/2monitor. The status message clearly shows that theHTTP monitor is UP, while theHTTP/2 monitor is DOWN. In BIG-IP, when multiple monitors are assigned to a pool member, the default behavior isAND logic, meaningall assigned monitors must succeedfor the pool member to be considered healthy.

In this scenario, the server is responding successfully to standard HTTP (likely HTTP/1.1) requests but does not support or respond correctly to HTTP/2 requests. As a result, the HTTP/2 monitor fails, which causes the overall monitor status to beDOWN, even though HTTP traffic itself is working.

This behavior is expected and documented in BIG-IP monitoring logic. Unless the monitor rule is explicitly changed to“at least one of”, a single failing monitor will mark the pool member down. Therefore, the correct conclusion is that the pool member isonly serving HTTP traffic, not HTTP/2.

The resolution would be to either remove the HTTP/2 monitor, correct the application to support HTTP/2, or adjust the monitor rule to match the intended health-check logic.

When a pool member is markedDOWN, it indicates that the configured health monitor is failing. The most effective troubleshooting approach is to focus on the monitor behavior and the actual traffic between BIG-IP and the pool member.

Enabling monitor logging (Option B)is a recommended first step. Monitor logging provides detailed information about why the health check is failing, such as timeouts, connection refusals, incorrect responses, or unexpected status codes. This directly correlates with BIG-IP troubleshooting best practices and allows administrators to confirm whether the failure is due to application behavior, incorrect monitor configuration, or network reachability.

Collecting a TCPdump packet capture (Option D)is also a highly effective method. A packet capture allows the administrator to verify whether the monitor probes are being sent, whether responses are received, and whether packets are being dropped, reset, or malformed. This is especially valuable when diagnosing firewall issues, SSL problems, or application-level failures.

Reviewing pool statistics (Option C) is useful for general monitoring but does not explainwhya health monitor is failing. Reviewing the routing table (Option A) is typically unnecessary unless there is evidence of a broader routing issue affecting multiple destinations.

Before upgrading a BIG-IP system to a newer TMOS version, it is critical to review known issues to avoid introducing instability or regressions.F5 Bug Tracker (Option B)is a primary resource for this purpose. It allows administrators to search for documented software defects by TMOS version, module, symptom, or bug ID. Using Bug Tracker, an administrator can identify unresolvedissues, fixed bugs, and behavioral changes that may affect their specific deployment, such as traffic handling, high availability, or module-specific functionality. This directly supports proactive troubleshooting and informed upgrade planning.

F5 iHealth (Option D)is another essential tool used during upgrade preparation. iHealth analyzes uploaded UCS or QKView files and correlates the device configuration and software version with F5’s known issues database. It provides actionable reports highlighting critical defects, upgrade risks, interoperability concerns, and recommended target versions. iHealth is especially valuable because it contextualizes known issues based on the actual configuration running on the device.

The other options are not appropriate for verifying known software issues.F5 End User Diagnostics (Option A)is a client-side troubleshooting tool,F5 University (Option C)is a training platform, andF5 Downloads (Option E)is primarily used to obtain software images and release notes, not to analyze known defects in depth.

To successfully performSSL offload and re-encryptionon a BIG-IP system, the virtual server must be configured withboth a Client SSL profile and a Server SSL profile. The Client SSL profile enables BIG-IP to decrypt inbound HTTPS traffic from clients, while the Server SSL profile is required tore-encrypt traffic before forwarding it to the pool members.

From the exhibit, the virtual server has aClient SSL profile configured, which allows BIG-IP to accept HTTPS connections from clients. However, there isno Server SSL profile attached, meaning BIG-IP attempts to sendunencrypted HTTP trafficto pool members listening on HTTPS (port 443). This protocol mismatch causes the server-side SSL handshake to fail, resulting in users being unable to connect to the application.

This behavior is well documented in BIG-IP SSL troubleshooting guides: when backend servers expect HTTPS, a Server SSL profile is mandatory to establish a secure connection from BIG-IP to the pool members.

The other options are incorrect:

Removing the Client SSL profile (Option A) would break client-side HTTPS.

The server-side TCP profile (Option B) is unrelated to SSL encryption.

Forward Proxy (Option C) is only used for outbound SSL inspection scenarios.

Therefore, configuring anSSL Profile (Server)is the correct and required solution.

When troubleshooting a pool that is not working correctly after adding new members, the "Slow Ramp Time" setting is a primary suspect. In a pool that is already under high load and using a "Least Connections" load balancing method, a newly added server has zero connections. Without a slow ramp time, the BIG-IP will immediately direct a massive flood of new connections to the new server to "balance" it with the others. This "thundering herd" effect can crash a newly initialized application server before it has time to warm up its caches or establish its own database connections. By setting a "Slow Ramp Time" (typically in seconds), the administrator ensures the BIG-IP gradually increases the connection ratio to the new member. This allows the server to stabilize and scale up its performance over time. If users report intermittent failures specifically coinciding with the expansion of a pool, checking this setting is a vital troubleshooting step to maintain pool health during maintenance.

A gateway_icmp monitor checks basic network reachability by sending ICMP echo requests (pings) to the pool member or its gateway. If the pool is markedDOWNwhile the server is confirmed to be online, the most likely cause is thatICMP traffic is being blocked.

Ahost-based firewall active on the server (Option C)can block ICMP echo requests or replies, preventing BIG-IP from receiving a successful response to the health check. This results in the monitor failing and the pool member being marked down, even though the server and application are otherwise functioning normally. This explanation is consistent with the scenario where other servers in the same subnet work correctly, indicating that routing and BIG-IP configuration are not the issue.

The other options are unrelated to ICMP monitoring. Logged-in users (Option A), missing patches (Option B), and stopped HTTP services (Option D) do not affect a gateway_icmp monitor. BIG-IP troubleshooting best practices recommend verifying ICMP reachability and firewall policies when diagnosing ICMP-based monitor failures.

AQKViewis the primary diagnostic file used by F5 Support to analyze BIG-IP system health, configuration, performance, and logs. It collects a wide range of data, including running configuration, license details, module provisioning, hardware status, logs, statistics, and diagnostic command output. Generating a QKView is a standard first step when troubleshooting issues or opening a support case with F5.

In the BIG-IP Configuration Utility (GUI), the correct location to generate a QKView isSystem > Support (Option C). This menu is specifically designed for support and troubleshooting activities. From this section, administrators can create QKView files, upload them directly to F5 iHealth, or download them locally for later analysis or submission to F5 Support.

The other options are incorrect:

System > Configuration (Option A)is used for system-wide settings such as device name, NTP, and DNS.

System > Archive (Option B)is used to create UCS backups, not diagnostic QKViews.

System > Logs (Option D)is used to view and manage log files, not to generate support bundles.

This workflow is clearly documented in BIG-IP Administration and Support guides and is considered a best practice for efficient troubleshooting and support engagement.