The F5 F5CAB3 Questions & Practice Test are Available On-Demand [Q34-Q48]

The F5 F5CAB3 Questions & Practice Test are Available On-Demand [Q34-Q48]

November 13, 2026 latestexam 0 Comments

Rate this post

The F5 F5CAB3 Questions & Practice Test are Available On-Demand

Valid F5CAB3 Exam Dumps Ensure you a HIGH SCORE

F5 F5CAB3 Exam Syllabus Topics:

Section	Weight	Objectives
Virtual Servers and Pools	25-30%	– Priority group activation – Virtual server configuration options – Address translation and port translation – Pool configuration and members – Virtual server types (Standard, Forwarding, Performance L4, Regex) – Node and pool management – Load balancing algorithms
Traffic Management Features	15-20%	– NAT and SNAT concepts – Connection limits and rate shaping – iRules basics and events – Compression and caching profiles – OneConnect – HTTP profile settings
SSL/TLS Configuration	15-20%	– Certificate and key management – SSL termination and re-encryption – SSL profiles (Client and Server) – Cipher groups and compatibility – Certificate validation settings
LTM Fundamentals	15-20%	– Traffic Management Shell (tmsh) CLI – Licensing types – Objects and their relationships – License and provisioning modules – Configuration architecture and files
Health Monitors and Persistence	20-25%	– Fallback host and persistence TTL – Persistence profiles (Cookie, Source Address, Universal) – Monitor types and configurations – OneConnect and connection multiplexing – Monitor assignment and interval settings

QUESTION 34
In a pool there are 2 pool members out of the 5 members that are older servers. The number of connections these can handle is less than the other 3 pool members. Which load balancing method would allow more traffic to be directed to the newer servers?

Weighted Least Connections (member)

Global Availability

Round Robin

Least Connections (member)

When dealing with heterogeneous server hardware where some servers are more powerful than others, a dynamic load balancing method that accounts for both current load and server capacity is required. The Weighted Least Connections (member) method is the most appropriate choice. This method works by tracking the number of active connections to each pool member and then “weighting” that number based on a user-defined Ratio value assigned to the member. For example, the administrator can assign a higher Ratio to the three newer, more powerful servers and a lower Ratio to the two older servers. The BIG-IP then uses a formula to calculate which server should receive the next connection, ensuring that the newer servers handle a proportionately larger share of the total concurrent connections.
Standard Round Robin (Option C) would be ineffective because it distributes connections strictly sequentially (1, 2, 3, 4, 5) without regard for the servers’ capacity or current load, which would eventually overwhelm the older servers. Least Connections (member) (Option D) is better than Round Robin because it picks the server with the fewest active connections, but it still assumes all servers are equal; it would try to keep the connection counts identical across all 5 servers, which would still stress the older hardware more than the new. Global Availability (Option B) is a GSLB (DNS-based) method used for multi-site redundancy, not for local pool member load balancing. By using Weighted Least Connections, the administrator achieves a balance where the more capable servers take the brunt of the work while the older servers are utilized only to their specific safe capacity.

QUESTION 35
Which persistence profile would be the most appropriate to ensure an HTTP web request connects to the same pool member? (Choose one answer)

Destination address

Hash persistence

SSL persistence

Cookie persistence

For HTTP-based applications, cookie persistence is the most appropriate and commonly recommended persistence method.
According to the BIG-IP Administration: Data Plane Configuration documentation:
* Cookie persistence inserts or uses an HTTP cookie to maintain session affinity.
* It operates at Layer 7 (HTTP) and is application-aware.
* It allows persistence to be maintained even when multiple clients are behind a NAT device.
Why the other options are incorrect:
* A. Destination addressDestination address persistence is generally used for inbound traffic patterns such as firewall or proxy scenarios.
* B. Hash persistenceHash persistence is less granular and not HTTP-specific.
* C. SSL persistenceSSL persistence is typically used when SSL session IDs are reused and is less reliable than cookies for HTTP applications.
Correct Resolution:
Using cookie persistence ensures that HTTP web requests are consistently directed to the same pool member.

QUESTION 36
During high-demand traffic events, the BIG-IP Administrator needs to limit new connections per second.
What should be applied?

HTTP Compression profile

Connection rate limit

Connection limit

OneConnect profile

Connection rate limiting controls how many new connections per second are accepted, protecting backend resources.

QUESTION 37
Refer to the exhibit.

A BIG-IP Administrator needs to configure health monitors for a newly configured server pool named Pool_B.
Which health monitor settings will ensure that all pool members will be accurately marked as available or unavailable? (Choose one answer)

HTTPS, HTTP, FTP, and SSH with the Availability Requirement of all health monitors

HTTP, HTTPS, FTP, and ICMP with the Availability Requirement of at least one health monitor

HTTPS, HTTP, FTP, and SSH with the Availability Requirement of at least one health monitor

HTTPS, HTTP, FTP, and SSH with the Availability Requirement of all health monitors

From the exhibit, the pool contains different applications on different service ports (for example, HTTP/80, FTP/21, HTTPS/443, SSH/22). To mark pool members correctly, BIG-IP must be able to verify the actual service running on each member’s port.
In BIG-IP Administration: Data Plane Configuration, monitor behavior is described as follows:
When multiple monitors are assigned to a pool, the Availability Requirement controls how monitor results are evaluated:
At least one = the pool member is marked up if any one of the assigned monitors succeeds.
All = the pool member is marked up only if every assigned monitor succeeds.
For pools containing members with different services/ports, using All can incorrectly mark members down because monitors intended for other services will fail on the wrong port.
Why C is correct:
Assigning HTTPS, HTTP, FTP, and SSH covers the actual services shown in the pool.
Setting the Availability Requirement to at least one ensures that each pool member is considered available when its appropriate service monitor succeeds, without being forced to pass unrelated service monitors.
Why the other options are incorrect:
A / D (Availability Requirement = all): would cause members to be marked down when unrelated monitors fail (e.g., SSH monitor against an HTTP member).
B (includes ICMP): ICMP can indicate the host is reachable even if the application service is down, which does not “accurately” reflect service availability.
Therefore, the best choice is HTTPS, HTTP, FTP, and SSH with Availability Requirement of at least one health monitor.

QUESTION 38
Refer to the exhibit.

A BIG-IP Administrator creates a new Virtual Server to load balance SSH traffic. Users are unable to log on to the servers.
What should the BIG-IP Administrator do to resolve the issue?

Set HTTP Profile to None

Set Destination Addresses/Mask to 0.0.0.0/0

Set Source Address to 10.1.1.2

Set Protocol to UDP

The virtual server is intended to process SSH traffic on TCP port 22 , but the exhibit shows that the standard
http HTTP profile is assigned. This is the configuration error. An HTTP profile enables BIG-IP Layer 7 HTTP processing and is appropriate only when the virtual server is expected to process HTTP protocol traffic.
F5 documentation defines its purpose directly: “An HTTP profile defines the way that you want the BIG- IP system to manage HTTP traffic.” SSH is not HTTP. It is an independent application protocol transported over TCP , conventionally using port
22 . Therefore, an ordinary SSH load-balancing virtual server should retain the TCP protocol/profile while having HTTP Profile set to None . F5 ‘ s SSH virtual-server configuration guidance specifically uses service port 22 for SSH and does not require an HTTP profile.
Options B, C, and D do not address the fault. The destination address 10.1.1.2 correctly identifies the virtual server, while source 0.0.0.0/0 appropriately permits clients from any source. Changing the protocol to UDP would be incorrect because SSH requires TCP.
Reference Topics: Virtual Server configuration; HTTP profiles; TCP profiles; application-protocol profile assignment; SSH traffic handling.

QUESTION 39
Which two load balancing methods consider all the connections the BIG-IP has between it and each backend application server (Pool Member) when making a load balancing decision for a new connection?

Least Connections (node)

Ratio (member)

Round Robin

Weighted Least Connections (node)

The two load balancing methods that consider all connections between the BIG-IP and each backend node
– not just connections to a specific pool member – are Least Connections (node) and Weighted Least Connections (node) .
The critical distinction here lies in the node-level scope of evaluation. A node represents the backend server ‘ s IP address, regardless of how many services or ports it may be serving. Therefore:
* Least Connections (node) directs new connections to the node with the fewest total active connections across all services on that server, providing a holistic connection-count perspective.
* Weighted Least Connections (node) operates identically but factors in an administrator-defined ratio weight, allowing servers with greater capacity to proportionally absorb more connections while still evaluating total node-level connection counts.
By contrast:
* Ratio (member) distributes traffic based on a static weight ratio and does not dynamically evaluate current connection counts.
* Round Robin distributes traffic sequentially in rotation, completely ignoring current connection states on any node or member.
The node-based methods are particularly valuable in environments where a single backend server hosts multiple pool members across different ports, ensuring the server ‘ s overall load – not just per-service load
– governs balancing decisions.
Reference: BIG-IP Administration – Data Plane Configuration, Module: Load Balancing Methods – Member vs. Node Scope.

QUESTION 40
Which Virtual Server type prevents the use of a default pool?

Performance (Layer 4)

Forwarding (IP)

Performance (HTTP)

Standard

Forwarding (IP) virtual servers forward traffic based on routing decisions and do not use pools or pool members.

QUESTION 41
Refer to the exhibit.

A BIG-IP Administrator needs to configure health monitors for a newly configured server pool named Pool_B.
Which health monitor settings will ensure that all pool members will be accurately marked as available or unavailable? (Choose one answer)

HTTPS, HTTP, FTP, and SSH with the Availability Requirement of all health monitors

HTTP, HTTPS, FTP, and ICMP with the Availability Requirement of at least one health monitor

HTTPS, HTTP, FTP, and SSH with the Availability Requirement of at least one health monitor

HTTPS, HTTP, FTP, and SSH with the Availability Requirement of all health monitors

From the exhibit, the pool contains different applications on different service ports (for example, HTTP/80, FTP/21, HTTPS/443, SSH/22). To mark pool members correctly, BIG-IP must be able to verify the actual service running on each member’s port.
In BIG-IP Administration: Data Plane Configuration, monitor behavior is described as follows:
* When multiple monitors are assigned to a pool, the Availability Requirement controls how monitor results are evaluated:
* At least one = the pool member is marked up if any one of the assigned monitors succeeds.
* All = the pool member is marked up only if every assigned monitor succeeds.
* For pools containing members with different services/ports, using All can incorrectly mark members down because monitors intended for other services will fail on the wrong port.
Why C is correct:
* Assigning HTTPS, HTTP, FTP, and SSH covers the actual services shown in the pool.
* Setting the Availability Requirement to at least one ensures that each pool member is considered available when its appropriate service monitor succeeds, without being forced to pass unrelated service monitors.
Why the other options are incorrect:
* A / D (Availability Requirement = all): would cause members to be marked down when unrelated monitors fail (e.g., SSH monitor against an HTTP member).
* B (includes ICMP): ICMP can indicate the host is reachable even if the application service is down, which does not “accurately” reflect service availability.
Therefore, the best choice is HTTPS, HTTP, FTP, and SSH with Availability Requirement of at least one health monitor.

QUESTION 42
Application administrators are reporting that nodes different from those configured in the pool are selected.
The use of an iRule is suspected. How can the BIG-IP Administrator check if an iRule is used for this traffic?
(Pick the 2 correct responses below)

Via TMSH with the list /ltm rule < irule > command.

Via TMSH with the list /ltm virtual < virtual_server > command.

Via the GUI at the iRule tab for the virtual server.

Via the GUI at the Resources tab for the virtual server.

To determine if an iRule is influencing traffic for a specific Virtual Server, the administrator must verify the association between the Virtual Server object and any applied scripts. In the BIG-IP Configuration Utility (GUI), this association is found under the Resources tab of the specific Virtual Server. While there is an ” iRules ” sub-menu under Local Traffic, checking the Virtual Server ‘ s Resources tab is the definitive way to see which specific rules are currently active and in what order they are being processed for that particular traffic flow.
From the Command Line Interface (CLI), the tmsh list /ltm virtual < virtual_server > command provides a full text-based output of the virtual server ‘ s configuration. If iRules are applied, they will appear within a ” rules { … } ” block in the command output. This is more effective than Option A, which only lists the contents of the iRule itself but does not show if or where it is applied. Option C is a common misconception; while some versions of the GUI have reorganized menus, the standard location for managing the association of profiles, policies, and iRules to a Virtual Server remains the ” Resources ” section. By identifying the applied iRule, an administrator can then review the script logic-often containing commands like pool or node-to see if it is overriding the default pool selection based on specific HTTP headers, URI paths, or client IP addresses.

QUESTION 43
How will the BIG-IP system distribute the traffic based on the configuration below?
pool my_pool {
lb_mode fastest
min_active_members 2
member 10.12.10.7:80 priority 3
member 10.12.10.8:80 priority 3
member 10.12.10.9:80 priority 3
member 10.12.10.4:80 priority 2
member 10.12.10.5:80 priority 2
member 10.12.10.6:80 priority 2
member 10.12.10.1:80 priority 1
member 10.12.10.2:80 priority 1
member 10.12.10.3:80 priority 1
}
(Pick the 2 correct responses below)

Connections are first distributed to all pool members with priority 3 when all the pool members with priority 3 are available

If both the priority 1 group and the priority 2 group have fewer than two members available, traffic is directed to the priority 3 group

If both the priority 3 group and the priority 2 group have fewer than two members available, traffic is directed to the priority 1 group

Connections are distributed to all pool members with priority 2 if one pool member with priority 3 is down

The configuration provided utilizes Priority Group Activation in conjunction with the min_active_members setting. Priority groups allow an administrator to define primary servers and “backup” servers within the same pool. The BIG-IP prioritizes traffic based on the assigned priority number, with the highest number receiving traffic first.
In this specific configuration, the priority 3 group is the primary group. Therefore, connections are first distributed to all pool members with priority 3 as long as they are available. The system will continue to use only the priority 3 group unless the number of available members in that group falls below the min_active_members value, which is set to 2.
If the priority 3 group has fewer than two active members, the BIG-IP “activates” the next available priority group (priority 2) and distributes traffic among the remaining members of priority 3 and all members of priority 2. This cascading logic continues down the list. Consequently, if both the priority 3 group and the priority 2 group have fewer than two members available, traffic is directed to the priority 1 group. This ensures that even in a multi-server failure scenario, the system has a last-resort group of servers to handle the traffic.
Option D is incorrect because if only one member of priority 3 goes down, there are still two members active (10.12.10.8 and 10.12.10.9). Since 2 is not less than the min_active_members threshold of 2, the priority 2 group will not yet be activated. Option B is incorrect because traffic flows from high priority to low priority, not the other way around.

QUESTION 44
Application administrators are reporting that nodes different from those configured in the pool are selected.
The use of an iRule is suspected. How can the BIG-IP Administrator check if an iRule is used for this traffic?
(Pick the 2 correct responses below)

Via TMSH with the list /ltm rule <irule> command.

Via TMSH with the list /ltm virtual <virtual_server> command.

Via the GUI at the iRule tab for the virtual server.

Via the GUI at the Resources tab for the virtual server.

To determine if an iRule is influencing traffic for a specific Virtual Server, the administrator must verify the association between the Virtual Server object and any applied scripts. In the BIG-IP Configuration Utility (GUI), this association is found under the Resources tab of the specific Virtual Server. While there is an
“iRules” sub-menu under Local Traffic, checking the Virtual Server’s Resources tab is the definitive way to see which specific rules are currently active and in what order they are being processed for that particular traffic flow.
From the Command Line Interface (CLI), the tmsh list /ltm virtual <virtual_server> command provides a full text-based output of the virtual server’s configuration. If iRules are applied, they will appear within a “rules {
… }” block in the command output. This is more effective than Option A, which only lists the contents of the iRule itself but does not show if or where it is applied. Option C is a common misconception; while some versions of the GUI have reorganized menus, the standard location for managing the association of profiles, policies, and iRules to a Virtual Server remains the “Resources” section. By identifying the applied iRule, an administrator can then review the script logic-often containing commands like pool or node-to see if it is overriding the default pool selection based on specific HTTP headers, URI paths, or client IP addresses.

QUESTION 45
A Standard Virtual Server reports poor network performance for Internet-based clients.
What configuration should be applied?

Client TCP: f5-tcp-wan / Server TCP: f5-tcp-lan

Client TCP: f5-tcp-lan

Client TCP: f5-tcp-lan / Server TCP: f5-tcp-wan

Client TCP: f5-tcp-optimized

WAN TCP profiles are optimized for high latency and packet loss typical of Internet clients, while LAN profiles are ideal for backend servers.

QUESTION 46
A BIG-IP Administrator finds the following log entry after a report of user issues connecting to a virtual server:
01010201: Intercept exhaustion on 10.70.110.112 to 192.28.123.250:80 (proto 6) How should the BIG-IP Administrator modify the SNAT pool that is associated with the virtual server?
(Choose one answer)

Increase the timeout of the SNAT addresses

Remove the SNAT pool and apply SNAT Automap

Remove an IP address from the SNAT pool

Add an IP address to the SNAT pool

The log message “Intercept exhaustion” indicates that the BIG-IP system has exhausted the available source port translations for one or more SNAT addresses. This occurs when too many concurrent client connections are being translated through a limited number of SNAT IP addresses, and all ephemeral source ports (typically ~64,000 per SNAT IP) are in use.
According to the BIG-IP Administration: Data Plane Configuration documentation:
Each SNAT IP address provides a finite number of available source ports.
When the number of concurrent connections exceeds the available port space, the BIG-IP logs an Intercept exhaustion error and new connections fail.
The recommended resolution is to increase the available SNAT resources by adding additional IP addresses to the SNAT pool.
Why the other options are incorrect:
A). Increase the timeout of the SNAT addressesIncreasing timeouts may actually worsen the problem by keeping ports allocated longer, accelerating port exhaustion.
B). Remove the SNAT pool and apply SNAT AutomapSNAT Automap uses the Self IP addresses on the egress VLAN, which may not provide additional capacity and can introduce routing or design issues. This is not a direct or recommended fix for SNAT exhaustion.
C). Remove an IP address from the SNAT poolThis would reduce the number of available source ports and further exacerbate the intercept exhaustion condition.
Correct Resolution:
By adding an IP address to the SNAT pool, the BIG-IP increases the total number of available source ports, alleviating intercept exhaustion and restoring successful client connections.

QUESTION 47
Refer to the exhibit.

DNS queries from two internal DNS servers are being load balanced to external DNS servers via a Virtual Server on a BIG-IP device. The DNS queries originate from 192.168.101.100 and 192.168.101.200 and target
192.168.21.50 .
All DNS queries destined for the external DNS servers fail.
Which property change should the BIG-IP Administrator make in the Virtual Server to resolve this issue?

Protocol Profile (Client) to DNS-OPTIMIZED

Protocol to UDP

Source Address to 192.168.101.0/24

Type to Performance (HTTP)

The virtual server is configured for destination 192.168.21.50 , service port 53 , but its Protocol is TCP .
Standard DNS query traffic is normally sent using UDP port 53 . Because virtual-server traffic matching includes the configured IP protocol, UDP DNS packets will not match a virtual server configured exclusively for TCP, causing the queries to fail.
F5 ‘ s DNS configuration guidance explicitly instructs administrators creating a DNS query virtual server to configure service port 53 and select UDP as the protocol. F5 also recommends separate TCP and UDP virtual servers when both forms of DNS traffic must be supported; TCP port 53 is particularly relevant for operations such as DNS zone transfers.
Option C is not required. The existing source network 192.168.100.0/23 spans addresses from 192.168.100.0 through 192.168.101.255, so both 192.168.101.100 and 192.168.101.200 are already permitted by the source- address criterion. F5 documents that the Source Address setting can specify the network from which a virtual server accepts traffic.
Therefore, changing the virtual server ‘ s Protocol from TCP to UDP corrects the traffic-matching problem.
Reference Topics: Virtual Server traffic matching; Protocol selection; DNS over UDP/TCP; Source Address matching; Service Port 53.

QUESTION 48
A BIG-IP Administrator is setting up a new BIG-IP device. The network administrator reports that the interface has an incompatible media speed. The BIG-IP Administrator needs to change this setting manually.
From which location should the BIG-IP Administrator perform this task?

On the Front Console

In the TMOS Shell Command line

In the Configuration Utility, Network > Interface

In the Configuration Utility, System > Configuration

Standard BIG-IP administration dictates that hardware-level physical attributes are managed within the Network section of the configuration. When a network switch and a BIG-IP fail to successfully negotiate speed and duplex settings (Auto-Negotiation), it can result in CRC errors, late collisions, or a total lack of link. To resolve this manually, the administrator must navigate to the Configuration Utility (GUI) and go to Network > Interfaces.
Within the Interfaces list, the administrator can select the specific physical port (e.g., 1.1 or 1.2) and modify its properties. By default, the media speed is set to “Auto,” but the drop-down menu allows for manual selection of specific speeds (e.g., 100Mb/s, 1Gb/s, 10Gb/s) and duplex settings (Full or Half). While these changes can also be made via the TMOS Shell (TMSH) (Option B) using the modify net interface command, the question asks for the standard location, which in most administrative contexts refers to the primary GUI path. System > Configuration (Option D) is used for global device settings like NTP, DNS, and licensing, not for interface-specific physical layer parameters. The Front Console (Option A), referring to the LCD panel on physical appliances, is primarily used for initial management IP setup and viewing system alerts, but does not provide the granular interface configuration required for media speed adjustments.

Loading …

F5CAB3 Exam Practice Questions prepared by F5 Professionals: https://www.latestcram.com/F5CAB3-exam-cram-questions.html

Related Certifications

H19-404_V1.0 (1)
H12-311_V3.0 (1)
H35-210_V2.5 (1)
H35-480_V3.0 (1)
H35-580_V2.0 (2)
H13-821_V3.0 (1)
H13-611 (1)
H12-711 (1)
H35-663 (1)
H11-851_V3.0 (2)

Free Cram & Latest Exams Dumps