F5-303 study plan

Map the full request path through a BIG-IP: client VLAN, virtual server, iRule event, pool member selection, and server-side connection, drawing it from memory by week's end

Distinguish the roles of virtual server, pool, pool member, node, monitor, and profile, and state which object owns persistence, SSL termination, and health checking

Configure a working HTTP virtual server with a load-balancing pool of at least two members and one health monitor on a lab or trial instance

Explain the difference between a standard virtual server, a forwarding virtual server, and a performance L4 virtual server, and pick the right one for three described traffic scenarios

Configure and verify load-balancing methods (round robin, least connections, ratio, and priority group activation) and predict member selection for a given member state

Set up a health monitor tuned to an application endpoint and demonstrate the pool draining a member after a forced failure

Implement source-address persistence and cookie persistence, then articulate when each is appropriate and how they interact with SSL offload

Describe how profiles (TCP, HTTP, client SSL, server SSL) layer onto a virtual server and modify traffic without an iRule

Configure SNAT and a SNAT pool, then confirm the source address seen by a backend server using a capture or server log

Build a simple iRule that logs a header and redirects based on URI, and explain which events fire in what order for one request

Compare one-connect, auto last hop, and SNAT behavior and select the correct choice for a topology where the pool member's default gateway is not the BIG-IP

Use tcpdump on the BIG-IP to prove whether traffic is being SNATed and whether the return path is symmetric

Explain the WAF processing pipeline from virtual server through the security policy to the backend, including where attack signatures, parameters, and bot defense sit

Create a security policy in transparent/learning mode, generate traffic against a deliberately vulnerable test app, and read the resulting violations

Tune a false positive by disabling or relaxing a specific signature or parameter and record the rationale

Distinguish a signature-based violation from a violation raised by a negative-security or parameter enforcement setting