F5-304 flashcards
F5-304 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Full proxy architecture
- The BIG-IP terminates the client TCP connection and opens a separate connection to the server, allowing independent TCP, TLS, and timeout settings on each side.
- Round Robin method
- The default load-balancing method that distributes requests to pool members in sequential order, ignoring current connection counts or member capacity.
- Least Connections method
- A load-balancing method that sends each new request to the pool member with the fewest active connections, suiting pools where session durations vary widely.
- Priority Group Activation
- Only members in the highest-priority group with an available member receive traffic; lower groups are used solely when all higher-priority members are down.
- Wildcard virtual server
- A virtual server whose destination port is specified as 0 or * so it matches traffic to any port on the configured address; the most specific match wins.
- Persistence profile
- A configuration that overrides load-balancing selection so a client keeps reaching the same pool member for the duration of the persistence entry's timeout.
- OneConnect profile
- A profile that pools idle server-side TCP connections so multiple client requests reuse them; it requires HTTP processing and needs care with NTLM authentication.
- Health monitor state
- A member must pass its monitor for the configured interval and retries before being placed in service; a single failed check can mark it down.
- Administrative partitions
- Logical containers for configuration objects; a virtual server can reference pool members only within its own partition or one it has been granted access to.
- iRule event order
- Events fire in sequence: CLIENT_ACCEPTED, CLIENT_DATA, HTTP_REQUEST, LB_SELECTED, SERVER_CONNECTED, HTTP_RESPONSE, HTTP_RESPONSE_DATA, SERVER_CLOSED, CLIENT_CLOSED.
- pool versus node command
- In an iRule, the pool command selects a named pool for load balancing, while the node command bypasses the pool and targets a specific address and port.
- Profile inheritance
- Profiles inherit settings from a parent profile; a virtual server applies exactly one profile of each type, and the parent chain supplies unspecified defaults.
- Standard virtual server type
- A virtual server type that handles TCP and UDP with full proxy processing, supporting iRules that inspect and modify payload content.
- Performance Layer 4 type
- A fastL4-based virtual server type that forwards packets with minimal processing and cannot use iRules requiring full payload parsing.
- SNAT automap
- A translation mode that uses the virtual server's own self IP as the source address for server-side connections, requiring no separate SNAT pool.
- Pool member ratio
- A weight applied only to Ratio-based load-balancing methods; it has no effect on Round Robin or Least Connections selection.
- Virtual server idle timeout
- The period of inactivity after which a connection is closed; the TCP default is 300 seconds, and a value of 0 disables timeout entirely.
- Access Policy flow
- A per-request visual policy attached to a virtual server; a successful termination issues a session and cookie, while a deny branch blocks the request.
- APM session timeouts
- Access sessions have both a maximum session timeout and an idle timeout; whichever limit is reached first expires the session.
- Client SSL cipher policy
- A client SSL profile's cipher string restricts which algorithms are accepted; a non-matching client handshake is rejected before any HTTP processing occurs.
- Drop versus reject action
- A drop action silently discards matching packets with no response, while a reject action returns a TCP reset to the sender.
- Configuration sync status
- Device Service Clustering reports Changes Pending when local edits are not pushed to the peer, and In Sync when both devices hold identical configuration.
- WAF enforcement mode
- A WAF security policy can run transparent (log only), blocking (reject matching requests), or mixed, applying different modes per attack signature or URL.
- Mutual TLS validation
- The client presents a certificate that must validate against the trust anchor in the client SSL profile's CA bundle; failure aborts the handshake.
- Policy branch ordering
- Access policy branches evaluate from top to bottom, and the first matching branch ends evaluation, so decision-box order determines the outcome.
- LTM log location
- Traffic-processing events are written to /var/log/ltm; access sessions go to /var/log/apm and configuration changes to /var/log/audit.
- tcpdump capture command
- Capture on the relevant VLAN interface with a command such as tcpdump -i 0.0:nnn -s0 -w /var/tmp/cap.pcap host <ip> to avoid truncation.
- Virtual server offline status
- An offline virtual server usually means no pool members are available or it is disabled; verify member monitor status before other checks.
- qkview utility
- A diagnostic tool that collects logs, configuration, and statistics into a snapshot for support; it does not modify configuration and is safe on production.
- tmsh show ltm virtual
- A command that displays virtual server status and statistics, including availability, current connections, and throughput counters.
- Config verify command
- The command tmsh load sys config verify parses the configuration for syntax and reference errors without applying any changes to the running system.
- High CPU diagnosis
- Elevated CPU on a virtual server often traces to iRules performing per-packet work or SSL handshake load; check system performance and iRule event statistics.