I85PREP
⌘ K
F5-304 study materials
F5-304 study resources

F5-304 practice questions

One question at a time. Build your F5-304 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Application Delivery Fundamentals

A client opens an HTTPS connection to a BIG-IP virtual server. The virtual server is configured with an HTTP profile, a client SSL profile, and a pool. What does the BIG-IP do with the encrypted client traffic before forwarding it to a pool member?

  1. It passes the ciphertext to the pool member and lets the member terminate TLS
  2. It re-encrypts the traffic with the pool member's own certificate before inspecting it
  3. It decrypts the traffic using the client SSL profile, processes it as HTTP, then re-encrypts only if a server SSL profile is attached Correct answer.
  4. It forwards the encrypted bytes unchanged because a client SSL profile only validates certificates

Explanation

A client SSL profile terminates TLS on the BIG-IP, so the connection is decrypted at the virtual server and processed by the HTTP profile. If a server SSL profile is also attached, the BIG-IP re-encrypts toward the pool member; without one, traffic to the member is plaintext. This client-side termination is the core of SSL offload.

Question 2Application Delivery Fundamentals

Which load-balancing method selects a pool member based on a computed hash of the source IP address so that a given client consistently reaches the same member?

  1. Source IP address affinity Correct answer.
  2. Least connections
  3. Observed (least connections with dynamic ratio)
  4. Round robin

Explanation

Source IP address affinity hashes the client address to pick a member, giving session persistence as long as the member is available. Round robin and least connections distribute per request without regard to client identity. Observed mode adjusts member ratios dynamically based on performance but does not hash the client address.

Question 3Application Delivery Fundamentals

An administrator wants health monitors to mark a pool member down when the application returns an HTTP 500 response, while still accepting a 200 response. Which monitor configuration achieves this?

  1. A gateway ICMP monitor on the pool
  2. A TCP half-open monitor on the pool member port
  3. An ICMP monitor on the node
  4. An HTTP monitor with send and receive strings that match a known healthy response body Correct answer.

Explanation

An HTTP monitor can send a request and require a matching receive string, so only a correct application response keeps the member up. A 500 response will not contain the expected string and the member is marked down. ICMP and TCP monitors only test reachability of the host or port, not application-level correctness.

Question 4Application Delivery Fundamentals

What is the primary purpose of a persistence profile on a virtual server?

  1. To ensure a client's subsequent connections go to the same pool member for a period of time Correct answer.
  2. To balance connections across pools in a priority group
  3. To compress responses before they reach the client
  4. To authenticate users against an LDAP directory

Explanation

A persistence profile maintains session affinity so that related requests from one client are directed to the same pool member, which matters for stateful applications. It does not perform compression, authentication, or pool selection. Persistence entries have a timeout that controls how long the affinity lasts.

Question 5Application Delivery Fundamentals

Which statement best describes the role of a default pool on a virtual server?

  1. It is the pool used only for health checks of the virtual server
  2. It is the pool used when the virtual server is disabled
  3. It receives traffic when no other pool is selected by an iRule or policy Correct answer.
  4. It is the pool that holds all standby members

Explanation

The default pool is the destination for traffic when no other pool selection logic, such as an iRule or local traffic policy, chooses a pool. It is not related to health checking or standby membership. If the default pool has no available members, the virtual server cannot serve traffic unless another pool is selected.

Question 6Application Delivery Fundamentals

A virtual server is configured with a destination address of 10.10.10.100 and a service port of 443. What does this configuration define?

  1. The health-check target for all pool members
  2. The listener that accepts client traffic for that address and port Correct answer.
  3. The SNAT address used for outbound connections
  4. The source address the BIG-IP uses toward pool members

Explanation

The virtual server destination address and port form the listener that clients connect to. The BIG-IP matches incoming traffic against this address and port to decide whether the virtual server handles it. Source addresses toward members and SNAT addresses are configured separately.

Question 7Application Delivery Fundamentals

Which profile type is required for a virtual server to inspect and modify HTTP headers such as inserting an X-Forwarded-For header?

  1. HTTP profile Correct answer.
  2. UDP profile
  3. TCP profile
  4. Client SSL profile

Explanation

Layer 7 header manipulation requires the BIG-IP to parse HTTP, which is enabled by attaching an HTTP profile to the virtual server. TCP and UDP profiles operate at lower layers and do not understand headers. A client SSL profile only terminates encryption.

Question 8Application Delivery Fundamentals

What happens when a pool member's monitor marks it down while other members remain available?

  1. The pool is deleted and must be recreated
  2. The virtual server stops accepting new connections entirely
  3. The member is removed from load-balancing selection until it is marked up again Correct answer.
  4. The member continues to receive connections but at a reduced ratio

Explanation

When a monitor marks a member down, the BIG-IP stops sending new traffic to that member and continues using the remaining available members. The member is returned to service automatically once its monitor succeeds again. The virtual server and pool remain intact throughout.

Question 9Application Delivery Fundamentals

A client connects to a virtual server, and the BIG-IP must forward the request to a pool member while preserving the client's original source IP for the application's logging. Which feature accomplishes this without additional configuration on the member?

  1. IP address transparency provided by a forwarding virtual server
  2. A secure network address translation pool with one address
  3. Source address translation disabled (preserving the client address) Correct answer.
  4. SNAT with automap

Explanation

With source address translation disabled, the BIG-IP forwards packets using the client's original source address, so the application sees the real client IP. This requires the pool members to have a route back to the client network through the BIG-IP. SNAT and automap would replace the client address with a BIG-IP address.

Question 10Application Delivery Fundamentals

An administrator needs to distribute traffic across three pools in a defined priority order, using the next pool only when the higher-priority pool has no available members. Which configuration provides this behavior?

  1. A local traffic policy that selects pools based on member availability Correct answer.
  2. A virtual server with a pool that references a fallback pool chain
  3. A single pool with three members and priority groups
  4. A virtual server with a default pool and a fallback host

Explanation

A local traffic policy can evaluate conditions and select among multiple pools, including choosing the next pool when the preferred one has no available members. Pool member priority groups operate within one pool and do not select between separate pools. A fallback host is used for error handling, not ordered pool selection.

Question 11Application Delivery Fundamentals

A virtual server uses a cookie-based persistence profile. After a pool member fails its monitor, what is the typical behavior for clients that hold a persistence cookie pointing to that member?

  1. They are dropped until the member recovers
  2. They are rejected with an HTTP 503 response permanently
  3. They are load-balanced to an available member and a new persistence entry is created Correct answer.
  4. They are redirected to a different virtual server

Explanation

When the persisted member is unavailable, the BIG-IP falls back to normal load balancing across available members and establishes new persistence for the client. Clients are not permanently rejected or dropped. Once the original member recovers, new sessions may again be directed to it according to policy.

Question 12Application Delivery Fundamentals

Which statement accurately distinguishes a node monitor from a pool member monitor?

  1. Node monitors apply to virtual servers, while member monitors apply to pools
  2. A node monitor checks only the port, while a member monitor checks only the address
  3. Node and member monitors are identical and cannot be configured separately
  4. A node monitor checks the entire node address, while a member monitor checks the specific address and port combination Correct answer.

Explanation

A node monitor tests the node address itself, often with ICMP or a service check, while a pool member monitor tests the specific address and port that the member represents. Member monitors give more precise application-level health information. Node and member monitors can be configured independently.

Question 13Application Delivery Fundamentals

A virtual server is configured with a TCP profile and a UDP profile simultaneously. What is the likely result?

  1. The BIG-IP accepts both TCP and UDP traffic on the virtual server
  2. The configuration is invalid because a virtual server uses one protocol type Correct answer.
  3. The UDP profile overrides the TCP profile
  4. The virtual server automatically creates two listeners

Explanation

A virtual server is associated with a single protocol type, so mixing a TCP profile and a UDP profile on one virtual server is not a valid configuration. Separate virtual servers are needed for TCP and UDP services. The platform does not silently merge them into a dual-protocol listener.

Question 14Application Delivery Fundamentals

Which iRule event is best suited to inspect the HTTP Host header and select a pool before the request is proxied to a member?

  1. SERVER_CONNECTED
  2. HTTP_REQUEST Correct answer.
  3. LB_SELECTED
  4. CLIENT_ACCEPTED

Explanation

HTTP_REQUEST fires after the request headers are parsed, so the Host header is available for inspection and a pool can be selected before load balancing. CLIENT_ACCEPTED occurs before any HTTP data arrives. SERVER_CONNECTED and LB_SELECTED happen after or during member selection, too late to choose the pool based on the header.

Question 15Application Delivery Fundamentals

An administrator attaches an HTTP compression profile to a virtual server. Which traffic is affected?

  1. Only responses that the client indicates it can accept compressed content Correct answer.
  2. All responses regardless of client capability
  3. Only requests sent from the client to the BIG-IP
  4. Only traffic that is already compressed by the server

Explanation

Compression is applied based on the client's Accept-Encoding header, so only clients that advertise support receive compressed responses. The BIG-IP compresses eligible response content according to the profile settings. Requests and pre-compressed payloads are handled differently.

Question 16Application Delivery Fundamentals

A pool uses the least connections method with a priority group configuration. What happens when all members in the highest-priority group become unavailable?

  1. Members in the next lower priority group become eligible to receive traffic Correct answer.
  2. The BIG-IP resets all existing connections
  3. The virtual server switches to round robin automatically
  4. The pool is marked down and the virtual server stops serving traffic

Explanation

Priority groups allow a pool to define preferred members and backups; when the preferred group has no available members, the next group becomes active. The pool does not go down as long as some member in a lower group is available. Existing connections are not reset and the method does not change automatically.

Question 17Application Delivery Fundamentals

Which configuration ensures that a virtual server responds to clients with a redirect to HTTPS when they connect over HTTP?

  1. A server SSL profile on the HTTP virtual server
  2. A client SSL profile on the HTTP virtual server
  3. A persistence profile configured for SSL
  4. An iRule or local traffic policy that sends an HTTP 302 redirect for requests on port 80 Correct answer.

Explanation

Redirecting HTTP to HTTPS is implemented at the application layer with an iRule or local traffic policy that returns a redirect response to the client. SSL profiles control encryption of connections and do not generate redirects. Persistence profiles have no role in redirection.

Question 18Application Delivery Fundamentals

A virtual server has a default pool with two members, both marked down, and no other pool selection logic. What is the result for new client connections?

  1. Traffic is queued until a member recovers
  2. The BIG-IP automatically marks the virtual server down
  3. Connections are load-balanced to the nodes directly
  4. The virtual server cannot forward traffic to a pool member and the connection fails Correct answer.

Explanation

If no pool member is available and no other selection logic exists, the BIG-IP has no destination for the traffic, so the connection cannot be served. The virtual server itself remains configured and enabled. Traffic is not queued for later delivery.

Question 19Application Delivery Fundamentals

Which statement about a wildcard virtual server is accurate?

  1. It can only be used with UDP traffic
  2. It requires a pool with exactly one member
  3. It matches only traffic addressed to the BIG-IP self IPs
  4. It matches traffic for any destination address on the specified port Correct answer.

Explanation

A wildcard virtual server uses a destination address of 0.0.0.0 or :: to match traffic for any address on its configured port. It is commonly used for forwarding or for catching traffic that no specific virtual server matches. It is not restricted to self IPs, one member, or UDP.

Question 20Application Delivery Fundamentals

An application requires that the BIG-IP insert a client certificate request toward pool members while presenting a different certificate to clients. Which combination of profiles supports this?

  1. An HTTP profile and a TCP profile only
  2. A client SSL profile and a server SSL profile on the same virtual server Correct answer.
  3. A single client SSL profile only
  4. A persistence profile and a client SSL profile

Explanation

A client SSL profile terminates TLS from the client, and a server SSL profile re-encrypts traffic toward the pool members with the member-facing certificate settings. Using both allows different certificates on each side. A client SSL profile alone would leave member traffic unencrypted.

Question 21Application Delivery Fundamentals

A pool member monitor is configured with an interval of 5 seconds and a timeout of 16 seconds. What is the effect of the timeout exceeding the interval?

  1. The member is immediately marked down after 5 seconds
  2. Multiple probes may be outstanding before a result is determined Correct answer.
  3. The monitor is disabled because the values conflict
  4. The monitor sends probes every 16 seconds

Explanation

When the timeout is longer than the interval, a new probe can be sent before the previous one has completed, so several probes may be in flight. This can delay how quickly a failure is detected. The interval still controls probe frequency, and the configuration is valid.

Question 22Application Delivery Fundamentals

A virtual server uses source IP persistence with a 180-second timeout. A client's connection is idle for 200 seconds and then sends a new request. What is the expected behavior?

  1. The request is dropped because persistence expired
  2. The request is sent to the same member because the source IP is unchanged
  3. The BIG-IP resets the client connection
  4. The persistence entry has expired, so the request is load-balanced normally Correct answer.

Explanation

Persistence entries expire after the configured timeout, so an idle period longer than 180 seconds removes the affinity record. The next request is load-balanced according to the pool method and a new persistence entry is created. The client address being unchanged does not preserve an expired entry.

Question 23Application Delivery Fundamentals

Which statement correctly describes the interaction between a virtual server's protocol profile and its pool member's monitor?

  1. The monitor operates independently of the virtual server's profiles Correct answer.
  2. The monitor uses the virtual server's protocol profile to test members
  3. The monitor inherits the virtual server's SSL profile
  4. The monitor requires the same profile as the virtual server

Explanation

Monitors are independent objects that test node and member health using their own settings, not the virtual server's profiles. A monitor can send an HTTP request regardless of whether the virtual server has an HTTP profile attached. This independence lets health checking match the application directly.

Question 24Application Delivery Fundamentals

An administrator configures a one-connect profile on a virtual server. What behavior does this enable?

  1. Each client connection is mapped to a single member connection that is reused for subsequent requests Correct answer.
  2. The client is limited to one request per connection
  3. The BIG-IP opens a new member connection for every client request
  4. The BIG-IP maintains a single connection to the pool for all clients

Explanation

A one-connect profile allows the BIG-IP to reuse an existing member-side connection for multiple client connections, reducing connection setup overhead. It does not merge all clients into one shared connection. Per-request reconnection describes the default behavior without one-connect.

Question 25Application Delivery Fundamentals

A local traffic policy and an iRule on the same virtual server both attempt to select a pool for the same request. Which statement best describes how to reason about the outcome?

  1. The policy always wins because policies are evaluated before iRules
  2. The iRule always wins because it executes first
  3. Both selections are applied and traffic is duplicated to two pools
  4. Evaluation order and the specific events determine which selection takes effect, so the configuration must be designed to avoid conflicts Correct answer.

Explanation

Pool selection can be influenced by multiple mechanisms, and the effective result depends on evaluation order and the events involved. Conflicting logic should be avoided or designed deliberately so the intended selection is deterministic. Traffic is never duplicated to two pools as a result of conflicting selection logic.

Question 26Application Delivery Fundamentals

In BIG-IP Local Traffic Manager terminology, what is the relationship between a virtual server and a pool?

  1. A pool is a monitoring template that is attached to a virtual server to verify backend health.
  2. A virtual server and a pool are both listener definitions, and either one can receive client connections directly.
  3. A virtual server defines the listener that receives client traffic, and a pool groups the backend servers that traffic can be sent to. Correct answer.
  4. A pool defines the client-facing listener, and a virtual server groups the backend servers that traffic can be sent to.

Explanation

A virtual server is the LTM object that listens on an address and service port for client traffic. A pool is a logical collection of backend nodes and service ports that the virtual server can select as a destination. The two are linked by a default pool or by traffic-selection logic such as an iRule or local traffic policy.

Question 27Application Delivery Fundamentals

Which object is used to define a backend server's IP address and allow it to be referenced by multiple pools?

  1. A node Correct answer.
  2. A health monitor
  3. A SNAT translation address
  4. A virtual address

Explanation

A node represents a backend server by IP address and can be shared by several pools, each pool member adding a service port. Virtual addresses and SNAT translation addresses are listener-side or source-translation objects, not backend server definitions. Monitors test health but do not define an address for pooling.

Question 28Application Delivery Fundamentals

What is the purpose of a health monitor attached to a pool member?

  1. It records the number of connections each member receives for billing and reporting purposes.
  2. It periodically tests the member and marks it up or down so the virtual server avoids sending traffic to a failed server. Correct answer.
  3. It encrypts traffic between the BIG-IP and the pool member using a configured cipher suite.
  4. It rewrites the client source address to the member's address before forwarding the request.

Explanation

A monitor sends periodic probes and evaluates the responses to determine whether a member is available. The resulting up or down state controls whether load balancing can select that member. Encryption, accounting, and address translation are handled by other profile or configuration objects.

Question 29Application Delivery Fundamentals

An administrator wants client traffic for www.example.com to be handled by one virtual server and traffic for api.example.com by another, both arriving on the same IP address and port 443. Which feature supports this?

  1. A forwarding virtual server with no pool assigned
  2. An HTTP virtual server with a host-based traffic-matching criterion Correct answer.
  3. A SNAT pool applied to the shared virtual address
  4. A network virtual server with a wildcard destination address

Explanation

HTTP virtual servers can match on request attributes such as the Host header, allowing multiple virtual servers to share an address and port. A network or forwarding virtual server operates on IP information and cannot distinguish hostnames inside TLS or HTTP requests. A SNAT pool affects source translation only and does not separate traffic by hostname.

Question 30Application Delivery Fundamentals

What does a load balancing method determine on a pool?

  1. Which pool member is selected to receive a new connection when the virtual server distributes traffic Correct answer.
  2. Which VLAN the pool members must be reachable on for health checks to succeed
  3. Which monitor is assigned to each pool member automatically at creation time
  4. Which SSL certificate is presented to clients during the TLS handshake

Explanation

The load balancing method is the algorithm, such as round robin or least connections, that chooses among available members. Monitors, VLAN reachability, and certificates are configured through separate objects and settings. The method only decides member selection for new traffic.

Question 31Application Delivery Fundamentals

Which persistence method tracks a client by information the BIG-IP places in an HTTP response and expects the client to return on later requests?

  1. Cookie persistence Correct answer.
  2. Source IP persistence
  3. Destination IP persistence
  4. SSL session ID persistence

Explanation

Cookie persistence inserts or uses a cookie so that subsequent requests carrying that cookie are sent to the same member. Source and destination IP persistence rely on address information rather than a returned token. SSL session ID persistence keys on the TLS session identifier, not on an HTTP cookie.

Question 32Application Delivery Fundamentals

What is the role of a protocol profile such as TCP or UDP on a virtual server?

  1. It defines the certificate chain used when terminating client TLS sessions.
  2. It assigns the virtual server to a specific VLAN for traffic reception.
  3. It determines which pool members are eligible based on their monitor status.
  4. It controls protocol-specific behavior such as connection handling and timeouts for traffic the virtual server processes. Correct answer.

Explanation

Protocol profiles tune how the BIG-IP handles a given protocol, including connection management and idle timeouts. VLAN association, member eligibility, and certificate handling are configured elsewhere. Choosing the correct protocol profile matters because it must match the traffic type the virtual server receives.

Question 33Application Delivery Fundamentals

Which iRule event fires when a client first connects to a virtual server, before any request payload is available?

  1. HTTP_RESPONSE
  2. CLIENT_ACCEPTED Correct answer.
  3. HTTP_REQUEST
  4. LB_SELECTED

Explanation

CLIENT_ACCEPTED runs when the client connection is accepted, which is before application-layer data such as an HTTP request exists. HTTP_REQUEST and HTTP_RESPONSE fire later in the request and response lifecycle. LB_SELECTED fires after a load balancing decision has been made.

Question 34Application Delivery Fundamentals

A virtual server uses round robin load balancing with three pool members, one of which is marked down by its monitor. How does round robin distribute new connections?

  1. It cycles through all three members, sending one connection in three to the failed member.
  2. It cycles through the two members that are up, skipping the member marked down. Correct answer.
  3. It refuses new connections until the down member recovers.
  4. It stops load balancing and sends all traffic to the first member in the pool.

Explanation

Load balancing considers only members that are available according to their monitor status. Round robin then rotates among those available members in turn. A member marked down is skipped until it is marked up again.

Question 35Application Delivery Fundamentals

An administrator needs the BIG-IP to forward traffic to a pool member using the client's original source IP address. Which configuration accomplishes this?

  1. Configure a SNAT pool containing the pool member addresses
  2. Enable a one-connect profile on the virtual server
  3. Attach a cookie persistence profile to the virtual server
  4. Set source address translation to None on the virtual server Correct answer.

Explanation

When source address translation is set to None, the BIG-IP does not rewrite the client source address, so servers see the original client IP. A SNAT pool would replace the client address with an address from the pool. Persistence and one-connect settings do not control source address rewriting.

Question 36Application Delivery Fundamentals

A pool uses priority groups, and all members of the highest priority group fail their monitors while lower priority group members remain up. What is the expected behavior?

  1. Traffic is sent to the failed members of the highest priority group to preserve priority.
  2. Traffic is dropped because the highest priority group has no available members.
  3. Traffic is directed to the available members of the next priority group. Correct answer.
  4. The virtual server is automatically disabled until the highest priority group recovers.

Explanation

Priority groups express a preference order: the highest group with available members receives traffic. If every member of that group is down, selection moves to the next group that has available members. Traffic is not sent to down members, and the virtual server is not automatically disabled.

Question 37Application Delivery Fundamentals

An administrator wants only requests whose URI begins with /images/ to be sent to a dedicated pool, while all other requests use the default pool. Which approach is most appropriate?

  1. Attach a compression profile that targets the /images/ path.
  2. Create an iRule on the virtual server that inspects the URI in HTTP_REQUEST and selects the dedicated pool conditionally. Correct answer.
  3. Create a second virtual server on the same address and port with a wildcard destination.
  4. Change the pool's load balancing method to least connections.

Explanation

URI-based selection requires inspecting the HTTP request, which an iRule can do in HTTP_REQUEST before the pool is chosen. The rule can compare the path prefix and call pool to select the dedicated pool, otherwise leaving the default. Load balancing methods and compression profiles do not perform request routing.

Question 38Application Delivery Fundamentals

A virtual server terminates client TLS and must connect to pool members over TLS as well. Which profile combination is required?

  1. A client SSL profile only, because member-side encryption is automatic
  2. A client SSL profile for the client-facing side and a server SSL profile for the member-facing side Correct answer.
  3. A server SSL profile only, because client-side termination is implicit
  4. An HTTP profile with a compression setting enabled

Explanation

TLS termination toward clients is handled by a client SSL profile, and initiating TLS toward pool members requires a server SSL profile. Both are needed when the BIG-IP decrypts on the client side and re-encrypts on the server side. Neither side is enabled implicitly by the other.

Question 39Application Delivery Fundamentals

What is the effect of configuring a virtual server as a forwarding virtual server?

  1. It translates the client source address to the virtual server address by default.
  2. It forwards IP packets based on routing information without performing load balancing to a pool. Correct answer.
  3. It load balances traffic across all pools referenced by the virtual server.
  4. It terminates TLS and inspects HTTP headers before forwarding.

Explanation

A forwarding virtual server passes traffic according to the routing table rather than selecting a pool member. It is commonly used for transparent forwarding scenarios. It does not balance across pools or inspect application-layer headers.

Question 40Application Delivery Fundamentals

An administrator observes that clients are being sent to a different pool member on each new connection despite a source IP persistence profile being attached. Which condition best explains this?

  1. The persistence entry expired or was never created because the client addresses differ. Correct answer.
  2. The virtual server has an HTTP profile attached, which disables persistence.
  3. The pool has more than one member, which disables persistence.
  4. The load balancing method is round robin, which overrides persistence.

Explanation

Source IP persistence creates an entry keyed on the client address with a configurable timeout. If that entry expires or each client presents a different address, persistence cannot direct them consistently. Load balancing methods and pool size do not override persistence, and an HTTP profile does not disable it.

Question 41Application Delivery Fundamentals

A monitor is configured with an interval of 10 seconds and a timeout of 31 seconds. What is the practical consequence of this configuration?

  1. The monitor will send probes every 31 seconds instead of every 10 seconds.
  2. The monitor will mark every member down because the timeout exceeds the interval.
  3. The monitor's timeout is longer than its interval, so a slow probe may overlap with the next scheduled probe. Correct answer.
  4. The timeout value is ignored because it is larger than the interval.

Explanation

The interval controls how often a probe is sent, and the timeout controls how long the BIG-IP waits for a response. A timeout longer than the interval allows a probe to remain outstanding when the next probe is due. This can delay failure detection and complicate health status, so timeouts are typically kept below the interval.

Question 42Application Delivery Fundamentals

Which statement best describes how a local traffic policy differs from an iRule for traffic selection?

  1. A local traffic policy is configured declaratively through the GUI with ordered rules and actions, while an iRule is Tcl-based scripting. Correct answer.
  2. A local traffic policy replaces the need for a default pool in all cases, while an iRule cannot select a pool.
  3. A local traffic policy operates only on UDP traffic, while an iRule operates only on TCP traffic.
  4. A local traffic policy requires Tcl scripting, while an iRule is configured only through the GUI.

Explanation

Local traffic policies provide a structured, GUI-driven way to define conditions and actions such as pool selection. iRules provide programmatic control using Tcl. Both can influence traffic handling, but their configuration models and flexibility differ.

Question 43Application Delivery Fundamentals

An administrator wants to ensure that a virtual server accepts connections only from clients on the 192.168.0.0/16 network. Which approach is appropriate?

  1. Apply a packet filter or an iRule that checks the client address in CLIENT_ACCEPTED and drops other connections. Correct answer.
  2. Attach a cookie persistence profile with a 192.168.0.0/16 match.
  3. Configure a SNAT pool with addresses from 192.168.0.0/16.
  4. Set the pool's load balancing method to least connections.

Explanation

Restricting clients by source network requires filtering on the client address, which can be done with a packet filter or an iRule that inspects the client IP. Persistence profiles, SNAT pools, and load balancing methods do not restrict which clients may connect.

Question 44Application Delivery Fundamentals

A pool contains two members with equal priority, and the least connections method is in use. Member A has 5 active connections and member B has 2. Which member receives the next new connection, and why?

  1. Member A, because equal priority causes selection to alternate regardless of connection counts.
  2. Member B, because least connections selects the available member with the fewest active connections. Correct answer.
  3. Member A, because it has handled more total connections and is therefore preferred.
  4. Neither member, because least connections requires at least three members.

Explanation

Least connections chooses the available member currently holding the fewest active connections. With 2 versus 5, member B is selected for the next connection. Equal priority does not force alternating selection, and the method works with any number of members.

Question 45Application Delivery Fundamentals

An administrator wants a virtual server to return an HTTP redirect to a maintenance page for all requests while backend work is performed, without disabling the virtual server. Which approach is most direct?

  1. Change the pool's load balancing method to round robin.
  2. Configure an iRule that sends an HTTP redirect in HTTP_REQUEST. Correct answer.
  3. Set the virtual server's source address translation to None.
  4. Remove all pool members from the default pool.

Explanation

An iRule can issue an HTTP redirect response in HTTP_REQUEST before any pool selection occurs, keeping the listener enabled. Removing members would cause failures rather than a controlled redirect. Source translation and load balancing methods do not generate redirect responses.

Question 46Application Delivery Fundamentals

A virtual server has an HTTP profile and a client SSL profile. A client connects over HTTPS and sends a request whose Host header is app.example.com. At which point can an iRule first read the HTTP Host header?

  1. In CLIENT_ACCEPTED, before TLS negotiation begins
  2. In HTTP_REQUEST, after TLS is terminated and the HTTP request is parsed Correct answer.
  3. In LB_SELECTED, before the request is parsed
  4. In SERVER_CONNECTED, after the connection to the member is established

Explanation

The Host header exists only after the HTTP request has been decrypted and parsed, which occurs at HTTP_REQUEST. CLIENT_ACCEPTED precedes TLS negotiation and request parsing. SERVER_CONNECTED and LB_SELECTED occur at other stages and do not guarantee parsed HTTP data.

Question 47Application Delivery Fundamentals

An administrator configures a virtual server with a UDP profile but attaches an iRule that uses HTTP_REQUEST. What is the likely outcome?

  1. The iRule converts the UDP traffic into HTTP requests automatically.
  2. The HTTP_REQUEST event fires for each UDP datagram with an empty URI.
  3. The virtual server refuses all UDP traffic until the iRule is removed.
  4. The HTTP_REQUEST event never fires because the traffic is not HTTP, so the rule's HTTP logic has no effect. Correct answer.

Explanation

HTTP events are triggered only when HTTP traffic is processed with the appropriate HTTP profile. UDP traffic does not produce HTTP requests, so HTTP_REQUEST logic is not executed. The iRule does not transform protocols or block traffic merely because it contains HTTP-specific code.

Question 48Application Delivery Fundamentals

A pool member's monitor is configured with a receive string that must appear in the response. The member returns a valid TCP response that does not contain the string. What is the resulting member state?

  1. The member is marked down because the response did not satisfy the receive string requirement. Correct answer.
  2. The member is placed in a forced offline state that requires manual intervention.
  3. The member is marked up but excluded from persistence.
  4. The member remains up because any TCP response satisfies the monitor.

Explanation

When a monitor defines a receive string, the response must contain that string for the probe to succeed. A response lacking the string fails the check and the member is marked down. A plain TCP response is insufficient when the monitor expects application-layer content.

Question 49Application Delivery Fundamentals

An administrator needs requests for the same client session to reach the same member, but the client's source address changes frequently because it roams between networks. Which persistence method is most suitable?

  1. Destination IP persistence, because it keys on the pool member address
  2. Source IP persistence, because it keys on the client address regardless of network changes
  3. Cookie persistence, because affinity follows a token carried in HTTP requests rather than the client address Correct answer.
  4. A round robin load balancing method without persistence

Explanation

Cookie persistence identifies the session through a token in the HTTP request, so affinity survives changes in the client's source address. Source IP persistence would break when the address changes. Destination IP persistence keys on the server side, and round robin provides no affinity at all.

Question 50Application Delivery Fundamentals

A virtual server uses a one-connect profile. Which behavior does this configuration produce?

  1. The BIG-IP limits each client to one simultaneous connection to the virtual server.
  2. The BIG-IP reuses a single connection between the client and a pool member for multiple requests, reducing connection setup overhead. Correct answer.
  3. The BIG-IP maintains one persistent connection to the pool member regardless of client activity.
  4. The BIG-IP opens one connection to every pool member for each client request.

Explanation

A one-connect profile allows multiple client requests to share an established connection to a member, avoiding repeated connection setup. It does not cap the number of client connections or open connections to every member. The reuse is tied to active client traffic rather than an indefinite idle connection.