F5-304 study plan

Diagram the full request path from client DNS resolution through BIG-IP virtual server, pool member selection, and response, labeling each LTM object involved

Explain the difference between a virtual server, a pool, a pool member, a node, and a monitor, and state which object owns health status

Describe how a standard vs. performance L4 virtual server differs in packet handling and when each is appropriate

Compare oneconnect, NTLM, and source-address affinity in terms of what state each preserves and its failure mode

Configure a virtual server with a two-member pool and a health monitor on a lab or simulator, then capture the resulting configuration objects

Distinguish load-balancing methods (round robin, least connections, observed, ratio, fastest, predictive) and state the traffic pattern each suits

Explain persistence profiles and predict which member a repeated client is sent to under cookie, source-address, and SSL persistence

Interpret the fields of a virtual server statistics output: current connections, total connections, bits in/out, and request counts

Write and validate iRules that inspect an HTTP header, redirect based on URI, and select a pool by hostname

Explain the event lifecycle (CLIENT_ACCEPTED, HTTP_REQUEST, LB_SELECTED, HTTP_RESPONSE) and where a given iRule command is legal

Configure an SSL client profile and an SSL server profile on a virtual server and describe where decryption and re-encryption occur

Differentiate a forwarding virtual server, a network virtual server, and a SNAT configuration by the traffic each handles

Configure an HTTP health monitor with send and receive strings and explain how interval, timeout, and retries interact to mark a member down

Describe how a pool's availability status is computed from member and monitor status and predict the pool state when one of two members fails

Explain the role of an APM access policy in the connection flow and where it sits relative to the virtual server and pool

Distinguish an access profile, an access policy, and a connectivity profile by what each controls

Build an access policy with a logon page, an authentication agent against an external auth source, and a successful-result branch to a webtop or resource

Explain how an access session is established, what a session variable stores, and how session timeout and inactivity timeout differ

Describe how client certificate inspection and OCSP or CRL checking fit into an access policy

Explain the purpose of an APM network access resource and how it differs from a portal access resource

Configure an LTM and an AFM or ASM policy element that restricts traffic to a defined set of source addresses, and verify enforcement

Explain how a security policy or firewall rule is evaluated in order and predict the outcome for a packet matching multiple rules

Identify the log and event sources that record denied connections and authentication failures, and state which log answers which question

Describe the difference between a network firewall rule, an LTM iRule-based block, and an ASM violation, including which layer each inspects

Use packet capture and tcpdump-style filtering on the BIG-IP to isolate whether a failure is client-side, on the virtual server, or at the pool member

Interpret a qkview or diagnostic report to locate configuration drift and service status

Trace a failed TLS handshake to the specific profile setting (cipher, protocol version, certificate chain) responsible

Explain how to read a pool member's monitor log and distinguish a timeout from a refused connection

Complete a timed 60-question mixed-domain practice set and record accuracy per domain

Re-teach the two weakest objectives from memory without notes, then verify against documentation

Re-run the week 4 and week 6 deliverables from scratch to confirm retention

Build a one-page formula and command sheet covering monitor math, persistence types, and diagnostic commands