I85PREP
⌘ K
F5-402 study materials
F5-402 study resources

F5-402 practice questions

One question at a time. Build your F5-402 understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1F5 cloud architecture, declarations and operational control

According to NIST SP 800-145, which of the five essential cloud characteristics describes the ability of a tenant to unilaterally provision compute, storage, and network capacity automatically without human interaction with the provider?

  1. Broad network access
  2. On-demand self-service Correct answer.
  3. Rapid elasticity
  4. Measured service

Explanation

On-demand self-service concerns provisioning relevant computing capabilities without requiring human interaction with the provider for each operation. Broad access and elasticity address other characteristics. Measured service concerns appropriate metering, control and reporting; it does not universally require consumption-based billing for every service.

Question 2F5 cloud architecture, declarations and operational control

A customer wants the cloud provider to manage the operating system, middleware, and runtime, but still wants to deploy and manage their own application code. Which NIST 800-145 cloud service model best fits this requirement?

  1. IaaS
  2. PaaS Correct answer.
  3. SaaS
  4. FaaS

Explanation

In NIST 800-145, Platform as a Service (PaaS) gives the consumer the capability to deploy onto the cloud infrastructure consumer-created or acquired applications using programming languages, libraries, services, and tools supported by the provider. The provider manages the underlying network, servers, OS, and storage; the consumer controls the deployed applications and possibly configuration settings.

Question 3F5 cloud architecture, declarations and operational control

Which NIST 800-145 deployment model describes infrastructure shared by several organizations supporting a specific community with shared concerns such as mission, security requirements, and compliance considerations?

  1. Public cloud
  2. Private cloud
  3. Community cloud Correct answer.
  4. Hybrid cloud

Explanation

NIST 800-145 lists four deployment models: private, community, public, and hybrid. The community cloud is provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns. It may be owned, managed, and operated by one or more of the organizations in the community, a third party, or some combination.

Question 4F5 cloud architecture, declarations and operational control

An architect needs the BIG-IP Virtual Edition (VE) to span multiple AWS Availability Zones for high availability. Which F5 component is specifically designed to handle the cross-AZ failover by manipulating AWS API constructs (route tables, EIPs, ENI secondary addresses)?

  1. BIG-IP DNS Sync Group
  2. F5 Cloud Failover Extension (CFE) Correct answer.
  3. F5 Telemetry Streaming
  4. F5 iApp v1 Templates

Explanation

F5 Cloud Failover Extension (CFE) is the iControl LX extension that performs cloud-aware failover for BIG-IP VE in AWS, Azure, and GCP. On failover it updates AWS route table entries, reassigns Elastic IP addresses, and moves secondary IPs across ENIs so traffic redirects from the failed unit to the healthy peer. Traditional gratuitous-ARP-based failover does not work across cloud subnets.

Question 5F5 cloud architecture, declarations and operational control

A BIG-IP VE is being launched on AWS. Which licensing model bundles the F5 software cost into an hourly EC2 instance price billed by AWS?

  1. BYOL (Bring Your Own License)
  2. Hourly / PAYG (Pay-As-You-Go) from the AWS Marketplace Correct answer.
  3. Volume Subscription License
  4. ELA Enterprise License Agreement

Explanation

On the AWS Marketplace, F5 BIG-IP VE is offered with both BYOL and Hourly / PAYG (Pay-As-You-Go) license models. PAYG bundles the F5 license cost into the hourly EC2 charge, so the customer is billed by AWS and no separate F5 license token is required. BYOL requires a registration key purchased from F5 to be applied to the running VE.

Question 6F5 cloud architecture, declarations and operational control

Which AWS construct provides the Layer 2-equivalent network attachment for a BIG-IP VE so it can present management and data interfaces with discrete IP addresses and security groups?

  1. IAM role
  2. Elastic Network Interface (ENI) Correct answer.
  3. S3 bucket
  4. Route 53 hosted zone

Explanation

In AWS, each network attachment for an EC2 instance is an Elastic Network Interface (ENI). BIG-IP VE typically has multiple ENIs - one for management, one or more for data plane (external/internal/HA) - each in its own subnet with its own security group. Cloud Failover Extension manipulates secondary IP addresses on ENIs during failover.

Question 7F5 cloud architecture, declarations and operational control

In an AWS sandwich design pattern, what is the BIG-IP VE positioned BETWEEN?

  1. Two regions
  2. An external (front-end) load balancer (such as an AWS NLB or ELB) and a back-end pool of application servers Correct answer.
  3. Two AWS accounts
  4. A VPN gateway and a NAT gateway

Explanation

The sandwich design places BIG-IP VEs between a cloud-native L4 load balancer (commonly the AWS Network Load Balancer in front for AZ-aware ingress and stateless distribution) and the back-end application servers. The cloud LB distributes flows to a fleet of BIG-IP VEs, and each VE applies the advanced ADC services (WAF, persistence, iRules, SSL) before sending to the application pool.

Question 8F5 cloud architecture, declarations and operational control

Which AWS service is most commonly used to template a complete BIG-IP VE deployment (VPC, subnets, route tables, BIG-IP instances, IAM roles) as code?

  1. AWS Config
  2. AWS CloudFormation Correct answer.
  3. AWS Trusted Advisor
  4. AWS Backup

Explanation

F5 publishes maintained AWS CloudFormation templates that build standalone, HA pair, and Auto Scale BIG-IP VE topologies. CloudFormation declaratively provisions the VPC, subnets, route tables, BIG-IP instances, IAM roles, and the AS3/DO/CFE bootstrap. AWS Config monitors compliance, Trusted Advisor advises on best practices, and AWS Backup handles backups - none deploy infrastructure as code.

Question 9F5 cloud architecture, declarations and operational control

Which AWS-native HA mechanism does NOT work for BIG-IP VE failover across Availability Zones?

  1. F5 Cloud Failover Extension that moves EIPs and updates route tables
  2. Standard gratuitous ARP on a shared Layer 2 VLAN between active and standby Correct answer.
  3. Across-network failover using AWS API calls
  4. DNS-based failover with BIG-IP DNS / Route 53

Explanation

AWS subnets are Layer 3 constructs, and Availability Zones do not share a Layer 2 broadcast domain. Gratuitous ARP cannot cross the AZ boundary, so traditional GARP-based BIG-IP failover does not work in AWS. CFE addresses this by using AWS API calls (route table updates, EIP reassignment, ENI secondary IP moves) to redirect traffic. DNS-based failover via BIG-IP DNS or Route 53 is also valid.

Question 10F5 cloud architecture, declarations and operational control

A customer plans to deploy BIG-IP VE in Microsoft Azure with HA across Availability Zones. Which Azure resource is typically used in front of an Active/Active BIG-IP VE pair to provide AZ-aware fronting and a single zone-redundant frontend IP?

  1. Azure Application Gateway
  2. Azure Standard Load Balancer (Standard SKU, zone-redundant) Correct answer.
  3. Azure Front Door
  4. Azure ExpressRoute

Explanation

F5's reference architecture for BIG-IP VE in Azure recommends fronting the BIG-IP cluster with the Azure Standard Load Balancer (Standard SKU) configured with a zone-redundant frontend IP. The Standard LB provides AZ awareness and stateless L4 distribution to BIG-IP VEs deployed in different Availability Zones. Azure Application Gateway and Front Door are full Layer 7 services and would conflict with BIG-IP advanced ADC services.

Question 11F5 cloud architecture, declarations and operational control

Which Azure mechanism is the equivalent of AWS CloudFormation and is used to deploy BIG-IP VE as code?

  1. Azure Resource Manager (ARM) templates Correct answer.
  2. Azure DevTest Labs
  3. Azure Policy
  4. Azure Bicep is not supported by F5

Explanation

Azure Resource Manager (ARM) templates are the declarative IaC format for Azure, and F5 publishes maintained ARM templates for standalone, Active/Standby, and Auto Scale BIG-IP VE deployments. Bicep templates compile to ARM and are also supported in newer F5 deployment patterns.

Question 12F5 cloud architecture, declarations and operational control

In Google Cloud Platform, which native service is most often used in front of a clustered BIG-IP VE deployment to provide internal Layer 4 distribution within a VPC?

  1. GCP Cloud Run
  2. GCP Internal TCP/UDP Load Balancer Correct answer.
  3. GCP Cloud DNS
  4. GCP Cloud Spanner

Explanation

In GCP, F5 reference architectures place the GCP Internal TCP/UDP Load Balancer in front of a BIG-IP VE cluster for internal HA fronting. The internal LB provides stateless L4 distribution to BIG-IP VEs in the same VPC and supports failover at the cloud-native layer. The BIG-IP VEs then deliver L7 ADC services to backend applications.

Question 13F5 cloud architecture, declarations and operational control

Which GCP service provides declarative deployment of BIG-IP VE infrastructure (VPCs, instances, IAM, firewall rules) similar to AWS CloudFormation and Azure ARM templates?

  1. Cloud Functions
  2. Cloud Deployment Manager (or Terraform) Correct answer.
  3. Cloud Spanner
  4. Cloud Composer

Explanation

Google Cloud Deployment Manager is GCP's native infrastructure-as-code service. F5 publishes Cloud Deployment Manager templates (alongside Terraform modules) for BIG-IP VE on GCP. Terraform is equally common for multi-cloud teams who prefer one IaC tool across AWS, Azure, and GCP.

Question 14F5 cloud architecture, declarations and operational control

A BIG-IP VE on AWS is deployed in an Auto Scaling Group (ASG) with a min of 2 and max of 8 instances. Which workflow ensures that newly launched BIG-IP instances come up fully configured for application delivery automatically?

  1. A human operator logs in to each new instance via SSH and runs tmsh
  2. User-data bootstraps DO (Declarative Onboarding) for system config and AS3 (Application Services 3) for application configuration Correct answer.
  3. An iRule auto-deploys virtual servers
  4. CloudFront pushes config

Explanation

In an ASG-based BIG-IP VE deployment, EC2 user-data triggers the Cloud-Init bootstrap that downloads and runs Declarative Onboarding (DO) for initial system setup (licensing, hostname, NTP, DNS, provisioning) and Application Services 3 (AS3) declarations for the application configuration (virtual servers, pools, profiles, monitors, WAF policies). This is fully unattended and is required for correct horizontal scaling.

Question 15F5 cloud architecture, declarations and operational control

In a hybrid cloud design, which architectural decision specifically reduces the risk of split-brain in a BIG-IP DNS (formerly GTM) deployment that spans on-premises and a public cloud region?

  1. Disabling iQuery
  2. Configuring multiple BIG-IP DNS sync group members across both sites with stable iQuery TCP 4353 connectivity and clock sync via NTP Correct answer.
  3. Using only one DNS server in cloud
  4. Disabling persistence

Explanation

BIG-IP DNS members exchange status, metrics, and probes via iQuery on TCP port 4353. Stable iQuery between all sync-group members, plus tightly synchronized clocks (NTP), keeps the global picture consistent and avoids split-brain decisions where each site believes it owns the entire view. Firewalls in hybrid topologies must permit TCP 4353.

Question 16F5 cloud architecture, declarations and operational control

Which F5 product family was previously known as Volterra and now provides multi-cloud networking, app delivery, WAAP (Web Application and API Protection), DDoS, bot, and API security as a SaaS?

  1. F5 BIG-IQ
  2. F5 Distributed Cloud Services (XC) Correct answer.
  3. F5 NGINX Plus
  4. F5 BIG-IP iSeries

Explanation

F5 Distributed Cloud Services (often called XC) is the rebrand of the Volterra acquisition. It is a SaaS platform offering multi-cloud networking (Customer Edge / Regional Edge), Web App and API Protection (WAAP), DDoS, Bot Defense, API discovery, and CDN, with a single console and unified policy across clouds and edges.

Question 17F5 cloud architecture, declarations and operational control

Which two locations does F5 Distributed Cloud Services use for its data plane: a customer-deployed site in their cloud or DC, and an F5-operated global PoP?

  1. Customer Edge (CE) and Regional Edge (RE) Correct answer.
  2. Hub and spoke
  3. Sync and standby
  4. TMM and MCPD

Explanation

In F5 Distributed Cloud Services, a Customer Edge (CE) is a software node deployed in the customer's environment (cloud VPC, on-prem, edge) under F5's control plane. A Regional Edge (RE) is an F5-operated global PoP. Together they form the multi-cloud fabric: CEs handle local app delivery and connectivity, REs handle global ingress, WAAP, and CDN.

Question 18F5 cloud architecture, declarations and operational control

Which deployment model places workloads on infrastructure that is operated solely for a single organization, possibly hosted on-premises or by a third party, and managed by either party?

  1. Public cloud
  2. Private cloud Correct answer.
  3. Community cloud
  4. Hybrid cloud

Explanation

NIST 800-145 defines a private cloud as cloud infrastructure provisioned for exclusive use by a single organization. It may be owned, managed, and operated by the organization, a third party, or some combination, and may exist on or off premises. The exclusivity of consumers - one organization - is what distinguishes it from a community cloud (multiple organizations) or a public cloud (general public).

Question 19F5 cloud architecture, declarations and operational control

An architect must design a hybrid cloud where some workloads burst from on-premises to AWS during peak hours. Which property MOST directly enables 'cloud bursting' under NIST 800-145?

  1. Resource pooling
  2. Rapid elasticity Correct answer.
  3. Multi-tenancy
  4. Measured service

Explanation

Rapid elasticity is the NIST characteristic that lets capabilities be provisioned and released, in some cases automatically, to scale rapidly outward and inward commensurate with demand. To the consumer, the capabilities available for provisioning often appear unlimited and can be appropriated in any quantity at any time - this is the foundation of cloud-burst patterns.

Question 20F5 cloud architecture, declarations and operational control

Which AWS deployment pattern places the BIG-IP VE at the edge of the VPC as the single ingress device that terminates TLS, applies WAF, and forwards to internal applications?

  1. Edge ADC pattern Correct answer.
  2. Sandwich pattern
  3. Hub-and-spoke transit pattern
  4. Side-car pattern

Explanation

In the Edge ADC pattern, the BIG-IP VE sits at the VPC edge (typically with an Elastic IP or behind an AWS NLB in the public subnet). All inbound traffic terminates TLS at the BIG-IP, passes through WAF and other ADC services, and is forwarded to private applications inside the VPC. The Sandwich pattern places BIG-IPs between two LBs, while the transit/gateway pattern is for inter-VPC routing.

Question 21F5 cloud architecture, declarations and operational control

Which AWS pattern uses the BIG-IP VE as a Layer 3 inspection or routing element on a shared services / transit VPC, with traffic from spoke VPCs steered through it via Transit Gateway and route tables?

  1. Edge ADC
  2. Sidecar
  3. Gateway / VPC inspection Correct answer.
  4. Single-tier

Explanation

In the Gateway pattern, BIG-IP VE deploys in a transit / shared-services VPC behind AWS Transit Gateway. Spoke VPC route tables direct east-west or north-south traffic through the BIG-IP, which performs inspection, security, or routing services for many tenants. This is common when BIG-IP is used as the central security choke point in multi-VPC architectures.

Question 22F5 cloud architecture, declarations and operational control

Which Azure HA construct allows two BIG-IP VEs to be placed in different physically separate datacenters within the same region, providing protection from datacenter-level failure?

  1. Availability Set
  2. Availability Zone Correct answer.
  3. Proximity Placement Group
  4. Resource Group

Explanation

Availability Zones are physically separate datacenters within the same Azure region with independent power, cooling, and networking. Placing BIG-IP VEs in different AZs (typically AZ 1 and AZ 2) protects against datacenter-level failure. Availability Sets only protect against rack-level failure within a single datacenter, and Proximity Placement Groups colocate workloads for low latency.

Question 23F5 cloud architecture, declarations and operational control

In a multi-cloud BIG-IP VE deployment, which design principle BEST minimizes vendor lock-in for the configuration of application delivery services?

  1. Configure each BIG-IP via the GUI
  2. Use AS3 declarations stored in version control to define application services so the same JSON can deploy to any BIG-IP regardless of cloud Correct answer.
  3. Hardcode IPs into iRules
  4. Use only PAYG licensing

Explanation

AS3 (Application Services 3) is a declarative JSON model maintained in version control. Because the AS3 declaration describes what application services are needed (virtual servers, pools, profiles, WAF) without imperative cloud-specific steps, the same declaration can be applied to BIG-IP VE in AWS, Azure, GCP, or on-premises. This avoids cloud-specific configuration drift and reduces vendor lock-in.

Question 24F5 cloud architecture, declarations and operational control

A customer's compliance policy requires that all data and processing remain in the EU. Which cloud architecture decision MOST directly addresses this requirement?

  1. Use a global CDN with a default-route to the closest PoP
  2. Deploy in EU regions only and configure data-residency controls (e.g., AWS S3 Object Lock with EU-only buckets, Azure regional storage, GCP regional resources) and route applications through F5 Distributed Cloud sites tagged for EU Correct answer.
  3. Encrypt with TLS 1.3
  4. Use SNAT pools

Explanation

Data residency requirements are addressed at the regional placement layer: choose only EU regions, configure cloud-native data-residency controls, and constrain F5 Distributed Cloud sites to EU presences. TLS 1.3 protects data in transit but does nothing about residency. SNAT and CDN PoP selection are unrelated to where data is stored or processed.

Question 25F5 cloud architecture, declarations and operational control

F5 Distributed Cloud's App Stack capability provides which of the following on Customer Edge sites?

  1. A managed Kubernetes runtime to host containerized workloads at the edge alongside L7 app delivery and security Correct answer.
  2. A new Linux distribution
  3. Replacement for AWS Lambda
  4. A traditional iSeries appliance

Explanation

F5 Distributed Cloud App Stack is a managed Kubernetes runtime that runs on Customer Edge sites. It allows customers to deploy containerized workloads next to F5's L7 ADC, WAAP, and multi-cloud networking - effectively bringing app and infrastructure together at the edge with a single F5-managed control plane.

Question 26BIG-IP LTM listeners, persistence and TLS boundaries

Which BIG-IP DNS (formerly GTM) construct is the FQDN endpoint that customers query, mapping to one or more pools of distributed application servers across data centers?

  1. Listener
  2. Wide IP Correct answer.
  3. Persistence record
  4. Self-IP

Explanation

A Wide IP associates the relevant DNS name/record type with configured DNS pools and selection behavior in the stated BIG-IP model. Returned answers can be cached, and later application connections depend on resolver/client behavior and endpoint state. DNS selection does not itself proxy the resulting application session.

Question 27BIG-IP LTM listeners, persistence and TLS boundaries

On BIG-IP DNS, which object accepts inbound DNS queries on a specified IP and port?

  1. Wide IP
  2. DNS Listener Correct answer.
  3. Server
  4. Data Center

Explanation

A DNS Listener is the BIG-IP DNS object that binds to an IP address and port (typically UDP/TCP 53) and accepts incoming DNS queries. The Listener references DNS profiles and is the entry point that drives Wide IP resolution. Without a Listener, BIG-IP DNS will not respond to queries on that IP.

Question 28BIG-IP LTM listeners, persistence and TLS boundaries

A customer wants BIG-IP DNS to direct users to the closest data center based on the source IP's geographic origin (continent or country). Which load-balancing method should be used?

  1. Round Robin
  2. Topology (with topology records based on geolocation) Correct answer.
  3. Ratio
  4. Static Persist

Explanation

Topology load-balancing uses topology records to map source LDNS attributes (subnet, region, country, continent) to preferred destination pool members. Combined with the F5 IP geolocation database, it directs users to the geographically closest or compliance-appropriate data center. Round Robin and Ratio do not consider geography; Static Persist locks a source to a single destination.

Question 29BIG-IP LTM listeners, persistence and TLS boundaries

Which BIG-IP DNS feature provides high-performance, in-memory DNS caching that responds to queries without sending them to back-end DNS servers when an answer is already in cache?

  1. DNSSEC
  2. DNS Express Correct answer.
  3. RPZ
  4. DNS64

Explanation

DNS Express on BIG-IP DNS is a high-performance authoritative caching layer that holds zone data in memory and answers queries directly without forwarding to back-end name servers. It dramatically increases query throughput and reduces latency. DNSSEC adds signing, RPZ implements policy zones, and DNS64 translates AAAA-to-A for IPv6/IPv4 transition.

Question 30BIG-IP LTM listeners, persistence and TLS boundaries

Which DNS security feature signs DNS records with cryptographic keys so that resolvers can validate that responses are authentic and have not been tampered with in transit?

  1. DNSSEC Correct answer.
  2. DNS Express
  3. DNS64
  4. Topology load balancing

Explanation

DNSSEC (DNS Security Extensions) signs zones with public/private key pairs (KSK and ZSK). Resolvers validate the chain of trust to verify authenticity and integrity of DNS responses. BIG-IP DNS supports on-the-fly signing for zones it serves authoritatively, integrating with HSMs or built-in key management.

Question 31BIG-IP LTM listeners, persistence and TLS boundaries

Which BIG-IP DNS monitor type runs an arbitrary external script to determine the health of a virtual server or pool member, useful when no built-in protocol monitor matches an application's health-check needs?

  1. BIG-IP
  2. HTTP
  3. External (EAV) Correct answer.
  4. NTP

Explanation

The External monitor (EAV - External Application Verification) runs a customer-supplied script (shell, Perl, Python) at each interval. Whatever the script outputs (typically 'up' on success) determines the member's status. It is the universal escape hatch for health checks that the built-in HTTP, HTTPS, FTP, NTP, BIG-IP, and other monitors cannot perform.

Question 32BIG-IP LTM listeners, persistence and TLS boundaries

On BIG-IP LTM, which profile provides accelerated Layer 4 forwarding with the highest packets-per-second throughput, suitable for high-volume connection-oriented services that do not need L7 inspection?

  1. HTTP
  2. FastL4 Correct answer.
  3. Stream
  4. FastHTTP

Explanation

FastL4 is the accelerated L4 profile, often offloaded to ePVA hardware on appliances. It bypasses the full TMOS L7 stack and is the highest-PPS option. Use it for L4-only workloads such as DNS, SIP UDP forwarding, or simple TCP load balancing where HTTP, SSL, or OneConnect are not required.

Question 33BIG-IP LTM listeners, persistence and TLS boundaries

Which BIG-IP LTM profile is optimized for very high request-per-second HTTP workloads with minimal feature set (no full HTTP::header iRule support, no pipeline buffering), used when you need raw L7 throughput more than rich features?

  1. HTTP
  2. FastHTTP Correct answer.
  3. TCP-LAN
  4. Stream

Explanation

FastHTTP is a stripped-down HTTP profile designed for very high request rates. It supports the most common HTTP load-balancing features but trims more advanced options (advanced iRule HTTP commands, pipelining, certain header rewriting) to maximize throughput. Use FastHTTP for stateless, high-RPS workloads where the standard HTTP profile's feature set is unnecessary.

Question 34BIG-IP LTM listeners, persistence and TLS boundaries

Which BIG-IP feature multiplexes multiple client HTTP requests over a small pool of persistent server-side TCP connections, dramatically reducing connection load on backend servers?

  1. Compression
  2. OneConnect Correct answer.
  3. SNAT
  4. RAM Cache

Explanation

OneConnect maintains a pool of established TCP connections to backend pool members and multiplexes HTTP requests from many clients across them. It requires an HTTP profile so the BIG-IP can parse request boundaries. The Source Mask determines which clients can share connections (e.g., /0 = any client, /32 = same IP only).

Question 35BIG-IP LTM listeners, persistence and TLS boundaries

Which BIG-IP feature stores response objects in memory and serves them directly without contacting the origin, reducing origin load and improving response time?

  1. RAM Cache (Web Acceleration / HTTP cache) Correct answer.
  2. Connection mirroring
  3. Persistence
  4. Hash load balancing

Explanation

BIG-IP RAM Cache (sometimes called the Web Acceleration profile or HTTP cache) stores cacheable HTTP response objects in memory based on standard cache-control rules. Subsequent matching requests are served directly from the BIG-IP, reducing origin load and lowering client latency. It is configured via a Web Acceleration profile bound to the virtual server.

Question 36BIG-IP LTM listeners, persistence and TLS boundaries

For a global SaaS application with users in multiple continents, which combination of F5 services provides global traffic steering AND local L7 application delivery with WAAP?

  1. BIG-IP DNS for global topology load balancing PLUS F5 Distributed Cloud (or BIG-IP VE) at each region for local L7 + WAAP Correct answer.
  2. Only BIG-IP LTM at one site
  3. Only iRules
  4. Only SNAT pools

Explanation

BIG-IP DNS resolves the global FQDN to the geographically appropriate region using topology load balancing. Within each region, F5 Distributed Cloud (or BIG-IP VE) handles local L7 application delivery, persistence, SSL, and WAAP. This two-tier model combines global steering with local rich services.

Question 37BIG-IP LTM listeners, persistence and TLS boundaries

Which BIG-IP TCP profile is appropriate for the client side of a virtual server where clients connect from high-latency, lossy networks such as mobile carriers across the globe?

  1. tcp-lan-optimized
  2. tcp-wan-optimized (or tcp-mobile-optimized) Correct answer.
  3. FastL4
  4. Stream

Explanation

WAN-optimized (or mobile-optimized) TCP profiles use larger initial congestion windows, larger receive windows, selective acknowledgements, and congestion control tuned for high-latency, lossy paths. Apply such a profile to the client side of a dual-TCP-profile virtual server. tcp-lan-optimized is for the server side or low-latency LAN segments.

Question 38BIG-IP LTM listeners, persistence and TLS boundaries

Which Wide IP load-balancing method on BIG-IP DNS is BEST when you need to send the FIRST available pool member traffic and only fail over if it becomes unavailable (active/standby data centers)?

  1. Round Robin
  2. Global Availability Correct answer.
  3. Ratio
  4. Topology

Explanation

Global Availability sends all traffic to the first available pool member in the configured order. Only when that member's monitor reports it down does it move to the next. This is the canonical active/standby DC pattern: primary site receives 100% of traffic, secondary takes over only on failure.

Question 39BIG-IP LTM listeners, persistence and TLS boundaries

Which BIG-IP DNS persistence type ensures the same source LDNS continues to receive the same pool member answer for the duration of a configurable timeout?

  1. Cookie persistence
  2. Source-address persistence (Persist Across Wide IPs) Correct answer.
  3. SSL Session ID
  4. Universal

Explanation

BIG-IP DNS supports source-address-based persistence so that answers to the same LDNS (or LDNS subnet) remain consistent for the persist timeout. This avoids users bouncing between datacenters between successive lookups in short-lived sessions. DNS does not support HTTP cookie or SSL session ID persistence at the resolution layer.

Question 40BIG-IP LTM listeners, persistence and TLS boundaries

Which BIG-IP DNS object groups physical sites and lets the administrator declare that virtual servers within it share location attributes (used by Topology and probe configuration)?

  1. Wide IP
  2. Pool
  3. Data Center Correct answer.
  4. Listener

Explanation

A Data Center object in BIG-IP DNS represents a physical or logical site. BIG-IP Servers (LTM devices and generic hosts) and their virtual servers are associated with Data Centers, which are then referenced by Topology records and Path metrics. This is how BIG-IP DNS knows which members belong to which site.

Question 41BIG-IP LTM listeners, persistence and TLS boundaries

An iRule on BIG-IP LTM rewrites HTTP traffic from /api/v1 to /v1 transparently to the client. Which iRule event is the correct place to perform this URI rewrite?

  1. CLIENT_ACCEPTED
  2. HTTP_REQUEST Correct answer.
  3. SERVER_CONNECTED
  4. HTTP_RESPONSE

Explanation

HTTP_REQUEST fires after the BIG-IP has parsed the client's HTTP request line and headers but before forwarding to the pool member. Use HTTP::uri or HTTP::path with regsub there to rewrite the URI before it reaches the back end. CLIENT_ACCEPTED fires before HTTP parsing, and HTTP_RESPONSE is too late to influence the request.

Question 42BIG-IP LTM listeners, persistence and TLS boundaries

A SaaS app uses HTTP/2 between clients and the BIG-IP, but legacy back-ends only support HTTP/1.1. What BIG-IP feature should be configured?

  1. FastL4 only
  2. HTTP/2 profile on the client side and a standard HTTP profile on the server side, allowing BIG-IP to terminate H2 and translate to H1 toward the pool Correct answer.
  3. Stream profile
  4. Disable HTTP

Explanation

BIG-IP can terminate HTTP/2 client-side (using the HTTP/2 profile on the virtual server) and translate to HTTP/1.1 toward back-end servers. This brings modern client benefits (header compression, multiplexing, fewer connections) while preserving compatibility with legacy origins. The HTTP/2 profile is layered on top of the HTTP profile; both are required.

Question 43BIG-IP LTM listeners, persistence and TLS boundaries

Which feature should be enabled on a BIG-IP virtual server when multiple cloud-native L4 load balancers (such as AWS NLB) sit in front of it, and you need the back end to see the original client IP at L3?

  1. X-Forwarded-For HTTP header insertion only
  2. Proxy Protocol (TCP) so the original source IP is carried in a Proxy Protocol header on the connection Correct answer.
  3. Stream profile
  4. UDP profile

Explanation

AWS NLB and many modern L4 LBs support Proxy Protocol, which prepends a small text header to each TCP connection containing the original client source/destination tuple. BIG-IP can be configured to read Proxy Protocol so back-end services or iRules can identify the true source. X-Forwarded-For is HTTP-only and does not work for non-HTTP services.

Question 44BIG-IP LTM listeners, persistence and TLS boundaries

In F5 Distributed Cloud, which object represents an application's Layer 7 endpoint that is published, secured, and served by the platform?

  1. HTTP Load Balancer (HTTPS LB) Correct answer.
  2. Site
  3. Origin Pool
  4. Routes

Explanation

In F5 XC, an HTTP Load Balancer (or HTTPS LB) is the L7 endpoint object: it defines domains, certificates, advertise policy (where it is exposed - public REs, private CEs), an Origin Pool, route rules, and security policies (WAAP, Bot, DDoS, API). This is the primary unit for publishing an application.

Question 45BIG-IP LTM listeners, persistence and TLS boundaries

Which F5 Distributed Cloud capability provides global content caching at Regional Edges to reduce origin load and lower latency for end users?

  1. F5 XC CDN Correct answer.
  2. BIG-IQ Centralized Manager
  3. BIG-IP iRules LX
  4. NGINX Open Source

Explanation

F5 Distributed Cloud CDN delivers cached content from F5's global Regional Edge PoPs, reducing origin egress and lowering latency. It is integrated with the F5 XC console alongside L7 LB, WAAP, Bot, and DDoS, allowing a single policy and observability surface across delivery and security.

Question 46BIG-IP application security, access and DNS decisions

Which listed F5 application-security offering provides supported Layer 7 WAF functions and is associated with the BIG-IP ASM application-security heritage, while actual feature/licensing distinctions remain version-dependent?

  1. BIG-IP Advanced WAF Correct answer.
  2. BIG-IP DNS
  3. BIG-IP APM
  4. BIG-IP AFM

Explanation

BIG-IP Advanced WAF is the application-layer protection offering among these choices. It is related to ASM’s application-security heritage, but exact feature coverage, compatibility, automation support and licensing depend on version and deployment. Enabling a WAF does not guarantee every listed attack is blocked.

Question 47BIG-IP application security, access and DNS decisions

Which F5 SaaS service provides Web App and API Protection (WAAP), Bot Defense, DDoS, and API discovery without the customer needing to deploy their own BIG-IP?

  1. F5 Distributed Cloud WAAP (XC WAAP) Correct answer.
  2. F5 BIG-IP iSeries
  3. F5 NGINX Open Source
  4. F5 BIG-IQ

Explanation

F5 Distributed Cloud WAAP is the SaaS WAAP offering on the F5 XC platform. It bundles WAF, Bot Defense, DDoS, and API security with a SaaS control plane, requiring no customer-managed BIG-IP. Customers connect their applications via XC HTTP LB and traffic is inspected at F5 Regional Edges or Customer Edges.

Question 48BIG-IP application security, access and DNS decisions

In an AS3 declaration that includes a WAF policy, which attribute references the WAF policy by URL or by a deployed policy name on BIG-IP?

  1. WAF_Policy class Correct answer.
  2. virtualServer class only
  3. Pool class
  4. Persist class

Explanation

AS3 includes a WAF_Policy class that references either a URL where a WAF policy XML/JSON file is hosted (which AS3 will fetch and import) or a deployed policy name on the BIG-IP. The WAF_Policy is then attached to a Service_HTTP or Service_HTTPS virtual server via the policyWAF property.

Question 49BIG-IP application security, access and DNS decisions

A customer needs to terminate TLS at BIG-IP VE in AWS using a publicly trusted certificate. Which AWS-native service is most commonly integrated with BIG-IP for storing and rotating these certificates?

  1. AWS S3
  2. AWS Certificate Manager (ACM) with private CA, OR third-party / ACME-issued certificates imported to BIG-IP Correct answer.
  3. AWS Lambda
  4. AWS ECS

Explanation

BIG-IP itself stores certificates locally; the public certificates are typically issued by AWS Certificate Manager (when using ACM Private CA) or by Let's Encrypt / a commercial CA via ACME. The certificate and private key are then imported (or rotated) onto BIG-IP and referenced by a Client SSL profile. ACM cannot be directly attached to BIG-IP - the cert must be exportable and imported.

Question 50BIG-IP application security, access and DNS decisions

Which protocol does BIG-IP and F5 Distributed Cloud use to automate certificate issuance and renewal from CAs such as Let's Encrypt?

  1. SCEP
  2. ACME (RFC 8555) Correct answer.
  3. SNMP
  4. TFTP

Explanation

ACME (Automatic Certificate Management Environment, RFC 8555) is the protocol used by Let's Encrypt and many other CAs to automate certificate issuance and renewal. F5 supports ACME on BIG-IP (via add-ons or scripts) and natively in F5 Distributed Cloud, where certificates can be auto-issued and renewed for HTTP LB domains.