I85PREP
⌘ K
F5-CA study materials
F5-CA study resources

F5-CA: Solutions including Cloud and Security

F5-CA · Work through your exam, one topic at a time.

All guide sections

Solutions including Cloud and Security

This domain tests solution design across hybrid and multi-cloud estates with security woven through. You must place the right F5 component - BIG-IP, BIG-IP VE, NGINX, Distributed Cloud, Silverline - at the right point in the architecture and justify it against latency, compliance, cost, and operational ownership.

Core rules

  • BIG-IP VE runs in AWS, Azure, and GCP as BYOL or PAYG. VE is feature-rich, but throughput is licensed and hardware-dependent capabilities such as certain SSL acceleration and vCMP hosting do not map one-to-one from appliances.
  • F5 Distributed Cloud Services (XC) is a global edge and mesh platform: multi-cloud networking, WAAP, bot defense, API security, and site-to-site connectivity managed from a SaaS console. It is broader than a cloud WAF.
  • Silverline is F5's managed security service portfolio - DDoS, WAF, and related protections delivered as a service - useful when the customer lacks 24x7 security operations or needs volumetric scrubbing.
  • Layer the security architecture: volumetric DDoS (Silverline or scrubbing), perimeter WAAP (XC or Advanced WAF), access and zero trust (APM, XC), API protection, and SSL orchestration for inspection.
  • Global traffic management belongs at the DNS layer: BIG-IP DNS/GTM or XC global load balancing sends users to the healthy region, while local LTM or cloud load balancers distribute inside the region.

Worked example

A bank keeps core systems on-prem but is deploying a new mobile API in Azure. Requirements are DDoS protection, API schema validation, global failover, and consistent policy with the on-prem WAF. Propose XC WAAP at the edge for API security and bot defense, BIG-IP DNS on-prem for GSLB with health checks to both sites, BIG-IP VE in Azure for local LTM and mutual TLS, and Silverline for volumetric scrubbing. The reasoning: security policy stays centralized in XC, latency stays local, and the on-prem BIG-IP keeps protecting internal APIs without a rip-and-replace.

Traps that cost marks

Assuming every BIG-IP module behaves identically in VE; ignoring cloud egress and cross-zone data charges; treating Silverline as a replacement for on-prem policy; designing multi-region without global DNS; and forgetting that TLS inspection and API security often require separate policy decisions.