I85PREP
⌘ K
F5-CSE study materials
F5-CSE study resources

F5-CSE practice questions

One question at a time. Build your F5-CSE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1F5 platform architecture, traffic processing, and troubleshooting

On a BIG-IP platform, which component is responsible for applying virtual server, pool, and iRule configuration to the data plane?

  1. httpd
  2. mcpd
  3. tmm Correct answer.
  4. bigd

Explanation

tmm is the Traffic Management Microkernel, the data-plane process that owns the fastL4 and full-proxy paths and actually matches traffic to virtual servers, selects pool members, and executes iRules. Control-plane daemons such as mcpd translate configuration but do not process packets themselves.

Question 2F5 platform architecture, traffic processing, and troubleshooting

A client connects to a standard TCP virtual server with a TCP profile. Which statement describes how the BIG-IP handles the client-side and server-side TCP connections?

  1. The client-side TCP handshake is passed through to the pool member so only one end-to-end connection exists.
  2. The client-side connection terminates at the BIG-IP, and a separate server-side connection is established to the pool member. Correct answer.
  3. The BIG-IP relies on the pool member to perform TCP termination and only routes IP packets between the two hosts.
  4. The BIG-IP forwards packets using layer 2 rewriting while preserving the original destination IP address.

Explanation

A standard virtual server uses a full-proxy model: the BIG-IP completes the TCP handshake with the client, then opens an independent TCP connection to the selected pool member. This lets it inspect and modify payloads, apply TCP optimizations per side, and hide server details from the client.

Question 3F5 platform architecture, traffic processing, and troubleshooting

A virtual server is configured with a source-address-affinity persistence profile. What determines which pool member a returning client is sent to?

  1. A persistence record keyed on the client source IP that maps to the previously selected pool member. Correct answer.
  2. The least-connections load-balancing method applied without any persistence lookup.
  3. A hash of the destination IP address and port computed on every new connection.
  4. A cookie inserted into the HTTP response that identifies the chosen pool member.

Explanation

Source address affinity creates a persistence entry keyed on the client's source IP address so subsequent connections from that address reuse the same pool member until the entry expires. Cookie persistence instead uses an inserted cookie, and simple load balancing has no memory of prior selections.

Question 4F5 platform architecture, traffic processing, and troubleshooting

Which BIG-IP feature allows a single virtual server to distribute traffic to pool members based on the requested URI path?

  1. An iRule or local traffic policy that selects a pool according to the HTTP path. Correct answer.
  2. A monitor assigned to the default pool.
  3. A SNAT pool applied to the virtual server's source translation.
  4. A VLAN group configured for redundant layer 2 forwarding.

Explanation

Path-based routing is implemented in the control plane as logic that inspects the HTTP request and assigns a pool, typically through an iRule or a local traffic policy with an HTTP URI condition. SNAT, VLAN groups, and monitors serve unrelated purposes.

Question 5F5 platform architecture, traffic processing, and troubleshooting

What is the primary function of a health monitor attached to a pool?

  1. It probes pool members and marks them up or down so the load balancer avoids unhealthy nodes. Correct answer.
  2. It records audit events for configuration changes made by administrators.
  3. It encrypts traffic between the BIG-IP and the pool members.
  4. It enforces rate limits on connections arriving at the virtual server.

Explanation

Monitors periodically test pool members using a defined check, such as a TCP connect or an HTTP request, and update member state so traffic is only sent to healthy nodes. Rate limiting, encryption, and auditing are handled by other features.

Question 6F5 platform architecture, traffic processing, and troubleshooting

A BIG-IP device pair uses active/standby configuration synchronization. Which statement describes the role of the standby device?

  1. It maintains synchronized configuration and can take over traffic if the active device fails. Correct answer.
  2. It actively forwards a share of connections alongside the active device at all times.
  3. It processes only management traffic and never holds a copy of the active configuration.
  4. It forwards traffic only for pool members that the active device has marked down.

Explanation

In an active/standby pair, the standby unit keeps its configuration in sync so it can assume the active role during failover. It does not forward production traffic while standby, and it does hold a synchronized configuration.

Question 7F5 platform architecture, traffic processing, and troubleshooting

Which statement best describes the difference between a routed and a transparent virtual server?

  1. A routed virtual server operates only at layer 2, while a transparent virtual server operates at layer 7.
  2. A routed virtual server requires an SSL profile, while a transparent virtual server never supports TLS.
  3. A routed virtual server uses a unique destination address, while a transparent virtual server matches traffic destined to an address the BIG-IP does not own. Correct answer.
  4. A routed virtual server uses SNAT automatically, while a transparent virtual server always preserves the client source address.

Explanation

A routed virtual server is defined with a destination address that clients use directly, often one the BIG-IP owns. A transparent virtual server matches traffic sent to an address that is not configured on the BIG-IP, typically using a wildcard or network destination combined with packet forwarding behavior.

Question 8F5 platform architecture, traffic processing, and troubleshooting

Which profile is required on a virtual server to terminate TLS from clients and re-encrypt traffic to pool members?

  1. A FastL4 profile, which performs TLS offload by default.
  2. A TCP profile alone, because TCP profiles handle encryption automatically.
  3. A client SSL profile on the virtual server and a server SSL profile on the pool or pool members. Correct answer.
  4. An HTTP compression profile applied to both the virtual server and the pool.

Explanation

TLS termination on the client side is provided by a client SSL profile attached to the virtual server, while re-encryption to the backend uses a server SSL profile on the pool or members. TCP, compression, and FastL4 profiles do not perform certificate-based TLS processing.

Question 9F5 platform architecture, traffic processing, and troubleshooting

A virtual server is configured with a destination of 10.10.10.100:443 and a pool of two members on port 8443. A client connects to 10.10.10.100:443. Which port does the BIG-IP use when connecting to the selected pool member?

  1. 8443, because the pool member port defines the server-side destination. Correct answer.
  2. Any random ephemeral port chosen by the BIG-IP.
  3. 443, because the BIG-IP always reuses the virtual server port.
  4. The client's source port, preserved end to end.

Explanation

In a full-proxy virtual server, the pool member's node and port define the server-side connection, so the BIG-IP connects to the member on port 8443 regardless of the virtual server port. The client source port is not preserved because a new server-side connection is created.

Question 10F5 platform architecture, traffic processing, and troubleshooting

A virtual server has no SNAT configured and pool members use the BIG-IP as their default gateway. What source address do pool members typically see for client connections?

  1. The floating management address of the device group.
  2. The client's original source IP address, because the BIG-IP forwards the connection without source translation. Correct answer.
  3. The self IP address of the egress VLAN.
  4. The virtual server's destination address.

Explanation

Without SNAT or a SNAT pool, the BIG-IP preserves the client source address toward pool members, which requires that return traffic routes back through the BIG-IP. Using a self IP as source only happens when SNAT is configured, such as with automap.

Question 11F5 platform architecture, traffic processing, and troubleshooting

A pool member is marked down by an HTTP monitor even though the application responds on port 80. Which condition most likely explains the failure?

  1. The pool member's TCP profile does not support HTTP.
  2. The monitor expects a specific response, such as a 200 status for a defined URI, that the application does not return. Correct answer.
  3. The virtual server is missing a client SSL profile.
  4. The persistence profile has expired on the virtual server.

Explanation

An HTTP monitor sends a request and compares the response against configured expectations, such as a send string and receive string or an expected status code. If the application returns a different status or body, the monitor marks the member down even though the port is reachable.

Question 12F5 platform architecture, traffic processing, and troubleshooting

An iRule contains an event that references HTTP commands, but the virtual server has only a TCP profile. What is the most likely result?

  1. The iRule fails to load and the virtual server is marked offline.
  2. The HTTP event never fires because no HTTP profile is attached to parse the request. Correct answer.
  3. The HTTP commands execute against raw TCP payload without a profile.
  4. The BIG-IP automatically attaches an HTTP profile to satisfy the iRule.

Explanation

HTTP events and commands depend on an HTTP profile so the BIG-IP parses requests and responses. Without it, the connection is handled as generic TCP and HTTP-specific events do not trigger, even though the iRule may still load.

Question 13F5 platform architecture, traffic processing, and troubleshooting

A client repeatedly lands on different pool members despite cookie persistence being enabled. Which explanation is most consistent with this behavior?

  1. The application sets its own cookie with the same name used by the persistence profile, overwriting the BIG-IP cookie. Correct answer.
  2. The pool uses round robin, which disables all persistence methods.
  3. The virtual server has a FastL4 profile, which always disables cookies.
  4. The monitor interval is shorter than the persistence timeout.

Explanation

Cookie persistence relies on the BIG-IP inserting and reading a cookie with a specific name. If the application also emits a cookie with that name, the client may return the application's value, so the BIG-IP cannot match a persistence entry and rebalances the request.

Question 14F5 platform architecture, traffic processing, and troubleshooting

A BIG-IP pair is configured active/standby, and the standby device shows configuration changes that were never made on it directly. Which mechanism explains this?

  1. Configuration synchronization replicates objects from the active device to the device group. Correct answer.
  2. The monitors on the standby device copy pool definitions from the active device.
  3. The traffic management microkernel forwards configuration packets between peers.
  4. The standby device polls the active device's management interface for audit logs.

Explanation

Config sync propagates configuration objects across members of a device group so the standby unit holds a matching configuration and can take over. The changes appear on the standby because they were synchronized from the active peer, not entered locally.

Question 15F5 platform architecture, traffic processing, and troubleshooting

A virtual server uses a performance layer 4 profile. Which statement describes how traffic is handled?

  1. Connections are balanced using URI-based content switching.
  2. The BIG-IP performs TLS termination and inserts persistence cookies for each request.
  3. Every connection is fully terminated and payloads are reassembled for HTTP inspection.
  4. Packets are forwarded using a fast path with limited TCP termination, and iRule events are restricted compared to a standard virtual server. Correct answer.

Explanation

A performance layer 4 profile, commonly called FastL4, uses a fast packet path with limited TCP processing and supports only a subset of iRule events. Full termination, HTTP inspection, cookie insertion, and URI switching require a standard virtual server with the appropriate profiles.

Question 16F5 platform architecture, traffic processing, and troubleshooting

Users report intermittent failures reaching an application through a BIG-IP. A packet capture on a pool member shows connections arriving with the client source address, but return traffic bypasses the BIG-IP. What is the most likely cause?

  1. The persistence profile is set to source address affinity.
  2. The pool member's default gateway does not point to a BIG-IP self IP, so return packets take a different path. Correct answer.
  3. The pool monitor is using the wrong interval.
  4. The virtual server is missing a client SSL profile.

Explanation

When SNAT is not used, the BIG-IP preserves the client source address, so pool members must send return traffic back through the BIG-IP. If their default gateway is a different router, asymmetric routing occurs and the BIG-IP never sees the return packets, breaking the connection.

Question 17F5 platform architecture, traffic processing, and troubleshooting

Which command-line tool on the BIG-IP is commonly used to inspect live packet flow and confirm whether traffic reaches a virtual server?

  1. tcpdump Correct answer.
  2. bigpipe db
  3. restjavad
  4. tmsh save sys config

Explanation

tcpdump captures packets on an interface so you can verify whether client traffic arrives and how the BIG-IP responds. The other choices relate to configuration saving, legacy configuration commands, and the REST daemon, none of which provide packet-level inspection.

Question 18F5 platform architecture, traffic processing, and troubleshooting

A virtual server is configured with a network destination such as 0.0.0.0/0 and a specific pool. What behavior should you expect?

  1. It matches a broad range of destination addresses, so traffic not intended for that service may be captured and balanced. Correct answer.
  2. It automatically becomes a transparent virtual server with no pool.
  3. It matches only the exact address 0.0.0.0 and forwards everything else normally.
  4. It cannot be created because virtual servers require a host destination.

Explanation

A wildcard or network destination makes the virtual server match any address in that range, which can capture unintended traffic and send it to the configured pool. This is often used deliberately for transparent or forward-proxy designs, but it must be scoped carefully.

Question 19F5 platform architecture, traffic processing, and troubleshooting

A pool contains three members, and one is marked down by a monitor. How does the BIG-IP handle new connections by default?

  1. It continues to send an equal share of connections to the down member.
  2. It distributes new connections only to the members that are marked up. Correct answer.
  3. It disables the virtual server until every member is healthy.
  4. It sends all connections to the first member in the pool until the down member recovers.

Explanation

By default, the load-balancing decision excludes pool members whose monitor status is down, so new connections go to healthy members. The virtual server remains available as long as at least one member is up.

Question 20F5 platform architecture, traffic processing, and troubleshooting

Which statement accurately describes how a BIG-IP handles a connection when a virtual server has an HTTP profile but the pool member is unreachable?

  1. The BIG-IP forwards the request to a random node outside the pool.
  2. The BIG-IP silently drops the client connection with no response.
  3. The BIG-IP can return an error response to the client, such as a 503, based on the configured fallback behavior. Correct answer.
  4. The BIG-IP converts the virtual server to FastL4 mode automatically.

Explanation

With an HTTP profile, the BIG-IP can generate an HTTP error response, commonly a 503, when no pool member is available and fallback is configured. Silently dropping, sending to arbitrary nodes, or changing the virtual server type are not standard behaviors.

Question 21F5 platform architecture, traffic processing, and troubleshooting

A BIG-IP is deployed in a one-armed configuration. What does this mean for traffic flow?

  1. The BIG-IP forwards traffic only at layer 2 without any IP routing.
  2. Client and server traffic both traverse the same BIG-IP interface or VLAN, with routing configured to return traffic through the device. Correct answer.
  3. The BIG-IP uses two separate interfaces dedicated to client and server traffic.
  4. The BIG-IP requires a direct physical connection to every pool member.

Explanation

In a one-armed deployment, the BIG-IP reaches both clients and servers through the same network path, so routing and often SNAT are needed to ensure return traffic flows back through the device. A two-armed design uses separate client and server interfaces.

Question 22F5 platform architecture, traffic processing, and troubleshooting

A virtual server with source address persistence is load balancing an application where many users share a single NAT egress IP. What problem is most likely to occur?

  1. The monitor marks all pool members down.
  2. All users behind the shared address map to the same persistence entry and are pinned to one pool member. Correct answer.
  3. The persistence table rejects the connections and resets them.
  4. The BIG-IP disables persistence because the source addresses are identical.

Explanation

Source address affinity keys on the client source IP, so many clients hidden behind one NAT address collapse into a single persistence entry and are all sent to the same member. This creates imbalance and is why cookie or other persistence methods are often preferred for web applications.

Question 23F5 platform architecture, traffic processing, and troubleshooting

An iRule uses the event HTTP_REQUEST to select a pool, but the virtual server is configured with a performance layer 4 profile. What is the most accurate outcome?

  1. The iRule runs but receives an empty URI for every request.
  2. The HTTP_REQUEST event does not fire because FastL4 does not provide HTTP parsing or full proxy handling. Correct answer.
  3. The BIG-IP upgrades the profile to a standard profile to run the iRule.
  4. The iRule fires on the first packet of each TCP connection.

Explanation

FastL4 uses a fast path with limited TCP processing and does not parse HTTP, so HTTP events such as HTTP_REQUEST cannot trigger. To use HTTP iRule events, the virtual server needs a standard profile with an HTTP profile attached.

Question 24F5 platform architecture, traffic processing, and troubleshooting

A BIG-IP pair in active/standby mode fails over, but clients experience dropped connections rather than a clean transition. Which factor best explains this?

  1. The floating self IP address is not moved to the new active device.
  2. The standby device has no synchronized configuration and cannot take over.
  3. The monitors on the active device are disabled by the failover.
  4. Existing connections are not synchronized to the standby device, so stateful flows cannot continue after failover. Correct answer.

Explanation

In active/standby without connection mirroring, the standby unit has the configuration but not the per-connection state, so established flows are dropped and clients must reconnect. Enabling connection mirroring allows stateful failover for supported configurations.

Question 25F5 platform architecture, traffic processing, and troubleshooting

Traffic to a virtual server is being SNATed using automap. Which source address will pool members observe for client connections?

  1. The floating management address.
  2. The virtual server's destination address.
  3. The original client source address.
  4. A self IP address selected from the egress VLAN. Correct answer.

Explanation

Automap translates the client source address to a self IP address on the egress VLAN, allowing return traffic to reach the BIG-IP. Without SNAT, the original client address would be preserved, but automap explicitly performs translation.

Question 26F5 platform architecture, traffic processing, and troubleshooting

A BIG-IP virtual server is configured with an HTTP profile. Which statement describes the default behavior when a client sends an unsupported HTTP method to the virtual server?

  1. The BIG-IP converts the method to GET and forwards the request to a pool member.
  2. The connection is reset immediately by the TCP stack before the HTTP layer parses it.
  3. The BIG-IP returns an HTTP 400-series response and does not forward the request. Correct answer.
  4. The request is forwarded to the pool member without inspection of the method.

Explanation

The HTTP profile enforces RFC-compliant parsing, so a malformed or unsupported request is rejected by the BIG-IP itself with an HTTP error response rather than being passed to a pool member. This protects back-end servers from invalid traffic and is visible in the HTTP profile statistics.

Question 27F5 platform architecture, traffic processing, and troubleshooting

An administrator wants to confirm which pool member a specific client connection was balanced to and see the current connection count per member. Which tmsh command provides this information?

  1. tmsh show ltm pool <pool_name> members Correct answer.
  2. tmsh list ltm virtual <virtual_name>
  3. tmsh show net interface
  4. tmsh show sys hardware

Explanation

The `tmsh show ltm pool <pool_name> members` command displays each member's status, current connections, and total connections, which lets you verify load distribution and member health. The other commands show configuration or platform state rather than per-member connection accounting.

Question 28F5 platform architecture, traffic processing, and troubleshooting

A virtual server is configured with a destination of 10.20.30.40:80 and a pool containing members on port 8080. A client connects to 10.20.30.40:80. What destination port does the BIG-IP use when forwarding to the pool member?

  1. A random ephemeral port chosen by the BIG-IP.
  2. Port 80, because the virtual server destination port is preserved.
  3. Port 443, because the BIG-IP defaults to HTTPS when the pool member port differs.
  4. Port 8080, because the pool member port overrides the virtual server port. Correct answer.

Explanation

When a pool member specifies its own service port, the BIG-IP translates the destination to that member port. The virtual server's listening port is only the client-facing destination, and the pool member definition controls the server-side port.

Question 29F5 platform architecture, traffic processing, and troubleshooting

A virtual server uses source address persistence, and many users share a single NAT egress address. What is the most likely result?

  1. Persistence is automatically disabled when duplicate source addresses are detected.
  2. All users from that NAT address are pinned to the same pool member. Correct answer.
  3. The BIG-IP falls back to round robin for every connection.
  4. Each user is distributed evenly across all pool members.

Explanation

Source address persistence keys on the client source IP, so clients sharing one NAT address map to the same persistence entry and are sent to the same pool member. This can create uneven load and is a common reason to choose cookie or SSL persistence instead.

Question 30F5 platform architecture, traffic processing, and troubleshooting

A virtual server has an HTTP profile but no TCP profile explicitly assigned. Which statement describes how the BIG-IP handles the connection?

  1. The BIG-IP uses a default TCP profile to manage the connection. Correct answer.
  2. The connection is forwarded without any TCP-level processing.
  3. The connection is rejected because a TCP profile is mandatory.
  4. The BIG-IP switches to a performance layer 4 profile automatically.

Explanation

When no TCP profile is explicitly assigned, the BIG-IP applies a default TCP profile so that connection management, such as window scaling and retransmission handling, still occurs. The HTTP profile depends on TCP processing, so a default is applied rather than leaving the connection unmanaged.

Question 31F5 platform architecture, traffic processing, and troubleshooting

A BIG-IP pair is active/standby, and the standby device shows configuration changes that were never made on it. What is the most likely explanation?

  1. The standby device is in a separate device group and cannot receive sync.
  2. The standby device has an independent management IP that is being modified by another team.
  3. The standby device is running a different software version and auto-generating changes.
  4. The standby device is receiving configuration synchronization from the active device. Correct answer.

Explanation

In an active/standby device group with config sync enabled, configuration changes made on the active device are synchronized to the standby peer. Seeing identical changes on the standby is expected behavior, not evidence of unauthorized modification.

Question 32F5 platform architecture, traffic processing, and troubleshooting

A monitor marks a pool member down, but a manual test from the BIG-IP to the member's service port succeeds. Which condition most likely explains the discrepancy?

  1. The virtual server has no pool assigned.
  2. The monitor is configured to check a different port or path than the one tested manually. Correct answer.
  3. The BIG-IP is in a standby state and cannot run monitors.
  4. The pool member is administratively disabled in the pool configuration.

Explanation

Monitors probe the specific port, path, or protocol defined in the monitor configuration, which may differ from the port tested manually. If the monitor checks a different service or URI, it can fail even when the tested port responds.

Question 33F5 platform architecture, traffic processing, and troubleshooting

An iRule references HTTP commands, but the virtual server has only a TCP profile. What is the most likely outcome?

  1. The BIG-IP automatically adds an HTTP profile to support the iRule.
  2. The HTTP commands fail at runtime because HTTP parsing is not enabled. Correct answer.
  3. The virtual server refuses to accept any client connections.
  4. The iRule executes normally because iRules do not depend on profiles.

Explanation

HTTP iRule commands require an HTTP profile so that the BIG-IP parses HTTP and fires HTTP events. Without it, HTTP-specific commands cannot operate correctly and the rule does not behave as intended.

Question 34F5 platform architecture, traffic processing, and troubleshooting

A client repeatedly lands on different pool members even though cookie persistence is enabled. Which explanation is most likely?

  1. The virtual server is using a performance layer 4 profile.
  2. The persistence profile is attached to the pool rather than the virtual server.
  3. The pool members are returning a cookie that the BIG-IP does not recognize or insert. Correct answer.
  4. The client is using HTTP/2 instead of HTTP/1.1.

Explanation

Cookie persistence relies on the BIG-IP inserting or reading its persistence cookie. If the application overwrites or strips the cookie, or the member returns cookies the BIG-IP cannot map, the client is treated as new and rebalanced.

Question 35F5 platform architecture, traffic processing, and troubleshooting

A BIG-IP pair in active/standby mode fails over, but clients experience dropped connections rather than a clean transition. Which factor most directly explains this behavior?

  1. The virtual server uses a standard TCP profile.
  2. The active device has more memory than the standby device.
  3. The pool members are configured with a health monitor.
  4. The standby device was not synchronized with the current connection state. Correct answer.

Explanation

Connection mirroring must be configured and synchronized for the standby to take over existing flows. Without mirrored connection state, the standby cannot resume established sessions and clients see resets or timeouts during failover.

Question 36F5 platform architecture, traffic processing, and troubleshooting

A virtual server is configured with a network destination of 0.0.0.0/0 and a specific pool. What behavior should you expect?

  1. The virtual server matches only traffic destined for the BIG-IP self IP.
  2. The virtual server is rejected because a network destination requires a netmask of /32.
  3. The virtual server matches any destination address not claimed by a more specific virtual server. Correct answer.
  4. The virtual server matches only traffic arriving on the management interface.

Explanation

A wildcard network virtual server matches traffic that does not match a more specific virtual server, making it a catch-all listener. Specific virtual servers take precedence, so the wildcard handles only unmatched destinations.

Question 37F5 platform architecture, traffic processing, and troubleshooting

A client connection reaches a virtual server, but a packet capture on the pool member shows connection attempts from a source address that is not the client and not a configured SNAT address. Which explanation is most likely?

  1. The virtual server is configured with a performance layer 4 profile.
  2. The pool member is receiving traffic from an unrelated host on the network.
  3. The pool member is responding to a health monitor probe.
  4. The BIG-IP is using automap SNAT, translating the source to a self IP. Correct answer.

Explanation

Automap SNAT rewrites the client source address to a BIG-IP self IP before forwarding to the pool member. Seeing a self IP as the source in a capture is consistent with automap rather than a rogue host.

Question 38F5 platform architecture, traffic processing, and troubleshooting

A BIG-IP platform's Traffic Management Microkernel (TMM) is described as handling the data plane. Which statement best characterizes the division of labor between TMM and the rest of the BIG-IP software?

  1. TMM handles only SSL handshakes, and all TCP and HTTP processing is performed by the control plane daemons.
  2. TMM runs only on the standby device, and the active device processes traffic entirely within the control plane.
  3. TMM processes packets and applies L4/L7 policy in user space, while configuration and control tasks such as the GUI and iControl REST run outside TMM. Correct answer.
  4. TMM performs all configuration validation and persistence of the running configuration to disk, while the control plane only forwards packets.

Explanation

TMM is the data-plane process that receives packets, applies virtual server matching, profiles, and iRules, and forwards traffic to pool members. Control-plane functions such as the configuration utility, iControl REST, and configuration persistence operate outside TMM. This separation means a busy control plane does not by itself determine forwarding throughput, which is bounded by TMM and hardware resources.

Question 39F5 platform architecture, traffic processing, and troubleshooting

Users report that a virtual server answering on port 443 completes the TCP handshake but the connection resets immediately after the ClientHello. A packet capture shows the BIG-IP sending a TCP reset toward the client. Which BIG-IP condition most directly explains this behavior?

  1. The virtual server's destination port does not match the port the client is connecting to.
  2. The virtual server has a Client SSL profile but no matching Server SSL profile assigned to the pool side.
  3. The pool members are responding more slowly than the configured idle timeout for the virtual server.
  4. The virtual server has no SSL profile assigned, so the BIG-IP cannot decrypt the ClientHello and rejects the session. Correct answer.

Explanation

When a client sends TLS to a virtual server that has no Client SSL profile, the BIG-IP is not configured to terminate TLS and treats the encrypted bytes as unexpected for the configured protocol, resetting the connection. Assigning a Client SSL profile lets the BIG-IP terminate the handshake before forwarding to the pool. A missing Server SSL profile would not cause this reset because server-side encryption is optional.

Question 40F5 platform architecture, traffic processing, and troubleshooting

An administrator needs to capture traffic for a specific virtual server without disrupting production and wants the capture to include packets as TMM sees them. Which approach best meets this requirement?

  1. Run tcpdump on the management interface and filter on the virtual server's destination address.
  2. Disable the virtual server temporarily so that traffic is queued and can be captured in full.
  3. Configure a packet filter on the BIG-IP that discards traffic to the virtual server so it can be inspected.
  4. Use the tcpdump utility from the advanced shell with a filter on the virtual server address and port, writing to a file for later analysis. Correct answer.

Explanation

Running tcpdump from the advanced shell with a targeted filter captures packets on the data interfaces as they are processed, and writing to a file avoids flooding the terminal while preserving evidence. This does not require changing virtual server state or dropping traffic. Packet filters and disabling the virtual server both alter forwarding behavior and are not capture methods.

Question 41LTM virtual servers, pools, nodes, and load balancing methods

On a BIG-IP LTM, which object is the direct parent of a pool member?

  1. A virtual server
  2. A monitor
  3. A node
  4. A pool Correct answer.

Explanation

A pool member is a node combined with a service port, and that combination is created inside a pool object. The node supplies the address, the pool supplies the port and load-balancing context, so the pool is the direct parent.

Question 42LTM virtual servers, pools, nodes, and load balancing methods

A virtual server is configured with destination 10.10.10.100:443 and type Standard. What does this configuration accomplish?

  1. It forwards all traffic arriving on any local address to the pool, ignoring the destination address.
  2. It performs source NAT on all outbound connections from the pool members.
  3. It creates a wildcard listener that matches any port on 10.10.10.100.
  4. It listens for traffic addressed to 10.10.10.100 on TCP port 443 and load balances it to the assigned pool. Correct answer.

Explanation

A Standard virtual server with a specific address and port matches only traffic destined to that address/port pair and distributes it to the pool. It is the classic application-delivery listener definition.

Question 43LTM virtual servers, pools, nodes, and load balancing methods

Which load-balancing method distributes connections to pool members in strict rotating order regardless of current connection counts?

  1. Least connections
  2. Predictive
  3. Observed
  4. Round robin Correct answer.

Explanation

Round robin simply advances to the next available member in sequence for each new connection. It does not consider how many connections each member currently holds.

Question 44LTM virtual servers, pools, nodes, and load balancing methods

What is the primary purpose of a health monitor attached to a pool?

  1. To encrypt traffic between the virtual server and the pool members
  2. To log every request that the virtual server processes
  3. To limit the number of concurrent connections a member may accept
  4. To determine whether pool members are available to receive traffic Correct answer.

Explanation

Monitors probe members and mark them up or down so the virtual server only sends traffic to healthy members. Connection limits and encryption are handled by other settings.

Question 45LTM virtual servers, pools, nodes, and load balancing methods

A node object in LTM stores which of the following?

  1. The persistence profile applied to the virtual server
  2. The IP address of a backend server Correct answer.
  3. The load-balancing method used by the pool
  4. The SSL certificate presented to clients

Explanation

A node is essentially a named IP address object representing a backend host. Pools reference nodes and add ports to create members.

Question 46LTM virtual servers, pools, nodes, and load balancing methods

Which virtual server type is required when the LTM must forward traffic based on Layer 4 information without inspecting or modifying the payload?

  1. Forwarding (Layer 2)
  2. Stateless
  3. Standard
  4. Performance (Layer 4) Correct answer.

Explanation

A Performance (Layer 4) virtual server operates at Layer 4, forwarding packets without full proxy processing of the payload. Standard virtual servers perform full proxy termination.

Question 47LTM virtual servers, pools, nodes, and load balancing methods

What happens to new connections when all members of a pool are marked down by their monitor?

  1. The virtual server resets every connection immediately
  2. The virtual server returns an error or drops traffic depending on configuration, since no member is available Correct answer.
  3. The virtual server automatically creates a new node
  4. The virtual server sends traffic to the first member anyway

Explanation

With no available members, the virtual server has no destination and typically rejects or drops the connection. It does not invent capacity or auto-provision nodes.

Question 48LTM virtual servers, pools, nodes, and load balancing methods

Which persistence method keeps a client bound to the same pool member based on the client's source IP address?

  1. Cookie persistence
  2. Source address affinity Correct answer.
  3. Destination address affinity
  4. SSL session ID persistence

Explanation

Source address affinity hashes or records the client IP so subsequent connections from that address go to the same member. Cookie and SSL session ID persistence rely on higher-layer identifiers.

Question 49LTM virtual servers, pools, nodes, and load balancing methods

An administrator wants new connections sent to the member with the fewest active connections. Which method should be selected?

  1. Ratio
  2. Fastest
  3. Round robin
  4. Least connections Correct answer.

Explanation

Least connections tracks active connection counts per member and selects the lowest. This adapts to uneven session durations better than fixed rotation.

Question 50LTM virtual servers, pools, nodes, and load balancing methods

A pool has three members with ratio weights 1, 1, and 2 and uses the Ratio (member) method. What is the intended distribution of new connections?

  1. All connections to the highest-weight member
  2. 50 percent, 25 percent, and 25 percent respectively
  3. One third to each member equally
  4. 25 percent, 25 percent, and 50 percent respectively Correct answer.

Explanation

Ratio (member) distributes proportionally to each member's ratio value. With weights 1, 1, and 2 the total is 4, giving 25/25/50 percent.