F5-CTS-LTM Practice Exam 4 — 20 Questions

Question 1

An application requires persistence based on a specific custom header named 'X-Session-ID'. The LTM Specialist has confirmed the header is always present in requests. Which persistence method is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Universal persistence. Universal persistence is the only method that allows the BIG-IP to persist traffic based on arbitrary data found within the request. By extracting the value of the 'X-Session-ID' header using an iRule and mapping it to a persistence record, the BIG-IP can ensure that all requests with the same session ID are consistently routed to the same backend server, regardless of the client's IP address.

Answer

Cookie Insert persistence

Answer

Source Address persistence

Answer

Hash persistence

Question 2

Which component of the BIG-IP LTM architecture is primarily responsible for the initial processing and decision-making regarding whether a packet should be forwarded to a pool member?

Accepted Answer

The Virtual Server. The Local Traffic Manager (LTM) module utilizes virtual servers to intercept incoming traffic. The virtual server acts as the central point of control, evaluating incoming packets against configured rules, policies, and profiles. This architecture allows the LTM to make intelligent load balancing decisions, ensuring traffic is directed to the most appropriate pool member based on system state, performance, and specific business logic requirements.

Answer

The Pool Member

Answer

The Health Monitor

Answer

The iControl API

Question 3

An LTM is configured with a 'OneConnect' profile. What is the primary purpose of this feature?

Accepted Answer

To reuse backend TCP connections for multiple client requests.. OneConnect enables TCP connection pooling between the BIG-IP and the backend servers. By keeping backend connections open even after a client request finishes, the LTM avoids the overhead of repeated TCP handshakes. This is essential for high-performance web applications, as it significantly reduces latency and server CPU consumption, allowing the backend servers to handle a higher volume of concurrent user requests more efficiently than they could with per-request connection establishment.

Answer

To encrypt traffic between the BIG-IP and the backend servers.

Answer

To enable persistence for HTTP traffic.

Answer

To limit the number of concurrent connections per client.

Question 4

An administrator needs to ensure that a pool member remains part of the load balancing rotation only if it responds to specific HTTP GET requests on port 80, rather than just TCP SYN. Which action should the administrator perform?

Accepted Answer

Create and assign an HTTP monitor with a specific 'Send' and 'Receive' string.. To validate application-level health rather than just network reachability, a custom monitor is required. By creating an HTTP or HTTPS monitor, the BIG-IP sends specific requests and verifies the content of the response. This ensures that the web service itself is functional, not just the underlying operating system or network stack, preventing the delivery of requests to unresponsive or malfunctioning application services.

Answer

Configure an ICMP monitor on the pool member.

Answer

Enable the 'Priority Group Activation' feature on the pool.

Answer

Change the pool's Load Balancing method to 'Least Connections'.

Question 5

Which statement best describes the difference between a 'Node' and a 'Pool Member' in the BIG-IP LTM configuration?

Accepted Answer

Nodes represent the physical IP, whereas pool members represent the service port.. A Node is a device defined by its IP address, which exists independently of any pool. A Pool Member is an instance of a node assigned to a specific pool, often including port and monitor settings. This distinction is crucial because multiple pools can reference the same node, allowing administrators to manage health and load balancing for different services independently on the same physical backend server.

Answer

Nodes are defined at the virtual server level, while pool members are defined globally.

Answer

Nodes are only used for health monitoring, while pool members handle traffic.

Answer

Pool members are not required for load balancing traffic.

Question 6

What is the primary function of a BIG-IP LTM monitor?

Accepted Answer

To determine the availability of a pool member.. Monitors are used to verify the operational status and health of backend pool members. By periodically checking specific services, the BIG-IP ensures that traffic is only sent to functional servers. This prevents black-holing traffic and maintains high availability, as the BIG-IP will automatically stop sending requests to any member that fails its configured health check, providing seamless failover for users.

Answer

To encrypt traffic between the client and the BIG-IP.

Answer

To balance traffic load across multiple pool members.

Answer

To translate source IP addresses for outgoing traffic.

Question 7

Which component is responsible for executing iRules on the BIG-IP LTM system?

Accepted Answer

The Data Plane (TMM).. The Traffic Management Microkernel (TMM) is the core engine of the BIG-IP system responsible for processing all traffic. iRules are executed directly within TMM as packets are processed, allowing for line-rate traffic manipulation. This architecture ensures that complex logic, such as header modification or persistence redirection, occurs in real-time with minimal latency, which is a major advantage of the LTM's purpose-built hardware acceleration and software design.

Answer

The Control Plane (MCPD).

Answer

The Linux Kernel.

Answer

The REST API daemon (restjavad).

Question 8

An LTM administrator needs to ensure that client SSL traffic is offloaded at the BIG-IP while maintaining end-to-end encryption to the backend servers. Which profile configuration is required to achieve this?

Accepted Answer

Assign both a Client SSL profile and a Server SSL profile to the virtual server.. To achieve SSL offloading with backend encryption, the LTM must terminate the client-side SSL using a Client SSL profile and then initiate a new SSL connection to the server using a Server SSL profile. This architecture, known as SSL Bridging, is critical for organizations needing to perform deep packet inspection or Layer 7 load balancing while maintaining security compliance protocols between the load balancer and the internal server pool members.

Answer

Apply only a Client SSL profile to the virtual server.

Answer

Configure a FastL4 profile with SSL persistence enabled.

Answer

Disable the Client SSL profile and enable a Server SSL profile only.

Question 9

Refer to the exhibit. The virtual server 'vs_secure_site' is showing as 'offline'. What is the most immediate step to take to restore service?

Accepted Answer

Investigate the pool members and health monitor status.. When a virtual server status is 'offline' due to 'no available members', it indicates that all pool members associated with that virtual server have failed their health checks. The most immediate and logical step is to inspect the pool members and their monitors to identify why they are failing, as the virtual server cannot function without at least one healthy backend server.

Answer

Delete and recreate the virtual server.

Answer

Restart the BIG-IP TMM service.

Answer

Change the virtual server IP address.

Question 10

When using an iRule to select a pool, what happens if the iRule contains a logic error that results in no pool being selected?

Accepted Answer

The system selects the default pool defined on the VS.. If an iRule does not issue a 'pool' command, the BIG-IP defaults to the pool defined on the Virtual Server itself. If no pool is defined on the VS, the connection is reset. Understanding this fallback behavior is vital for debugging complex iRule logic. If an administrator fails to account for all conditions in an iRule, the traffic may behave unpredictably, falling back to default settings rather than failing outright.

Answer

The connection is immediately dropped.

Answer

The system routes traffic to the first pool in the list.

Answer

The iRule execution stops and returns an error to the client.

Question 11

An LTM administrator needs to allow a specific external IP address to access a restricted management interface via a virtual server, while blocking all others. What is the most efficient way to implement this?

Accepted Answer

Use an iRule or Local Traffic Policy on the virtual server to check the source IP.. The most efficient way to control access at the BIG-IP level is using an LTM Local Traffic Policy or an iRule. While a packet filter or AFM can work, LTM-specific policies are integrated directly into the virtual server configuration. By checking the client IP address in the policy, the administrator can perform a 'drop' or 'reset' action for unauthorized traffic, ensuring high performance.

Answer

Apply a packet filter to the VLAN that blocks all traffic except the specific IP.

Answer

Modify the pool member's firewall to allow only the BIG-IP's self IP address.

Answer

Assign a 'None' profile to the virtual server to force an error on unauthorized connections.

Question 12

An administrator wants to use an iRule to log the 'Host' header of every incoming HTTP request. Which iRule event is most appropriate for this task?

Accepted Answer

HTTP_REQUEST. The 'HTTP_REQUEST' event triggers whenever a client sends an HTTP request, providing immediate access to the headers before the request is processed by the pool selection logic. This is the correct point in the request-response cycle to inspect and log headers. Using this event ensures that the logging logic executes for every single request, providing a full audit trail of host header usage.

Answer

CLIENT_ACCEPTED

Answer

HTTP_RESPONSE

Answer

LB_SELECTED

Question 13

Which BIG-IP feature allows an administrator to modify the HTTP header of a request before it reaches the backend server?

Accepted Answer

iRule. An iRule is the primary mechanism for manipulating traffic at the application layer. By using events like HTTP_REQUEST, an administrator can insert, modify, or delete HTTP headers on the fly. This is essential for scenarios like adding X-Forwarded-For headers, removing security-sensitive headers, or injecting custom application-specific tokens to communicate information to the backend servers that the client did not initially provide.

Answer

SNAT Pool

Answer

HTTP Profile

Answer

Virtual Server

Question 14

What is the primary function of the LTM 'OneConnect' profile in an environment with high-volume short-lived connections?

Accepted Answer

It multiplexes client-side and server-side connections to reduce server CPU load.. OneConnect enables TCP connection multiplexing. It allows the BIG-IP to keep backend TCP connections open even after a client has closed its connection. By reusing these existing idle connections for new client requests, the LTM significantly reduces the overhead on backend servers associated with the TCP three-way handshake and slow-start process, which is essential for scaling performance in high-traffic web environments.

Answer

It compresses HTTP traffic to reduce bandwidth usage.

Answer

It caches static content to prevent repetitive requests to backend servers.

Answer

It performs SSL decryption to offload cryptographic tasks.

Question 15

Which BIG-IP feature allows an LTM Specialist to perform granular inspection and modification of HTTP traffic headers before they reach the backend server?

Accepted Answer

iRules. iRules are the primary tool for custom traffic manipulation on the BIG-IP. They provide an event-driven Tcl-based scripting environment that allows specialists to intercept, inspect, and modify any part of the packet, including HTTP headers. This is essential for advanced load balancing scenarios, such as header-based routing, security obfuscation, or dynamic application integration that standard profiles cannot handle natively.

Answer

Local Traffic Policy

Answer

Persistence Profile

Answer

FastL4 Profile

Question 16

Refer to the exhibit. Why is the 'http' profile required in this virtual server configuration?

Accepted Answer

To allow the LTM to inspect and modify HTTP headers.. The 'http' profile is required because the BIG-IP LTM needs to parse the HTTP headers to perform application-level functions like persistence, compression, or header manipulation. Even if the Virtual Server simply forwards traffic, the presence of an HTTP profile enables the TMM to understand the protocol structure. This is critical for any LTM configuration that requires visibility into the payload for security or load-balancing logic.

Answer

To enable hardware acceleration for SSL processing.

Answer

To define the backend server pool members.

Answer

To enable port translation for the virtual server.

Question 17

Which TWO of the following are valid methods to offload SSL processing from the backend servers to the BIG-IP system? (Choose two)

Accepted Answer

Configure Client-side SSL profile on the virtual server and leave the backend pool unencrypted.. SSL Offloading is a primary function of LTM, allowing the BIG-IP to perform the resource-intensive cryptographic tasks. By terminating the SSL connection at the BIG-IP, the backend servers can focus on application logic. The two common architectures are SSL Termination (Client-side SSL) and SSL Bridging (Client-side and Server-side SSL), both of which effectively remove the encryption burden from the backend pool members.

Answer

Configure Server-side SSL profile on the virtual server and leave the client traffic unencrypted.

Answer

Disable SSL on the virtual server and enable it on the pool.

Answer

Configure an iRule to forward unencrypted packets to the backend servers.

Question 18

What is the result of setting the 'OneConnect Transformation' feature to 'Enabled' in an HTTP profile?

Accepted Answer

It rewrites HTTP headers to support connection reuse.. OneConnect Transformation allows the BIG-IP to safely rewrite Connection headers, converting 'keep-alive' to 'close' or vice-versa to facilitate connection reuse. This ensures that the backend servers properly interpret the connection state as managed by the BIG-IP's pooling mechanism. Without this, the server might close the connection prematurely, causing errors in applications that expect persistent connections, thereby negating the performance benefits provided by the OneConnect profile implementation.

Answer

It forces the client to use HTTPS.

Answer

It compresses all outgoing HTTP payloads.

Answer

It disables all persistence profiles on the VS.

Question 19

What is the result of applying a 'FastL4' profile to a virtual server?

Accepted Answer

It provides high-performance L4 load balancing.. The FastL4 profile is designed for high-performance, transport-layer load balancing. It bypasses the full proxy capabilities of the BIG-IP, meaning it cannot perform L7 inspection, HTTP header manipulation, or SSL offloading. This is ideal for scenarios like UDP traffic, streaming, or simple TCP load balancing where maximizing throughput and minimizing latency are more important than application-level traffic modification or security features.

Answer

It allows the BIG-IP to perform HTTP header insertion.

Answer

It enables SSL termination on the virtual server.

Answer

It creates a stateful firewall for all traffic.

Question 20

Refer to the exhibit. An LTM Specialist wants to ensure that persistence is maintained even if a client switches between different virtual services that share the same pool members. Based on the configuration, will this work?

Accepted Answer

Yes, because 'match-across-services' is enabled.. The persistence profile has 'match-across-services' enabled. This setting allows the BIG-IP to maintain the same persistence record across different virtual servers that share the same pool. This is crucial for complex applications where a user might initiate a session on one virtual service and be directed to another, as it ensures session affinity remains consistent throughout the user's entire journey across the application.

Answer

No, because the cookie name must be unique per virtual server.

Answer

No, because 'expiration 0' prevents persistence across services.

Answer

Yes, but only if the virtual servers share the same IP address.