F5-CTS-LTM Practice Test 2 — 25 Questions

Question 1

Which component of the BIG-IP architecture is responsible for performing the actual load balancing of traffic to pool members?

Accepted Answer

The TMM (Traffic Management Microkernel). The TMM (Traffic Management Microkernel) is the heart of the BIG-IP system. It is a specialized, high-performance kernel that handles all traffic processing, including load balancing, SSL termination, and iRule execution. Unlike the standard Linux kernel, which handles management tasks, the TMM is optimized for high-throughput packet processing, which is the core requirement for LTM services in modern network environments.

Answer

The Linux kernel

Answer

The Control Plane

Answer

The Configuration Utility (GUI)

Question 2

A client is experiencing intermittent connection resets when accessing a virtual server. The LTM Specialist observes that the backend servers are occasionally overwhelmed during traffic spikes. Which feature should be implemented to mitigate this impact on the backend servers?

Accepted Answer

Enable Connection Limits on the pool members.. Connection limits are the direct way to prevent backend servers from becoming overwhelmed. By setting a per-member connection limit, the BIG-IP will stop sending traffic to a server once it hits capacity, instead directing it to other available servers. This protects the backend from failure, ensuring the overall application remains available even when specific nodes are under extreme load conditions during traffic bursts.

Answer

Increase the idle timeout in the TCP profile.

Answer

Configure a SNAT pool with more IP addresses.

Answer

Change the load balancing method to Least Connections.

Question 3

A virtual server is configured with a OneConnect profile. What is the primary benefit of enabling OneConnect in this scenario?

Accepted Answer

It reduces the number of TCP connections opened on backend servers.. OneConnect allows the BIG-IP to reuse existing TCP connections between the BIG-IP and the backend pool members. By multiplexing many client-side requests over a smaller number of established server-side connections, it significantly reduces the overhead of TCP handshake (SYN/ACK) processes on the backend servers. This is particularly effective for high-traffic applications that use short-lived HTTP connections, leading to improved server resource utilization and overall application latency.

Answer

It enables hardware-based SSL offloading.

Answer

It forces all traffic to be encrypted using the strongest ciphers.

Answer

It eliminates the need for Source Address persistence.

Question 4

Which component should an administrator monitor to identify if the BIG-IP is hitting its licensed throughput limit?

Accepted Answer

The total system throughput statistics.. Monitoring the performance statistics, specifically bits per second or total throughput, is essential for capacity planning. If the BIG-IP exceeds its licensed throughput, it may rate-limit traffic, leading to performance degradation or dropped packets. Proactive monitoring ensures that administrators can upgrade licenses or scale out their BIG-IP deployments before hitting these hard performance caps that impact the end-user experience for critical production applications.

Answer

The system's disk space usage.

Answer

The number of configured virtual servers.

Answer

The total number of user accounts.

Question 5

When implementing SNAT Automap on a virtual server, what is the source IP address of the traffic as it arrives at the backend server?

Accepted Answer

The BIG-IP egress Self-IP address.. SNAT Automap causes the BIG-IP to translate the client's source IP address to the self-IP address of the egress interface used to communicate with the pool member. This is a key design pattern for ensuring that backend servers can reply directly to the BIG-IP without needing to update their default gateways, which is essential for deployments where the BIG-IP is not the default gateway for the backend servers.

Answer

The original client source IP address.

Answer

The Virtual Server IP address.

Answer

The default gateway address of the LTM.

Question 6

What happens to the BIG-IP system when the failover trigger occurs in a high-availability pair?

Accepted Answer

The secondary unit becomes the active unit and assumes the floating IPs.. During a failover, the standby unit assumes control by taking over the floating IP addresses and processing the traffic load. The former active unit transitions to standby mode. This process is orchestrated by the failover mechanism to ensure high availability, with the 'active' status moving to the secondary unit to prevent service disruption, provided that connection mirroring was configured for active sessions.

Answer

The configuration is wiped and reset to factory defaults.

Answer

The traffic is dropped until an administrator reboots the system.

Answer

The BIG-IP enters a maintenance mode to run diagnostics.

Question 7

An LTM administrator needs to ensure that a pool member remains in the pool but stops receiving new connections while existing connections are allowed to finish. Which action should the administrator perform?

Accepted Answer

Set the pool member state to 'Disabled'.. Setting a pool member to 'Disabled' state is the standard operational procedure for graceful maintenance. It prevents new connections from being established via the load balancing algorithm while allowing established persistence records or active sessions to complete their lifecycle. This is critical for preventing service disruption during application updates or server-side patching cycles, ensuring a seamless user experience while managing backend resources effectively.

Answer

Set the pool member state to 'Offline'.

Answer

Force the pool member to 'Offline'.

Answer

Delete the pool member from the pool.

Question 8

What is the primary function of the 'OneConnect' profile in a BIG-IP LTM environment?

Accepted Answer

It improves performance by reusing server-side TCP connections.. OneConnect allows the BIG-IP to reuse server-side TCP connections for multiple client-side requests. This reduces the overhead of repeatedly opening and closing TCP connections to the backend servers, which is highly beneficial for high-traffic applications. By maintaining a pool of idle connections to the servers, the system significantly improves performance and reduces the CPU load associated with the TCP three-way handshake on the backend.

Answer

It enables SSL offloading for encrypted traffic.

Answer

It provides a mechanism for persistence across multiple pools.

Answer

It forces traffic to use HTTP/2 instead of HTTP/1.1.

Question 9

An LTM administrator is configuring a new virtual server and needs to ensure that only specific source networks can access the application. Which TWO methods can be used to restrict access?

Accepted Answer

Configure an iRule in the CLIENT_ACCEPTED event to drop connections from unauthorized IPs.. Restricting access is a fundamental security requirement for LTM deployments. Using either an iRule to drop unauthorized connections or a Local Traffic Policy is a standard security practice. These methods provide granular control, allowing administrators to filter traffic based on source IP, CIDR blocks, or other criteria before the request is processed by the pool, effectively mitigating unauthorized access at the network edge.

Answer

Set the virtual server type to 'Forwarding (IP)'.

Answer

Assign a FastL4 profile to the virtual server to block unwanted traffic.

Answer

Increase the 'Idle Timeout' value in the TCP profile.

Question 10

When deploying a BIG-IP LTM in a high-availability (HA) pair, what is the purpose of the 'Failover' cable or link?

Accepted Answer

To detect the failure of the peer device via heartbeat signals.. The failover link, often implemented via dedicated network interfaces or shared backplanes, is used for the continuous exchange of heartbeat signals between the two BIG-IP devices. This ensures that each unit knows the operational status of its peer. If the heartbeat is lost, the standby unit assumes the active unit has failed and triggers a failover, promoting itself to active to maintain service continuity.

Answer

To synchronize the configuration files across both units.

Answer

To mirror active connection states for seamless failover.

Answer

To increase the total throughput capacity of the cluster.

Question 11

A BIG-IP administrator creates a Standard Virtual Server with source address translation set to 'Automated Map'. During peak hours, clients behind a specific corporate NAT gateway experience intermittent connection drops. What is the mechanism and impact of 'Automated Map' in this scenario?

Accepted Answer

It uses the system self IP addresses as translation addresses, which can lead to port exhaustion under high connection rates.. Automated Map creates a temporary SNAT translation using available self IP addresses on the BIG-IP system. If traffic volume exhausts available source ports for a given self IP, connection attempts fail. High client concurrency through a shared NAT gateway exacerbates port exhaustion on the SNAT address, leading to dropped connections.

Answer

It translates client source IPs using a dedicated SNAT pool, causing IP address collisions with upstream gateways.

Answer

It maps client source ports to a fixed range, restricting concurrent connections from individual subnet prefixes.

Answer

It disables connection tracking, forcing clients to establish direct routing paths that bypass the internal firewall.

Question 12

Which component of the BIG-IP LTM architecture is responsible for performing the actual load balancing decisions based on the configured algorithm?

Accepted Answer

Traffic Management Microkernel (TMM). The Traffic Management Microkernel (TMM) is the core engine of the BIG-IP. It handles all packet processing, protocol parsing, and load balancing decisions. Mastering TMM's role is essential for LTM certification, as it allows administrators to understand why the BIG-IP can perform high-speed Layer 7 inspection and why it is so much more efficient than software-based load balancers that rely on general-purpose operating system networking stacks.

Answer

Configuration Utility (GUI)

Answer

Local Traffic Manager (LTM) daemon

Answer

iControl API

Question 13

Refer to the exhibit. An administrator notices that users connecting to both port 80 and port 443 are being persisted to the same backend server. Why is this occurring?

Accepted Answer

The 'match-across-services' setting is enabled in the persistence profile.. The persistence profile /Common/my_src_persist has 'match-across-services' enabled. This feature instructs the BIG-IP to ignore the destination port when calculating the persistence record. Consequently, when a client hits the virtual server on port 80, the persistence record is created based on the source IP. When the same client subsequently hits a virtual server on port 443, the BIG-IP identifies the existing persistence entry and directs the traffic to the same pool member.

Answer

The persistence timeout is too high, causing records to overlap across services.

Answer

The persistence profile is applied to the virtual server without a mask.

Answer

The virtual server is using a shared pool, forcing persistence across services.

Question 14

Refer to the exhibit. The web server logs show the source IP is the BIG-IP Self IP. Why is this happening despite the X-Forwarded-For configuration?

Accepted Answer

SNAT is enabled on the virtual server, causing source translation.. The 'Insert X-Forwarded-For' setting only adds an HTTP header; it does not change the source IP address of the TCP packet. If the backend server sees the BIG-IP Self IP, it is because SNAT (Secure Network Address Translation) is active and is translating the client's source IP to the BIG-IP's address. The X-Forwarded-For header is present, but the server must be configured to read it.

Answer

The HTTP profile is misconfigured and needs an iRule to function.

Answer

The virtual server is missing a Client SSL profile.

Answer

The pool members are in a different subnet than the virtual server.

Question 15

Refer to the exhibit. An administrator wants to modify this configuration to support persistence for this application. Which command should be added to the virtual server configuration?

Accepted Answer

persist /Common/cookie. To enable persistence on a Virtual Server, you must attach a persistence profile to the 'persist' attribute of the virtual server object. Simply having the pool members defined is insufficient for maintaining session affinity. This is a core concept in BIG-IP configuration; without a persistence profile, the LTM defaults to the load balancing algorithm, which may bounce users between different servers, breaking application sessions.

Answer

profile /Common/cookie

Answer

persistence-mode cookie

Answer

pool /Common/pool_http persist

Question 16

Refer to the exhibit. The administrator wants to use cookie persistence, but it is not working. What is missing from the configuration?

Accepted Answer

The virtual server is missing a default persistence profile.. The cookie persistence profile is defined but not actually attached to the virtual server. In BIG-IP LTM, simply creating a profile is not enough; it must be explicitly assigned to the virtual server under the 'persistence' section of the virtual server configuration. Without this assignment, the LTM does not know to inject the cookie into the response headers.

Answer

The cookie profile mode must be set to 'rewrite'.

Answer

The HTTP profile needs to be set to 'oneconnect'.

Answer

The virtual server requires an iRule to parse the cookie.

Question 17

An administrator needs to perform a graceful shutdown of a server in a load-balanced pool without interrupting existing user sessions. Which action should be taken?

Accepted Answer

Set the node status to 'Disabled'.. To gracefully remove a node, the administrator should set the node or pool member state to 'Disabled'. When a node is 'Disabled', the BIG-IP stops sending new connections to it but allows existing connections to persist until they complete or time out. This is critical for maintaining a positive user experience during maintenance windows, preventing the immediate termination of active sessions that would occur if the node were set to 'Forced Offline'.

Answer

Set the node status to 'Forced Offline'.

Answer

Delete the node from the pool configuration.

Answer

Disable the health monitor associated with the node.

Question 18

An administrator configures a standard Virtual Server with a destination IP of 10.10.10.20:443, using a SNAT Pool instead of Auto Map. During peak hours, connections begin to fail because the SNAT pool only contains a single IP address and port exhaustion occurs. Which architectural adjustment best resolves this issue while maintaining security?

Accepted Answer

Add additional IP addresses to the existing SNAT pool to increase the total number of available ephemeral translation ports.. Expanding the SNAT pool by adding multiple IP addresses provides a larger translation address space and multiplies the available ephemeral port capacity per destination. This prevents port exhaustion during traffic spikes without sacrificing the controlled source IP mapping required by downstream security policies.

Answer

Switch the source address translation setting from SNAT Pool to Auto Map to leverage all available self IP addresses.

Answer

Increase the connection timeout profile value to allow closed connections to linger and free up sockets more gradually.

Answer

Configure a OneConnect profile on the virtual server to enable HTTP connection multiplexing across backend servers.

Question 19

Which command is used to view the current status and statistics of a pool from the command line?

Accepted Answer

tmsh show ltm pool. The 'tmsh show ltm pool' command is the standard method for viewing real-time pool status and traffic statistics. It provides a comprehensive view of member health, current connection counts, and traffic throughput. This is an essential skill for LTM administrators for performing quick health checks and verifying that traffic is being distributed as expected across the backend server farm without relying on the GUI.

Answer

tmsh list ltm pool

Answer

tmsh view ltm pool

Answer

tmsh display ltm pool

Question 20

A client is experiencing intermittent connection failures. You suspect the BIG-IP is SNATing traffic. If the SNAT pool is exhausted, what behavior will the BIG-IP exhibit?

Accepted Answer

It will drop new incoming connections from clients.. SNAT pool exhaustion occurs when the BIG-IP runs out of available source ports to translate client connections. When this happens, new requests from clients will be dropped or rejected because the LTM cannot map the connection to a valid source IP/port combination. Identifying this is crucial during performance troubleshooting, as it often masquerades as generic network connectivity issues or server-side application errors.

Answer

It will automatically increase the SNAT pool size.

Answer

It will bypass the SNAT pool and use the Self-IP.

Answer

It will rotate the source IP to the next available virtual address.