F5-CTS-LTM Practice Test 3 — 10 Questions

Question 1

What is the primary function of a 'Clone Pool' in an LTM virtual server configuration?

Accepted Answer

To mirror incoming traffic to an out-of-band monitoring device.. A Clone Pool is used for traffic replication. It allows the BIG-IP to send a copy of the traffic (packets) to a secondary destination, such as an IDS (Intrusion Detection System) or a packet capture device, without affecting the primary traffic flow to the actual application servers. This is a common requirement for security compliance and troubleshooting, as it allows deep packet inspection on traffic that is intended for the production backend.

Answer

To provide high availability for the backend pool members.

Answer

To distribute traffic across two different data centers simultaneously.

Answer

To act as a backup pool if the primary pool fails.

Question 2

An administrator implements a pool monitor using an HTTP GET request to verify application health. The application returns an HTTP 200 OK status, but the HTML body contains an error string indicating database connectivity failure. How should the administrator configure the monitor to mark the pool member down when this error appears?

Accepted Answer

Configure the monitor with a 'Receive Disable' string matching the database error message.. Advanced monitors support 'Send' and 'Receive' string configurations. By specifying a 'Receive' string, the BIG-IP inspects the response body for expected content. Conversely, using a 'Receive Disable' string allows the administrator to specify a string that, if matched in the body, immediately marks the pool member down.

Answer

Configure the monitor with a 'Receive' string that matches the database error message to validate failure.

Answer

Change the monitor type to ICMP to detect underlying TCP socket failures automatically.

Answer

Enable reverse validation in the pool properties to invert HTTP status code return logic.

Question 3

An administrator wants to redirect all incoming HTTP traffic on port 80 to HTTPS on port 443. What is the most effective approach?

Accepted Answer

Use an iRule on a separate HTTP virtual server to send a redirect.. Creating a separate HTTP virtual server that uses an iRule to perform a 301 or 302 redirect is the most effective method. This keeps the logic clean and separates the handling of unencrypted traffic (redirecting it) from the encrypted virtual server that handles the actual application traffic, ensuring clear separation of concerns in the configuration while maintaining a secure user experience.

Answer

Configure the existing HTTPS VS to also listen on port 80.

Answer

Enable 'Force HTTPS' in the pool configuration.

Answer

Use a SNAT pool to force traffic to port 443.

Question 4

Which THREE criteria determine how a BIG-IP selects a pool member for a new client connection?

Accepted Answer

The configured load balancing method.. Load balancing decisions are multi-faceted. The BIG-IP considers the configured load balancing method (e.g., Round Robin, Least Connections), the status of the pool members (only active members are eligible), and any active persistence records that might override the load balancing method for returning clients. These three factors combine to ensure traffic is distributed intelligently and consistently across the available server pool.

Answer

The physical location of the client's ISP.

Answer

The CPU speed of the client's device.

Question 5

An administrator wants to use a single Virtual Server to handle both HTTP and HTTPS traffic for the same domain. What is the recommended way to achieve this?

Accepted Answer

Use two Virtual Servers and an iRule to redirect port 80 to 443.. The most efficient way to manage both HTTP and HTTPS is to create two separate virtual servers: one on port 80 and one on port 443. The port 80 virtual server should then use an iRule to redirect users to the HTTPS virtual server. This ensures that all traffic is encrypted while providing a seamless user experience, as the user only needs to type the domain name to be redirected correctly.

Answer

Use a single Virtual Server on port 80 with an iRule to handle SSL.

Answer

Use a single Virtual Server with 'Any' port enabled.

Answer

Create one Virtual Server on 443 and disable port 80.

Question 6

Which component of the BIG-IP architecture is responsible for performing the actual load balancing of traffic to pool members?

Accepted Answer

The TMM (Traffic Management Microkernel). The TMM (Traffic Management Microkernel) is the heart of the BIG-IP system. It is a specialized, high-performance kernel that handles all traffic processing, including load balancing, SSL termination, and iRule execution. Unlike the standard Linux kernel, which handles management tasks, the TMM is optimized for high-throughput packet processing, which is the core requirement for LTM services in modern network environments.

Answer

The Linux kernel

Answer

The Control Plane

Answer

The Configuration Utility (GUI)

Question 7

A client is experiencing intermittent connection resets when accessing a virtual server. The LTM Specialist observes that the backend servers are occasionally overwhelmed during traffic spikes. Which feature should be implemented to mitigate this impact on the backend servers?

Accepted Answer

Enable Connection Limits on the pool members.. Connection limits are the direct way to prevent backend servers from becoming overwhelmed. By setting a per-member connection limit, the BIG-IP will stop sending traffic to a server once it hits capacity, instead directing it to other available servers. This protects the backend from failure, ensuring the overall application remains available even when specific nodes are under extreme load conditions during traffic bursts.

Answer

Increase the idle timeout in the TCP profile.

Answer

Configure a SNAT pool with more IP addresses.

Answer

Change the load balancing method to Least Connections.

Question 8

A virtual server is configured with a OneConnect profile. What is the primary benefit of enabling OneConnect in this scenario?

Accepted Answer

It reduces the number of TCP connections opened on backend servers.. OneConnect allows the BIG-IP to reuse existing TCP connections between the BIG-IP and the backend pool members. By multiplexing many client-side requests over a smaller number of established server-side connections, it significantly reduces the overhead of TCP handshake (SYN/ACK) processes on the backend servers. This is particularly effective for high-traffic applications that use short-lived HTTP connections, leading to improved server resource utilization and overall application latency.

Answer

It enables hardware-based SSL offloading.

Answer

It forces all traffic to be encrypted using the strongest ciphers.

Answer

It eliminates the need for Source Address persistence.

Question 9

Which component should an administrator monitor to identify if the BIG-IP is hitting its licensed throughput limit?

Accepted Answer

The total system throughput statistics.. Monitoring the performance statistics, specifically bits per second or total throughput, is essential for capacity planning. If the BIG-IP exceeds its licensed throughput, it may rate-limit traffic, leading to performance degradation or dropped packets. Proactive monitoring ensures that administrators can upgrade licenses or scale out their BIG-IP deployments before hitting these hard performance caps that impact the end-user experience for critical production applications.

Answer

The system's disk space usage.

Answer

The number of configured virtual servers.

Answer

The total number of user accounts.

Question 10

When implementing SNAT Automap on a virtual server, what is the source IP address of the traffic as it arrives at the backend server?

Accepted Answer

The BIG-IP egress Self-IP address.. SNAT Automap causes the BIG-IP to translate the client's source IP address to the self-IP address of the egress interface used to communicate with the pool member. This is a key design pattern for ensuring that backend servers can reply directly to the BIG-IP without needing to update their default gateways, which is essential for deployments where the BIG-IP is not the default gateway for the backend servers.

Answer

The original client source IP address.

Answer

The Virtual Server IP address.

Answer

The default gateway address of the LTM.