F5-CTS-LTM Practice Test 2 — 30 Questions

Question 1

What happens to the BIG-IP system when the failover trigger occurs in a high-availability pair?

Accepted Answer

The secondary unit becomes the active unit and assumes the floating IPs.. During a failover, the standby unit assumes control by taking over the floating IP addresses and processing the traffic load. The former active unit transitions to standby mode. This process is orchestrated by the failover mechanism to ensure high availability, with the 'active' status moving to the secondary unit to prevent service disruption, provided that connection mirroring was configured for active sessions.

Answer

The configuration is wiped and reset to factory defaults.

Answer

The traffic is dropped until an administrator reboots the system.

Answer

The BIG-IP enters a maintenance mode to run diagnostics.

Question 2

An LTM administrator needs to ensure that a pool member remains in the pool but stops receiving new connections while existing connections are allowed to finish. Which action should the administrator perform?

Accepted Answer

Set the pool member state to 'Disabled'.. Setting a pool member to 'Disabled' state is the standard operational procedure for graceful maintenance. It prevents new connections from being established via the load balancing algorithm while allowing established persistence records or active sessions to complete their lifecycle. This is critical for preventing service disruption during application updates or server-side patching cycles, ensuring a seamless user experience while managing backend resources effectively.

Answer

Set the pool member state to 'Offline'.

Answer

Force the pool member to 'Offline'.

Answer

Delete the pool member from the pool.

Question 3

What is the primary function of the 'OneConnect' profile in a BIG-IP LTM environment?

Accepted Answer

It improves performance by reusing server-side TCP connections.. OneConnect allows the BIG-IP to reuse server-side TCP connections for multiple client-side requests. This reduces the overhead of repeatedly opening and closing TCP connections to the backend servers, which is highly beneficial for high-traffic applications. By maintaining a pool of idle connections to the servers, the system significantly improves performance and reduces the CPU load associated with the TCP three-way handshake on the backend.

Answer

It enables SSL offloading for encrypted traffic.

Answer

It provides a mechanism for persistence across multiple pools.

Answer

It forces traffic to use HTTP/2 instead of HTTP/1.1.

Question 4

An LTM administrator is configuring a new virtual server and needs to ensure that only specific source networks can access the application. Which TWO methods can be used to restrict access?

Accepted Answer

Configure an iRule in the CLIENT_ACCEPTED event to drop connections from unauthorized IPs.. Restricting access is a fundamental security requirement for LTM deployments. Using either an iRule to drop unauthorized connections or a Local Traffic Policy is a standard security practice. These methods provide granular control, allowing administrators to filter traffic based on source IP, CIDR blocks, or other criteria before the request is processed by the pool, effectively mitigating unauthorized access at the network edge.

Answer

Set the virtual server type to 'Forwarding (IP)'.

Answer

Assign a FastL4 profile to the virtual server to block unwanted traffic.

Answer

Increase the 'Idle Timeout' value in the TCP profile.

Question 5

When deploying a BIG-IP LTM in a high-availability (HA) pair, what is the purpose of the 'Failover' cable or link?

Accepted Answer

To detect the failure of the peer device via heartbeat signals.. The failover link, often implemented via dedicated network interfaces or shared backplanes, is used for the continuous exchange of heartbeat signals between the two BIG-IP devices. This ensures that each unit knows the operational status of its peer. If the heartbeat is lost, the standby unit assumes the active unit has failed and triggers a failover, promoting itself to active to maintain service continuity.

Answer

To synchronize the configuration files across both units.

Answer

To mirror active connection states for seamless failover.

Answer

To increase the total throughput capacity of the cluster.

Question 6

A BIG-IP administrator creates a Standard Virtual Server with source address translation set to 'Automated Map'. During peak hours, clients behind a specific corporate NAT gateway experience intermittent connection drops. What is the mechanism and impact of 'Automated Map' in this scenario?

Accepted Answer

It uses the system self IP addresses as translation addresses, which can lead to port exhaustion under high connection rates.. Automated Map creates a temporary SNAT translation using available self IP addresses on the BIG-IP system. If traffic volume exhausts available source ports for a given self IP, connection attempts fail. High client concurrency through a shared NAT gateway exacerbates port exhaustion on the SNAT address, leading to dropped connections.

Answer

It translates client source IPs using a dedicated SNAT pool, causing IP address collisions with upstream gateways.

Answer

It maps client source ports to a fixed range, restricting concurrent connections from individual subnet prefixes.

Answer

It disables connection tracking, forcing clients to establish direct routing paths that bypass the internal firewall.

Question 7

Which component of the BIG-IP LTM architecture is responsible for performing the actual load balancing decisions based on the configured algorithm?

Accepted Answer

Traffic Management Microkernel (TMM). The Traffic Management Microkernel (TMM) is the core engine of the BIG-IP. It handles all packet processing, protocol parsing, and load balancing decisions. Mastering TMM's role is essential for LTM certification, as it allows administrators to understand why the BIG-IP can perform high-speed Layer 7 inspection and why it is so much more efficient than software-based load balancers that rely on general-purpose operating system networking stacks.

Answer

Configuration Utility (GUI)

Answer

Local Traffic Manager (LTM) daemon

Answer

iControl API

Question 8

Refer to the exhibit. An administrator notices that users connecting to both port 80 and port 443 are being persisted to the same backend server. Why is this occurring?

Accepted Answer

The 'match-across-services' setting is enabled in the persistence profile.. The persistence profile /Common/my_src_persist has 'match-across-services' enabled. This feature instructs the BIG-IP to ignore the destination port when calculating the persistence record. Consequently, when a client hits the virtual server on port 80, the persistence record is created based on the source IP. When the same client subsequently hits a virtual server on port 443, the BIG-IP identifies the existing persistence entry and directs the traffic to the same pool member.

Answer

The persistence timeout is too high, causing records to overlap across services.

Answer

The persistence profile is applied to the virtual server without a mask.

Answer

The virtual server is using a shared pool, forcing persistence across services.

Question 9

Refer to the exhibit. The web server logs show the source IP is the BIG-IP Self IP. Why is this happening despite the X-Forwarded-For configuration?

Accepted Answer

SNAT is enabled on the virtual server, causing source translation.. The 'Insert X-Forwarded-For' setting only adds an HTTP header; it does not change the source IP address of the TCP packet. If the backend server sees the BIG-IP Self IP, it is because SNAT (Secure Network Address Translation) is active and is translating the client's source IP to the BIG-IP's address. The X-Forwarded-For header is present, but the server must be configured to read it.

Answer

The HTTP profile is misconfigured and needs an iRule to function.

Answer

The virtual server is missing a Client SSL profile.

Answer

The pool members are in a different subnet than the virtual server.

Question 10

Refer to the exhibit. An administrator wants to modify this configuration to support persistence for this application. Which command should be added to the virtual server configuration?

Accepted Answer

persist /Common/cookie. To enable persistence on a Virtual Server, you must attach a persistence profile to the 'persist' attribute of the virtual server object. Simply having the pool members defined is insufficient for maintaining session affinity. This is a core concept in BIG-IP configuration; without a persistence profile, the LTM defaults to the load balancing algorithm, which may bounce users between different servers, breaking application sessions.

Answer

profile /Common/cookie

Answer

persistence-mode cookie

Answer

pool /Common/pool_http persist

Question 11

Refer to the exhibit. The administrator wants to use cookie persistence, but it is not working. What is missing from the configuration?

Accepted Answer

The virtual server is missing a default persistence profile.. The cookie persistence profile is defined but not actually attached to the virtual server. In BIG-IP LTM, simply creating a profile is not enough; it must be explicitly assigned to the virtual server under the 'persistence' section of the virtual server configuration. Without this assignment, the LTM does not know to inject the cookie into the response headers.

Answer

The cookie profile mode must be set to 'rewrite'.

Answer

The HTTP profile needs to be set to 'oneconnect'.

Answer

The virtual server requires an iRule to parse the cookie.

Question 12

An administrator needs to perform a graceful shutdown of a server in a load-balanced pool without interrupting existing user sessions. Which action should be taken?

Accepted Answer

Set the node status to 'Disabled'.. To gracefully remove a node, the administrator should set the node or pool member state to 'Disabled'. When a node is 'Disabled', the BIG-IP stops sending new connections to it but allows existing connections to persist until they complete or time out. This is critical for maintaining a positive user experience during maintenance windows, preventing the immediate termination of active sessions that would occur if the node were set to 'Forced Offline'.

Answer

Set the node status to 'Forced Offline'.

Answer

Delete the node from the pool configuration.

Answer

Disable the health monitor associated with the node.

Question 13

An administrator configures a standard Virtual Server with a destination IP of 10.10.10.20:443, using a SNAT Pool instead of Auto Map. During peak hours, connections begin to fail because the SNAT pool only contains a single IP address and port exhaustion occurs. Which architectural adjustment best resolves this issue while maintaining security?

Accepted Answer

Add additional IP addresses to the existing SNAT pool to increase the total number of available ephemeral translation ports.. Expanding the SNAT pool by adding multiple IP addresses provides a larger translation address space and multiplies the available ephemeral port capacity per destination. This prevents port exhaustion during traffic spikes without sacrificing the controlled source IP mapping required by downstream security policies.

Answer

Switch the source address translation setting from SNAT Pool to Auto Map to leverage all available self IP addresses.

Answer

Increase the connection timeout profile value to allow closed connections to linger and free up sockets more gradually.

Answer

Configure a OneConnect profile on the virtual server to enable HTTP connection multiplexing across backend servers.

Question 14

Which command is used to view the current status and statistics of a pool from the command line?

Accepted Answer

tmsh show ltm pool. The 'tmsh show ltm pool' command is the standard method for viewing real-time pool status and traffic statistics. It provides a comprehensive view of member health, current connection counts, and traffic throughput. This is an essential skill for LTM administrators for performing quick health checks and verifying that traffic is being distributed as expected across the backend server farm without relying on the GUI.

Answer

tmsh list ltm pool

Answer

tmsh view ltm pool

Answer

tmsh display ltm pool

Question 15

A client is experiencing intermittent connection failures. You suspect the BIG-IP is SNATing traffic. If the SNAT pool is exhausted, what behavior will the BIG-IP exhibit?

Accepted Answer

It will drop new incoming connections from clients.. SNAT pool exhaustion occurs when the BIG-IP runs out of available source ports to translate client connections. When this happens, new requests from clients will be dropped or rejected because the LTM cannot map the connection to a valid source IP/port combination. Identifying this is crucial during performance troubleshooting, as it often masquerades as generic network connectivity issues or server-side application errors.

Answer

It will automatically increase the SNAT pool size.

Answer

It will bypass the SNAT pool and use the Self-IP.

Answer

It will rotate the source IP to the next available virtual address.

Question 16

An LTM administrator needs to ensure that only encrypted traffic is accepted by a Virtual Server. Which profile should be configured?

Accepted Answer

Client SSL profile. The Client SSL profile is required to handle incoming encrypted traffic. By assigning this profile, the BIG-IP acts as the SSL endpoint. This is a foundational concept in secure application delivery. Properly configuring SSL termination ensures that the BIG-IP can inspect the traffic for security threats and load-balance it effectively while offloading the computationally expensive decryption process from the backend application servers.

Answer

Server SSL profile

Answer

TCP profile

Answer

HTTP profile

Question 17

Refer to the exhibit. The monitor is failing even though the page exists. What is the most likely cause?

Accepted Answer

The receive string is too restrictive.. The 'recv' string is set to '200 OK', but the HTTP monitor often returns the full response, including headers. If the server response contains the status code without the exact string '200 OK', or if the casing differs, the monitor will fail. This scenario emphasizes the importance of precise regex or string matching in health monitors to avoid false negatives in service availability monitoring.

Answer

The monitor timeout is too low.

Answer

The HTTP version is unsupported.

Answer

The send string is missing the User-Agent header.

Question 18

When troubleshooting a persistent connection issue, which LTM feature allows you to view active persistence entries?

Accepted Answer

Traffic Management Shell (tmsh) persistence table. The persistence table contains a real-time mapping of client sessions to specific pool members. Viewing this table is the most effective way to determine if persistence is working correctly. It is a fundamental troubleshooting step for LTM specialists, as it confirms whether client traffic is being directed to the intended server or if a conflict in the persistence configuration is causing sessions to be misrouted.

Answer

Configuration Utility Dashboard

Answer

Virtual Server Statistics

Answer

Log files in /var/log/ltm

Question 19

An administrator observes that the 'Least Connections' load balancing algorithm is not distributing traffic as evenly as expected. What is the most probable reason?

Accepted Answer

Persistence profiles are overriding the load balancing algorithm.. Least Connections distributes traffic based on the number of active connections to each pool member. If persistence is enabled, the BIG-IP will send subsequent requests from the same client to the same server, regardless of the load balancing algorithm. Consequently, persistence overrides the load balancing decision, leading to uneven distribution if certain sessions are longer or more active than others.

Answer

The pool members have different weight values configured.

Answer

The TCP profile is set to 'OneConnect' mode.

Answer

The health monitor is failing intermittently.

Question 20

What is the primary risk of using a wildcard (0.0.0.0/0) virtual server on a BIG-IP system?

Accepted Answer

It significantly increases the attack surface by exposing all ports.. A wildcard virtual server intercepts all traffic directed to the BIG-IP on any port for any destination IP address. If not carefully configured with specific iRules or policies, this can lead to security vulnerabilities, such as exposing management or internal interfaces to public traffic. It significantly increases the attack surface of the network and is generally discouraged unless strictly required for specific gateway or firewall-like functionalities.

Answer

It prevents the use of SSL profiles on the virtual server.

Answer

It causes high CPU utilization due to packet inspection overhead.

Answer

It disables the BIG-IP's ability to use persistence.