F5-CTS-LTM Practice Test 4 — 10 Questions

Question 1

What happens to the BIG-IP system when the failover trigger occurs in a high-availability pair?

Accepted Answer

The secondary unit becomes the active unit and assumes the floating IPs.. During a failover, the standby unit assumes control by taking over the floating IP addresses and processing the traffic load. The former active unit transitions to standby mode. This process is orchestrated by the failover mechanism to ensure high availability, with the 'active' status moving to the secondary unit to prevent service disruption, provided that connection mirroring was configured for active sessions.

Answer

The configuration is wiped and reset to factory defaults.

Answer

The traffic is dropped until an administrator reboots the system.

Answer

The BIG-IP enters a maintenance mode to run diagnostics.

Question 2

An LTM administrator needs to ensure that a pool member remains in the pool but stops receiving new connections while existing connections are allowed to finish. Which action should the administrator perform?

Accepted Answer

Set the pool member state to 'Disabled'.. Setting a pool member to 'Disabled' state is the standard operational procedure for graceful maintenance. It prevents new connections from being established via the load balancing algorithm while allowing established persistence records or active sessions to complete their lifecycle. This is critical for preventing service disruption during application updates or server-side patching cycles, ensuring a seamless user experience while managing backend resources effectively.

Answer

Set the pool member state to 'Offline'.

Answer

Force the pool member to 'Offline'.

Answer

Delete the pool member from the pool.

Question 3

What is the primary function of the 'OneConnect' profile in a BIG-IP LTM environment?

Accepted Answer

It improves performance by reusing server-side TCP connections.. OneConnect allows the BIG-IP to reuse server-side TCP connections for multiple client-side requests. This reduces the overhead of repeatedly opening and closing TCP connections to the backend servers, which is highly beneficial for high-traffic applications. By maintaining a pool of idle connections to the servers, the system significantly improves performance and reduces the CPU load associated with the TCP three-way handshake on the backend.

Answer

It enables SSL offloading for encrypted traffic.

Answer

It provides a mechanism for persistence across multiple pools.

Answer

It forces traffic to use HTTP/2 instead of HTTP/1.1.

Question 4

An LTM administrator is configuring a new virtual server and needs to ensure that only specific source networks can access the application. Which TWO methods can be used to restrict access?

Accepted Answer

Configure an iRule in the CLIENT_ACCEPTED event to drop connections from unauthorized IPs.. Restricting access is a fundamental security requirement for LTM deployments. Using either an iRule to drop unauthorized connections or a Local Traffic Policy is a standard security practice. These methods provide granular control, allowing administrators to filter traffic based on source IP, CIDR blocks, or other criteria before the request is processed by the pool, effectively mitigating unauthorized access at the network edge.

Answer

Set the virtual server type to 'Forwarding (IP)'.

Answer

Assign a FastL4 profile to the virtual server to block unwanted traffic.

Answer

Increase the 'Idle Timeout' value in the TCP profile.

Question 5

When deploying a BIG-IP LTM in a high-availability (HA) pair, what is the purpose of the 'Failover' cable or link?

Accepted Answer

To detect the failure of the peer device via heartbeat signals.. The failover link, often implemented via dedicated network interfaces or shared backplanes, is used for the continuous exchange of heartbeat signals between the two BIG-IP devices. This ensures that each unit knows the operational status of its peer. If the heartbeat is lost, the standby unit assumes the active unit has failed and triggers a failover, promoting itself to active to maintain service continuity.

Answer

To synchronize the configuration files across both units.

Answer

To mirror active connection states for seamless failover.

Answer

To increase the total throughput capacity of the cluster.

Question 6

A BIG-IP administrator creates a Standard Virtual Server with source address translation set to 'Automated Map'. During peak hours, clients behind a specific corporate NAT gateway experience intermittent connection drops. What is the mechanism and impact of 'Automated Map' in this scenario?

Accepted Answer

It uses the system self IP addresses as translation addresses, which can lead to port exhaustion under high connection rates.. Automated Map creates a temporary SNAT translation using available self IP addresses on the BIG-IP system. If traffic volume exhausts available source ports for a given self IP, connection attempts fail. High client concurrency through a shared NAT gateway exacerbates port exhaustion on the SNAT address, leading to dropped connections.

Answer

It translates client source IPs using a dedicated SNAT pool, causing IP address collisions with upstream gateways.

Answer

It maps client source ports to a fixed range, restricting concurrent connections from individual subnet prefixes.

Answer

It disables connection tracking, forcing clients to establish direct routing paths that bypass the internal firewall.

Question 7

Which component of the BIG-IP LTM architecture is responsible for performing the actual load balancing decisions based on the configured algorithm?

Accepted Answer

Traffic Management Microkernel (TMM). The Traffic Management Microkernel (TMM) is the core engine of the BIG-IP. It handles all packet processing, protocol parsing, and load balancing decisions. Mastering TMM's role is essential for LTM certification, as it allows administrators to understand why the BIG-IP can perform high-speed Layer 7 inspection and why it is so much more efficient than software-based load balancers that rely on general-purpose operating system networking stacks.

Answer

Configuration Utility (GUI)

Answer

Local Traffic Manager (LTM) daemon

Answer

iControl API

Question 8

Refer to the exhibit. An administrator notices that users connecting to both port 80 and port 443 are being persisted to the same backend server. Why is this occurring?

Accepted Answer

The 'match-across-services' setting is enabled in the persistence profile.. The persistence profile /Common/my_src_persist has 'match-across-services' enabled. This feature instructs the BIG-IP to ignore the destination port when calculating the persistence record. Consequently, when a client hits the virtual server on port 80, the persistence record is created based on the source IP. When the same client subsequently hits a virtual server on port 443, the BIG-IP identifies the existing persistence entry and directs the traffic to the same pool member.

Answer

The persistence timeout is too high, causing records to overlap across services.

Answer

The persistence profile is applied to the virtual server without a mask.

Answer

The virtual server is using a shared pool, forcing persistence across services.

Question 9

Refer to the exhibit. The web server logs show the source IP is the BIG-IP Self IP. Why is this happening despite the X-Forwarded-For configuration?

Accepted Answer

SNAT is enabled on the virtual server, causing source translation.. The 'Insert X-Forwarded-For' setting only adds an HTTP header; it does not change the source IP address of the TCP packet. If the backend server sees the BIG-IP Self IP, it is because SNAT (Secure Network Address Translation) is active and is translating the client's source IP to the BIG-IP's address. The X-Forwarded-For header is present, but the server must be configured to read it.

Answer

The HTTP profile is misconfigured and needs an iRule to function.

Answer

The virtual server is missing a Client SSL profile.

Answer

The pool members are in a different subnet than the virtual server.

Question 10

Refer to the exhibit. An administrator wants to modify this configuration to support persistence for this application. Which command should be added to the virtual server configuration?

Accepted Answer

persist /Common/cookie. To enable persistence on a Virtual Server, you must attach a persistence profile to the 'persist' attribute of the virtual server object. Simply having the pool members defined is insufficient for maintaining session affinity. This is a core concept in BIG-IP configuration; without a persistence profile, the LTM defaults to the load balancing algorithm, which may bounce users between different servers, breaking application sessions.

Answer

profile /Common/cookie

Answer

persistence-mode cookie

Answer

pool /Common/pool_http persist