F5-CTS-LTM Practice Test 5 — 10 Questions

Question 1

Refer to the exhibit. The administrator wants to use cookie persistence, but it is not working. What is missing from the configuration?

Accepted Answer

The virtual server is missing a default persistence profile.. The cookie persistence profile is defined but not actually attached to the virtual server. In BIG-IP LTM, simply creating a profile is not enough; it must be explicitly assigned to the virtual server under the 'persistence' section of the virtual server configuration. Without this assignment, the LTM does not know to inject the cookie into the response headers.

Answer

The cookie profile mode must be set to 'rewrite'.

Answer

The HTTP profile needs to be set to 'oneconnect'.

Answer

The virtual server requires an iRule to parse the cookie.

Question 2

An administrator needs to perform a graceful shutdown of a server in a load-balanced pool without interrupting existing user sessions. Which action should be taken?

Accepted Answer

Set the node status to 'Disabled'.. To gracefully remove a node, the administrator should set the node or pool member state to 'Disabled'. When a node is 'Disabled', the BIG-IP stops sending new connections to it but allows existing connections to persist until they complete or time out. This is critical for maintaining a positive user experience during maintenance windows, preventing the immediate termination of active sessions that would occur if the node were set to 'Forced Offline'.

Answer

Set the node status to 'Forced Offline'.

Answer

Delete the node from the pool configuration.

Answer

Disable the health monitor associated with the node.

Question 3

An administrator configures a standard Virtual Server with a destination IP of 10.10.10.20:443, using a SNAT Pool instead of Auto Map. During peak hours, connections begin to fail because the SNAT pool only contains a single IP address and port exhaustion occurs. Which architectural adjustment best resolves this issue while maintaining security?

Accepted Answer

Add additional IP addresses to the existing SNAT pool to increase the total number of available ephemeral translation ports.. Expanding the SNAT pool by adding multiple IP addresses provides a larger translation address space and multiplies the available ephemeral port capacity per destination. This prevents port exhaustion during traffic spikes without sacrificing the controlled source IP mapping required by downstream security policies.

Answer

Switch the source address translation setting from SNAT Pool to Auto Map to leverage all available self IP addresses.

Answer

Increase the connection timeout profile value to allow closed connections to linger and free up sockets more gradually.

Answer

Configure a OneConnect profile on the virtual server to enable HTTP connection multiplexing across backend servers.

Question 4

Which command is used to view the current status and statistics of a pool from the command line?

Accepted Answer

tmsh show ltm pool. The 'tmsh show ltm pool' command is the standard method for viewing real-time pool status and traffic statistics. It provides a comprehensive view of member health, current connection counts, and traffic throughput. This is an essential skill for LTM administrators for performing quick health checks and verifying that traffic is being distributed as expected across the backend server farm without relying on the GUI.

Answer

tmsh list ltm pool

Answer

tmsh view ltm pool

Answer

tmsh display ltm pool

Question 5

A client is experiencing intermittent connection failures. You suspect the BIG-IP is SNATing traffic. If the SNAT pool is exhausted, what behavior will the BIG-IP exhibit?

Accepted Answer

It will drop new incoming connections from clients.. SNAT pool exhaustion occurs when the BIG-IP runs out of available source ports to translate client connections. When this happens, new requests from clients will be dropped or rejected because the LTM cannot map the connection to a valid source IP/port combination. Identifying this is crucial during performance troubleshooting, as it often masquerades as generic network connectivity issues or server-side application errors.

Answer

It will automatically increase the SNAT pool size.

Answer

It will bypass the SNAT pool and use the Self-IP.

Answer

It will rotate the source IP to the next available virtual address.

Question 6

An LTM administrator needs to ensure that only encrypted traffic is accepted by a Virtual Server. Which profile should be configured?

Accepted Answer

Client SSL profile. The Client SSL profile is required to handle incoming encrypted traffic. By assigning this profile, the BIG-IP acts as the SSL endpoint. This is a foundational concept in secure application delivery. Properly configuring SSL termination ensures that the BIG-IP can inspect the traffic for security threats and load-balance it effectively while offloading the computationally expensive decryption process from the backend application servers.

Answer

Server SSL profile

Answer

TCP profile

Answer

HTTP profile

Question 7

Refer to the exhibit. The monitor is failing even though the page exists. What is the most likely cause?

Accepted Answer

The receive string is too restrictive.. The 'recv' string is set to '200 OK', but the HTTP monitor often returns the full response, including headers. If the server response contains the status code without the exact string '200 OK', or if the casing differs, the monitor will fail. This scenario emphasizes the importance of precise regex or string matching in health monitors to avoid false negatives in service availability monitoring.

Answer

The monitor timeout is too low.

Answer

The HTTP version is unsupported.

Answer

The send string is missing the User-Agent header.

Question 8

When troubleshooting a persistent connection issue, which LTM feature allows you to view active persistence entries?

Accepted Answer

Traffic Management Shell (tmsh) persistence table. The persistence table contains a real-time mapping of client sessions to specific pool members. Viewing this table is the most effective way to determine if persistence is working correctly. It is a fundamental troubleshooting step for LTM specialists, as it confirms whether client traffic is being directed to the intended server or if a conflict in the persistence configuration is causing sessions to be misrouted.

Answer

Configuration Utility Dashboard

Answer

Virtual Server Statistics

Answer

Log files in /var/log/ltm

Question 9

An administrator observes that the 'Least Connections' load balancing algorithm is not distributing traffic as evenly as expected. What is the most probable reason?

Accepted Answer

Persistence profiles are overriding the load balancing algorithm.. Least Connections distributes traffic based on the number of active connections to each pool member. If persistence is enabled, the BIG-IP will send subsequent requests from the same client to the same server, regardless of the load balancing algorithm. Consequently, persistence overrides the load balancing decision, leading to uneven distribution if certain sessions are longer or more active than others.

Answer

The pool members have different weight values configured.

Answer

The TCP profile is set to 'OneConnect' mode.

Answer

The health monitor is failing intermittently.

Question 10

What is the primary risk of using a wildcard (0.0.0.0/0) virtual server on a BIG-IP system?

Accepted Answer

It significantly increases the attack surface by exposing all ports.. A wildcard virtual server intercepts all traffic directed to the BIG-IP on any port for any destination IP address. If not carefully configured with specific iRules or policies, this can lead to security vulnerabilities, such as exposing management or internal interfaces to public traffic. It significantly increases the attack surface of the network and is generally discouraged unless strictly required for specific gateway or firewall-like functionalities.

Answer

It prevents the use of SSL profiles on the virtual server.

Answer

It causes high CPU utilization due to packet inspection overhead.

Answer

It disables the BIG-IP's ability to use persistence.