F5-CTS-LTM Practice Test 8 — 10 Questions

Question 1

An LTM administrator needs to allow a specific external IP address to access a restricted management interface via a virtual server, while blocking all others. What is the most efficient way to implement this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an iRule or Local Traffic Policy on the virtual server to check the source IP.. The most efficient way to control access at the BIG-IP level is using an LTM Local Traffic Policy or an iRule. While a packet filter or AFM can work, LTM-specific policies are integrated directly into the virtual server configuration. By checking the client IP address in the policy, the administrator can perform a 'drop' or 'reset' action for unauthorized traffic, ensuring high performance.

Answer

Apply a packet filter to the VLAN that blocks all traffic except the specific IP.

Answer

Modify the pool member's firewall to allow only the BIG-IP's self IP address.

Answer

Assign a 'None' profile to the virtual server to force an error on unauthorized connections.

Question 2

An administrator wants to use an iRule to log the 'Host' header of every incoming HTTP request. Which iRule event is most appropriate for this task?

Accepted Answer

HTTP_REQUEST. The 'HTTP_REQUEST' event triggers whenever a client sends an HTTP request, providing immediate access to the headers before the request is processed by the pool selection logic. This is the correct point in the request-response cycle to inspect and log headers. Using this event ensures that the logging logic executes for every single request, providing a full audit trail of host header usage.

Answer

CLIENT_ACCEPTED

Answer

HTTP_RESPONSE

Answer

LB_SELECTED

Question 3

Which BIG-IP feature allows an administrator to modify the HTTP header of a request before it reaches the backend server?

Accepted Answer

iRule. An iRule is the primary mechanism for manipulating traffic at the application layer. By using events like HTTP_REQUEST, an administrator can insert, modify, or delete HTTP headers on the fly. This is essential for scenarios like adding X-Forwarded-For headers, removing security-sensitive headers, or injecting custom application-specific tokens to communicate information to the backend servers that the client did not initially provide.

Answer

SNAT Pool

Answer

HTTP Profile

Answer

Virtual Server

Question 4

What is the primary function of the LTM 'OneConnect' profile in an environment with high-volume short-lived connections?

Accepted Answer

It multiplexes client-side and server-side connections to reduce server CPU load.. OneConnect enables TCP connection multiplexing. It allows the BIG-IP to keep backend TCP connections open even after a client has closed its connection. By reusing these existing idle connections for new client requests, the LTM significantly reduces the overhead on backend servers associated with the TCP three-way handshake and slow-start process, which is essential for scaling performance in high-traffic web environments.

Answer

It compresses HTTP traffic to reduce bandwidth usage.

Answer

It caches static content to prevent repetitive requests to backend servers.

Answer

It performs SSL decryption to offload cryptographic tasks.

Question 5

Which BIG-IP feature allows an LTM Specialist to perform granular inspection and modification of HTTP traffic headers before they reach the backend server?

Accepted Answer

iRules. iRules are the primary tool for custom traffic manipulation on the BIG-IP. They provide an event-driven Tcl-based scripting environment that allows specialists to intercept, inspect, and modify any part of the packet, including HTTP headers. This is essential for advanced load balancing scenarios, such as header-based routing, security obfuscation, or dynamic application integration that standard profiles cannot handle natively.

Answer

Local Traffic Policy

Answer

Persistence Profile

Answer

FastL4 Profile

Question 6

Refer to the exhibit. Why is the 'http' profile required in this virtual server configuration?

Accepted Answer

To allow the LTM to inspect and modify HTTP headers.. The 'http' profile is required because the BIG-IP LTM needs to parse the HTTP headers to perform application-level functions like persistence, compression, or header manipulation. Even if the Virtual Server simply forwards traffic, the presence of an HTTP profile enables the TMM to understand the protocol structure. This is critical for any LTM configuration that requires visibility into the payload for security or load-balancing logic.

Answer

To enable hardware acceleration for SSL processing.

Answer

To define the backend server pool members.

Answer

To enable port translation for the virtual server.

Question 7

Which TWO of the following are valid methods to offload SSL processing from the backend servers to the BIG-IP system? (Choose two)

Accepted Answer

Configure Client-side SSL profile on the virtual server and leave the backend pool unencrypted.. SSL Offloading is a primary function of LTM, allowing the BIG-IP to perform the resource-intensive cryptographic tasks. By terminating the SSL connection at the BIG-IP, the backend servers can focus on application logic. The two common architectures are SSL Termination (Client-side SSL) and SSL Bridging (Client-side and Server-side SSL), both of which effectively remove the encryption burden from the backend pool members.

Answer

Configure Server-side SSL profile on the virtual server and leave the client traffic unencrypted.

Answer

Disable SSL on the virtual server and enable it on the pool.

Answer

Configure an iRule to forward unencrypted packets to the backend servers.

Question 8

What is the result of setting the 'OneConnect Transformation' feature to 'Enabled' in an HTTP profile?

Accepted Answer

It rewrites HTTP headers to support connection reuse.. OneConnect Transformation allows the BIG-IP to safely rewrite Connection headers, converting 'keep-alive' to 'close' or vice-versa to facilitate connection reuse. This ensures that the backend servers properly interpret the connection state as managed by the BIG-IP's pooling mechanism. Without this, the server might close the connection prematurely, causing errors in applications that expect persistent connections, thereby negating the performance benefits provided by the OneConnect profile implementation.

Answer

It forces the client to use HTTPS.

Answer

It compresses all outgoing HTTP payloads.

Answer

It disables all persistence profiles on the VS.

Question 9

What is the result of applying a 'FastL4' profile to a virtual server?

Accepted Answer

It provides high-performance L4 load balancing.. The FastL4 profile is designed for high-performance, transport-layer load balancing. It bypasses the full proxy capabilities of the BIG-IP, meaning it cannot perform L7 inspection, HTTP header manipulation, or SSL offloading. This is ideal for scenarios like UDP traffic, streaming, or simple TCP load balancing where maximizing throughput and minimizing latency are more important than application-level traffic modification or security features.

Answer

It allows the BIG-IP to perform HTTP header insertion.

Answer

It enables SSL termination on the virtual server.

Answer

It creates a stateful firewall for all traffic.

Question 10

Refer to the exhibit. An LTM Specialist wants to ensure that persistence is maintained even if a client switches between different virtual services that share the same pool members. Based on the configuration, will this work?

Accepted Answer

Yes, because 'match-across-services' is enabled.. The persistence profile has 'match-across-services' enabled. This setting allows the BIG-IP to maintain the same persistence record across different virtual servers that share the same pool. This is crucial for complex applications where a user might initiate a session on one virtual service and be directed to another, as it ensures session affinity remains consistent throughout the user's entire journey across the application.

Answer

No, because the cookie name must be unique per virtual server.

Answer

No, because 'expiration 0' prevents persistence across services.

Answer

Yes, but only if the virtual servers share the same IP address.