F5-CTS-LTM Practice Test 9 — 10 Questions

Question 1

An administrator is configuring a new virtual server and needs to ensure that it only accepts traffic on a specific VLAN. How should this be configured?

Accepted Answer

By modifying the 'Enabled VLANs and Tunnels' setting in the virtual server properties.. Configuring VLAN-specific access for a virtual server is done within the 'Resources' or 'Configuration' tab of the virtual server settings. By default, a virtual server listens on all enabled VLANs. Restricting this to a single VLAN enhances security by preventing unauthorized traffic from other network segments from reaching the virtual server and potentially exposing the application to unnecessary risk.

Answer

By applying a packet filter to the virtual server object in the GUI.

Answer

By adding a static route in the routing table for that VLAN.

Answer

By creating a SNAT pool that only contains IPs from the specific VLAN.

Question 2

Which monitoring method is most reliable for verifying that a web application is not just responding to TCP requests, but also returning correct application-layer data?

Accepted Answer

HTTP monitor. The HTTP monitor is specifically designed to perform application-layer verification by sending an actual HTTP request and waiting for a specific response string. This goes beyond simple TCP port checks, ensuring that the application server is fully functional, the web service is running, and the expected content is being served, which is vital for preventing 'false-up' states for failing web applications.

Answer

ICMP monitor

Answer

TCP monitor

Answer

SNMP monitor

Question 3

What is the primary function of the 'FastL4' profile in a BIG-IP LTM configuration?

Accepted Answer

To provide high-throughput, hardware-accelerated packet switching.. The FastL4 profile is designed for high-performance, layer 4 load balancing. It optimizes the processing of TCP or UDP traffic by bypassing the full proxy architecture for the majority of the connection's lifecycle. This allows the BIG-IP to handle a significantly higher volume of throughput and connections per second, making it ideal for large-scale deployments where deep application-layer inspection (layer 7) is not required for the specific traffic type.

Answer

To enable advanced HTTP header inspection.

Answer

To perform SSL offloading for encrypted traffic.

Answer

To manage persistence based on HTTP cookies.

Question 4

What is the primary benefit of using a 'OneConnect' profile in an HTTP virtual server?

Accepted Answer

It allows connection reuse to backend servers.. OneConnect enables TCP connection reuse between the BIG-IP and the backend servers. By maintaining a pool of established connections, the BIG-IP avoids the overhead of repeated TCP three-way handshakes for each client request. This is particularly important for HTTP/1.1 traffic, where it significantly reduces latency and server CPU utilization, making it a critical optimization for high-traffic web applications.

Answer

It encrypts traffic to the backend.

Answer

It compresses HTTP payload data.

Answer

It manages client persistence.

Question 5

Which health monitor should be used to verify that a web application is not just responding to TCP connections, but is actually serving the correct content?

Accepted Answer

HTTP Monitor. An HTTP or HTTPS monitor is required to verify the content of the response. Unlike a simple TCP monitor, which only checks for a successful three-way handshake, an HTTP monitor sends a GET request to a specific URI and checks the response for a 'Receive String'. This ensures the application layer is functioning and the web server is actually serving the expected site content.

Answer

TCP Monitor

Answer

ICMP Monitor

Answer

External Monitor

Question 6

An LTM is configured with a OneConnect profile. What is the primary purpose of this feature in the context of HTTP connections?

Accepted Answer

To multiplex multiple client requests over a single server-side TCP connection.. OneConnect allows the BIG-IP to reuse existing connections between the BIG-IP and the backend servers. By multiplexing multiple client requests onto a smaller set of established TCP connections, it significantly reduces the overhead associated with the TCP three-way handshake and slow-start mechanism on the backend servers. This is particularly valuable for high-traffic environments where connection setup latency can become a major bottleneck for the application's response time.

Answer

To increase the number of TCP connections allowed to the backend servers.

Answer

To enable persistent connections between the client and the BIG-IP.

Answer

To provide SSL offloading for non-HTTP traffic types.

Question 7

Which THREE actions are required to successfully implement SSL offloading on a BIG-IP virtual server?

Accepted Answer

Import the server certificate and private key into the BIG-IP's certificate store.. SSL offloading requires the BIG-IP to decrypt traffic before it reaches the backend. This involves importing the server's certificate and key, creating a Client SSL profile, and ensuring the virtual server is listening on the correct port (typically 443). By offloading SSL, the LTM can inspect traffic, perform security checks, and manage persistence, which is not possible if the traffic remains encrypted from the client to the backend server.

Answer

Create a Server SSL profile and assign it to the virtual server.

Answer

Enable the 'Allow All' cipher suite in the SSL profile.

Question 8

An administrator wants to reduce the load on the backend servers by caching static content. Which BIG-IP feature should be configured?

Accepted Answer

Apply a Web Acceleration profile with an enabled cache object.. The Web Acceleration profile provides built-in HTTP caching capabilities. By enabling this on a virtual server, the BIG-IP can cache static assets like images, CSS, and JS files, serving them directly from memory and significantly reducing the number of requests that reach the backend web servers. This is a highly effective way to improve application performance and scalability without modifying the backend application code.

Answer

Enable the 'OneConnect' profile to pool backend connections.

Answer

Create an iRule to store request data in the BIG-IP session table.

Answer

Configure the 'HTTP-Compress' profile to shrink the size of responses.

Question 9

An LTM Specialist is asked to prevent users from accessing a specific subdirectory on a website, e.g., '/admin'. What is the most secure and efficient way to do this?

Accepted Answer

Use a Local Traffic Policy to reject requests for '/admin'.. Using a Local Traffic Policy is the most efficient and secure way to block access to specific URI paths. By creating a policy rule that matches the request path against '/admin' and setting the action to 'reject' or 'drop', the BIG-IP intercepts the malicious or unauthorized request before it ever reaches the backend servers. This provides a clear, configurable, and high-performance security boundary for the application.

Answer

Create an iRule to log the request and drop the connection.

Answer

Configure a custom health monitor to mark the server down.

Answer

Enable a Persistence profile to filter the URI.

Question 10

Which action does an LTM perform when a health monitor fails for a pool member?

Accepted Answer

It marks the member as down and stops load balancing new requests to it.. When a health monitor fails, the LTM marks the member as 'down' and stops sending new traffic to it. This ensures that users do not experience errors or timeouts. Existing connections are typically handled according to the persistence and timeout settings, preventing sudden application failures for active users while protecting the service from faulty backend infrastructure.

Answer

It automatically restarts the service on the backend server.

Answer

It removes the member from the pool and drops all active connections.

Answer

It alerts the user with a 503 error page.