F5-CTS-LTM BIG-IP Local Traffic Manager Practice Test 1 — 15 Questions

Question 1

An LTM Specialist notices that a virtual server using a Cookie Insert persistence profile is not correctly maintaining session affinity for users. The application serves content over HTTPS and uses secure cookies. What must be configured to ensure persistence functions correctly?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the persistence profile with the 'Secure' flag enabled.. Persistence using Cookie Insert relies on the client returning the cookie provided by the BIG-IP. Because the application uses Secure cookies, the BIG-IP must be configured to match those security attributes. If the cookie is flagged as Secure but the persistence profile does not reflect this, the browser will ignore the set-cookie header, resulting in persistence failure. This is critical in load balancing environments where session state is maintained on specific backend pool members.

Answer

Enable the 'Always Send' option in the persistence profile.

Answer

Increase the persistence timeout to match the application session timeout.

Answer

Change the persistence method to Source Address Affinity.

Question 2

An LTM Specialist needs to ensure that all traffic sent to a specific virtual server is logged for auditing purposes. Which method is most efficient for capturing detailed request and response information without significantly degrading performance?

Accepted Answer

Configure High-Speed Logging (HSL) via an iRule.. High-speed logging (HSL) is the recommended way to log traffic on BIG-IP. Unlike older logging methods that rely on local syslog, HSL sends logs to a remote collector over a dedicated, non-blocking path. This prevents the BIG-IP's management processor from becoming a bottleneck, ensuring that auditing requirements are met without impacting the performance of the data plane or the availability of the application services.

Answer

Enable verbose debug logging in the Local Traffic log level.

Answer

Use iRules with the 'log' command to write to /var/log/ltm.

Answer

Capture traffic using tcpdump and save it to a file.

Question 3

Which THREE conditions must be met for a SNAT to be used by a virtual server to translate the source IP address of outbound traffic?

Accepted Answer

The Virtual Server must have a SNAT pool or 'Automap' configured.. SNAT is necessary when the server cannot route directly back to the client, or when the server needs to see a consistent source IP for policy reasons. The virtual server must be configured with a SNAT type (either Automap or a specific SNAT pool), the BIG-IP must be in the traffic path for both directions, and the packet must be traversing the BIG-IP as a full proxy. If any of these are missing, the SNAT will not engage.

Answer

The Virtual Server must be configured with a FastL4 profile.

Answer

The backend server must have the BIG-IP as its default gateway.

Question 4

An LTM administrator needs to ensure that client requests are consistently mapped to the same backend server based on the source IP address for a duration of 30 minutes. Which persistence method should the administrator configure?

Accepted Answer

Source Address Affinity. Source Address Affinity persistence, also known as sticky persistence, is the correct mechanism here. It uses the client's source IP address to map the session to a specific pool member. By setting the timeout to 1800 seconds, the BIG-IP ensures the mapping persists for exactly 30 minutes. This is critical for applications requiring session state continuity without cookie support or specific application headers.

Answer

Cookie Persistence

Answer

Universal Persistence

Answer

SSL Session ID Persistence

Question 5

Refer to the exhibit. An LTM administrator observes that 10.1.1.5 is marked as 'disabled'. How will this affect traffic flow for existing and new connections to the virtual server associated with this pool?

Accepted Answer

New connections are sent to 10.1.1.6; existing connections are maintained.. When a pool member is marked as disabled, the BIG-IP stops sending new connections to that member while allowing existing connections to complete if persistence or connection mirroring is active. This state differs from 'down' which implies a health monitor failure. Understanding these states is vital for graceful maintenance procedures without dropping active user sessions abruptly during server rotation or patching cycles.

Answer

New connections are dropped; existing connections are immediately reset.

Answer

New connections are rejected; existing connections are sent to 10.1.1.6.

Answer

The virtual server will stop responding to all traffic.

Question 6

An LTM administrator is implementing a new virtual server and needs to ensure secure traffic handling. Which TWO of the following configurations are required to terminate SSL traffic at the BIG-IP?

Accepted Answer

Assign a Client SSL profile to the virtual server.. SSL termination requires a Client SSL profile to decrypt incoming traffic and a Server SSL profile if re-encryption to the backend is required (though strictly for termination, the Client SSL profile is the core requirement). By decrypting at the BIG-IP, the device can inspect, manipulate, and load-balance traffic based on Layer 7 headers, which is essential for advanced application delivery services.

Answer

Enable SNAT automap on the virtual server.

Answer

Assign a Server SSL profile to the virtual server.

Answer

Enable iRule processing on the virtual server.

Question 7

An LTM administrator needs to block traffic from a specific range of malicious IP addresses. What is the most efficient way to achieve this at the BIG-IP level?

Accepted Answer

Use an iRule to check the client IP against a Data Group.. Using an LTM Network Firewall policy or an iRule with an IP data group is the industry standard. However, the most efficient way is a 'Network Firewall' or 'Advanced Firewall Manager' policy if licensed, or an iRule with a data group for standard LTM. These methods scale significantly better than individual firewall rules by using high-performance lookups against optimized memory structures.

Answer

Apply a packet filter to the virtual server.

Answer

Create an individual virtual server for each blocked IP.

Answer

Configure each pool member to reject the traffic.

Question 8

An administrator notices that the BIG-IP is not correctly identifying the client's IP address when connections are proxied through an upstream device. What should the administrator configure to solve this?

Accepted Answer

Enable 'X-Forwarded-For' in the HTTP profile.. When an upstream device proxies traffic, the BIG-IP's source IP appears as the upstream device's IP. To see the true client IP, the administrator must configure the BIG-IP to inspect headers, typically the 'X-Forwarded-For' header. This is done via an HTTP profile where the header insertion or parsing logic is configured to extract the original client IP from the HTTP request headers.

Answer

Configure a SNAT pool with the upstream IP address.

Answer

Change the load balancing algorithm to 'Least Connections'.

Answer

Disable the Client SSL profile on the virtual server.

Question 9

Refer to the exhibit. An administrator wants to modify this virtual server to support HTTPS. What is the minimum configuration change required?

Accepted Answer

Change port to 443 and add a Client SSL profile.. To support HTTPS, the virtual server must handle encrypted traffic. This requires changing the port to 443 (as defined by HTTPS standards) and attaching a Client SSL profile. The HTTP profile must also be kept to allow the BIG-IP to decrypt and parse the HTTP traffic after the SSL handshake is terminated by the Client SSL profile, ensuring the BIG-IP can perform application-layer operations.

Answer

Add a Server SSL profile to the virtual server.

Answer

Change the destination address to 10.0.0.1:443.

Answer

Remove the HTTP profile and add a Client SSL profile.

Question 10

An LTM administrator is troubleshooting a Virtual Server that is failing to pass traffic. The pool members are marked as UP. Which TWO of the following configurations could cause the traffic to drop at the virtual server level?

Accepted Answer

The Virtual Server has an iRule assigned that triggers a 'drop' command under specific conditions.. Virtual Server traffic flow relies on proper mapping of profiles and services. If the configuration is inconsistent, such as missing an iRule dependency or having a conflicting port/protocol mismatch, the LTM drops the connection. Identifying these misconfigurations is essential for LTM troubleshooting, as it differentiates between backend server application failures and middle-box configuration errors that block traffic before it even reaches the load-balanced pool members.

Answer

The pool members are configured with a different port than the Virtual Server destination port.

Answer

The Virtual Server is assigned a Client SSL profile while the protocol is set to UDP.

Answer

The SNAT pool is exhausted and cannot allocate source ports for the connection.

Question 11

Refer to the exhibit. An administrator notices that the pool members are marked as DOWN. The backend servers are responding to TCP SYN packets, but the application is not returning HTTP 200 OK statuses. What is the cause of this behavior?

Accepted Answer

The monitor is actually an HTTP monitor, not a TCP monitor, causing health check failures.. The pool is using the default TCP monitor, which only checks for a successful three-way handshake. Since the servers respond to SYN packets, the TCP monitor marks the members as UP. However, the user states they are DOWN. This implies the monitor is not actually a simple TCP monitor or the configuration provided is incomplete. In the context of LTM, health monitors must match application behavior to ensure accurate availability reporting.

Answer

The TCP monitor is configured to expect an HTTP 200 OK response.

Answer

The BIG-IP LTM has an internal firewall rule blocking port 80 traffic.

Answer

The pool members need a custom iRule to respond to the TCP monitor probes.

Question 12

When configuring a SNAT (Secure Network Address Translation) pool, what is the primary benefit of using a SNAT pool instead of 'Automap'?

Accepted Answer

SNAT pools provide a dedicated set of IP addresses that can be whitelisted by backend servers.. Automap uses the self-IP of the egress interface, which limits scalability and can cause port exhaustion in high-traffic environments. A SNAT pool allows for a defined range of IP addresses, distributing the connection load across multiple addresses. This approach is critical for large-scale enterprise deployments where a single IP address would be insufficient to handle the volume of concurrent connections generated by thousands of users hitting the BIG-IP.

Answer

SNAT pools allow for more efficient use of internal BIG-IP system resources.

Answer

SNAT pools are required for SSL termination and decryption to function.

Answer

SNAT pools automatically enable persistence for all connections.

Question 13

Which object in the BIG-IP LTM configuration is responsible for translating a client's destination IP address to a pool of backend servers?

Accepted Answer

Virtual Server. The Virtual Server is the front-end object that listens for client traffic. It acts as a proxy, receiving the request and then applying the load-balancing logic configured in the pool. Understanding the relationship between Virtual Servers and Pools is fundamental to LTM operations, as this mapping defines how traffic enters the network and how it is distributed among available resources to maintain high availability and performance.

Answer

Node

Answer

Profile

Answer

SNAT

Question 14

Which THREE of the following are valid load-balancing methods available in the BIG-IP LTM?

Accepted Answer

Round Robin. Load balancing methods determine how traffic is distributed among pool members. Selecting the appropriate method is critical for performance tuning. While Round Robin is the default, advanced methods like Least Connections or Observed are necessary for heterogeneous environments where servers may have varying capacities or workloads, ensuring that no single member becomes a bottleneck while others remain underutilized, thereby maximizing the efficiency of the entire server farm.

Answer

Fastest Connection

Answer

Random Weight

Question 15

Which TWO of the following are true regarding the behavior of the BIG-IP LTM when a pool member is marked 'DOWN'?

Accepted Answer

New connections are sent to the remaining 'UP' pool members.. When a pool member is marked DOWN, the BIG-IP LTM immediately stops sending new connections to that node. Understanding how the BIG-IP handles existing connections versus new ones is vital. By default, existing connections are usually preserved depending on persistence settings, but new requests are diverted to healthy members, ensuring continuous service without interrupting users already in active sessions.

Answer

The BIG-IP drops all existing connections to that pool member.

Answer

The BIG-IP automatically removes the node from the configuration.

Answer

The BIG-IP sends an ICMP unreachable message to the client.