F5-CTS-LTM BIG-IP Local Traffic Manager Practice Test 12 — 15 Questions

Question 1

Which profile type must be attached to a virtual server to allow the BIG-IP to perform Layer 7 application inspection and modification?

Accepted Answer

HTTP Profile. An HTTP profile is the foundation for Layer 7 processing on the BIG-IP. It allows the system to parse HTTP requests and responses, which is necessary for features like cookie persistence, header insertion, and iRule-based traffic manipulation. Without an HTTP profile, the LTM acts only at the TCP layer, limiting its ability to understand or modify application-level data, which is vital for modern web application delivery.

Answer

TCP Profile

Answer

Client SSL Profile

Answer

Persistence Profile

Question 2

What is the primary function of the 'OneConnect' profile in a BIG-IP LTM environment?

Accepted Answer

It improves performance by reusing server-side TCP connections.. OneConnect allows the BIG-IP to reuse server-side TCP connections for multiple client-side requests. This reduces the overhead of repeatedly opening and closing TCP connections to the backend servers, which is highly beneficial for high-traffic applications. By maintaining a pool of idle connections to the servers, the system significantly improves performance and reduces the CPU load associated with the TCP three-way handshake on the backend.

Answer

It enables SSL offloading for encrypted traffic.

Answer

It provides a mechanism for persistence across multiple pools.

Answer

It forces traffic to use HTTP/2 instead of HTTP/1.1.

Question 3

An LTM Specialist is troubleshooting an issue where client browsers are receiving errors when connecting via HTTPS. The virtual server is working fine for plain HTTP. Which THREE of the following could be the cause? (Choose three)

Accepted Answer

The Client SSL profile is using an expired certificate.. HTTPS issues usually stem from certificate, profile, or protocol mismatch problems. An expired certificate, a missing intermediate certificate in the chain, or an incompatible SSL profile will break the TLS handshake. These issues are common in LTM deployments and must be systematically ruled out by checking the BIG-IP logs, certificate stores, and profile settings to ensure the handshake can complete successfully between the client and the BIG-IP.

Answer

The virtual server is missing a Server SSL profile.

Answer

The virtual server is listening on the wrong port.

Question 4

An LTM administrator needs to ensure that client SSL traffic is offloaded at the BIG-IP while maintaining end-to-end encryption to the backend servers. Which profile configuration is required to achieve this?

Accepted Answer

Assign both a Client SSL profile and a Server SSL profile to the virtual server.. To achieve SSL offloading with backend encryption, the LTM must terminate the client-side SSL using a Client SSL profile and then initiate a new SSL connection to the server using a Server SSL profile. This architecture, known as SSL Bridging, is critical for organizations needing to perform deep packet inspection or Layer 7 load balancing while maintaining security compliance protocols between the load balancer and the internal server pool members.

Answer

Apply only a Client SSL profile to the virtual server.

Answer

Configure a FastL4 profile with SSL persistence enabled.

Answer

Disable the Client SSL profile and enable a Server SSL profile only.

Question 5

Refer to the exhibit. An administrator checks the status of 'web_pool' and observes the output shown. What is the most likely cause for the pool being offline?

Accepted Answer

The health monitors assigned to the pool members are failing.. The output indicates that the pool is offline because all members are unavailable. In LTM, a pool's availability status is determined by the health of its members. When all monitors fail or the members are manually disabled, the pool enters an offline state. This is a fundamental concept for troubleshooting service outages, as it immediately identifies that the issue lies with the backend servers rather than the VIP.

Answer

The Virtual Server associated with the pool is disabled.

Answer

The load balancing method is set to Round Robin.

Answer

The license for the LTM module has expired.

Question 6

You have a requirement to distribute traffic to pool members based on the total number of active connections each server is currently handling. Which load balancing method should be selected?

Accepted Answer

Least Connections (member). The 'Least Connections' method is the correct choice for load balancing based on active session counts. This algorithm dynamically tracks the current load on each server and directs new requests to the member with the fewest active connections. It is essential for application environments where individual requests vary significantly in duration or resource consumption, preventing any single server from becoming overwhelmed.

Answer

Round Robin

Answer

Ratio (member)

Answer

Observed (member)

Question 7

A client is experiencing intermittent connection failures. You suspect the BIG-IP is SNATing traffic. If the SNAT pool is exhausted, what behavior will the BIG-IP exhibit?

Accepted Answer

It will drop new incoming connections from clients.. SNAT pool exhaustion occurs when the BIG-IP runs out of available source ports to translate client connections. When this happens, new requests from clients will be dropped or rejected because the LTM cannot map the connection to a valid source IP/port combination. Identifying this is crucial during performance troubleshooting, as it often masquerades as generic network connectivity issues or server-side application errors.

Answer

It will automatically increase the SNAT pool size.

Answer

It will bypass the SNAT pool and use the Self-IP.

Answer

It will rotate the source IP to the next available virtual address.

Question 8

Which profile is essential to enable when you need to inspect or manipulate HTTP traffic, such as inserting X-Forwarded-For headers?

Accepted Answer

HTTP Profile. The HTTP profile is required for any Layer 7 processing. Without an HTTP profile, the BIG-IP treats traffic as raw TCP streams. By enabling the HTTP profile, the LTM gains the ability to parse HTTP requests and responses, allowing for features like header manipulation, cookie persistence, and content switching, which are standard requirements for modern web application delivery controllers.

Answer

TCP Profile

Answer

Client SSL Profile

Answer

FastL4 Profile

Question 9

Which THREE features are provided by the BIG-IP LTM that assist in optimizing application performance?

Accepted Answer

TCP Express. BIG-IP LTM offers a suite of optimization tools. TCP Express, HTTP compression, and Caching are central to reducing latency and server load. These features work together to reduce the data sent over the wire and optimize how that data is transported, significantly improving the end-user experience for slow network connections and reducing backend resource consumption.

Answer

DNS Load Balancing

Answer

Firewall Rule Processing

Question 10

What is the primary function of the 'OneConnect' profile in a BIG-IP LTM configuration?

Accepted Answer

To enable TCP connection reuse to backend servers.. The OneConnect profile enables connection pooling between the BIG-IP and the backend servers. By keeping backend connections open even after a client request is fulfilled, the BIG-IP can reuse these existing connections for subsequent requests. This reduces the overhead associated with the TCP three-way handshake for every new request, significantly lowering the CPU utilization on backend servers and improving overall latency.

Answer

To perform SSL decryption for client-side traffic.

Answer

To allow for HTTP header insertion.

Answer

To enforce persistence based on client IP.

Question 11

Which action does an LTM perform when a health monitor fails for a pool member?

Accepted Answer

It marks the member as down and stops load balancing new requests to it.. When a health monitor fails, the LTM marks the member as 'down' and stops sending new traffic to it. This ensures that users do not experience errors or timeouts. Existing connections are typically handled according to the persistence and timeout settings, preventing sudden application failures for active users while protecting the service from faulty backend infrastructure.

Answer

It automatically restarts the service on the backend server.

Answer

It removes the member from the pool and drops all active connections.

Answer

It alerts the user with a 503 error page.

Question 12

You are managing an LTM and notice that some traffic is not being load-balanced as expected. You see that an iRule is applied to the virtual server. What is the most likely reason the iRule is overriding the load-balancing method?

Accepted Answer

The iRule explicitly selects a pool or node.. iRules are processed before standard load balancing in the BIG-IP pipeline. When an iRule contains commands like 'pool' or 'node', it can explicitly select a destination server, effectively bypassing the configured load-balancing algorithm. This is a common point of confusion for administrators, as the iRule logic can override the expected behavior of the pool's load-balancing method.

Answer

The iRule is only triggered when the pool is empty.

Answer

The load-balancing method is incompatible with iRules.

Answer

The iRule is disabled by the current license.

Question 13

Refer to the exhibit. The virtual server 'vs_secure_site' is showing as 'offline'. What is the most immediate step to take to restore service?

Accepted Answer

Investigate the pool members and health monitor status.. When a virtual server status is 'offline' due to 'no available members', it indicates that all pool members associated with that virtual server have failed their health checks. The most immediate and logical step is to inspect the pool members and their monitors to identify why they are failing, as the virtual server cannot function without at least one healthy backend server.

Answer

Delete and recreate the virtual server.

Answer

Restart the BIG-IP TMM service.

Answer

Change the virtual server IP address.

Question 14

A BIG-IP administrator creates a Standard Virtual Server with source address translation set to 'Automated Map'. During peak hours, clients behind a specific corporate NAT gateway experience intermittent connection drops. What is the mechanism and impact of 'Automated Map' in this scenario?

Accepted Answer

It uses the system self IP addresses as translation addresses, which can lead to port exhaustion under high connection rates.. Automated Map creates a temporary SNAT translation using available self IP addresses on the BIG-IP system. If traffic volume exhausts available source ports for a given self IP, connection attempts fail. High client concurrency through a shared NAT gateway exacerbates port exhaustion on the SNAT address, leading to dropped connections.

Answer

It translates client source IPs using a dedicated SNAT pool, causing IP address collisions with upstream gateways.

Answer

It maps client source ports to a fixed range, restricting concurrent connections from individual subnet prefixes.

Answer

It disables connection tracking, forcing clients to establish direct routing paths that bypass the internal firewall.

Question 15

An administrator implements a pool monitor using an HTTP GET request to verify application health. The application returns an HTTP 200 OK status, but the HTML body contains an error string indicating database connectivity failure. How should the administrator configure the monitor to mark the pool member down when this error appears?

Accepted Answer

Configure the monitor with a 'Receive Disable' string matching the database error message.. Advanced monitors support 'Send' and 'Receive' string configurations. By specifying a 'Receive' string, the BIG-IP inspects the response body for expected content. Conversely, using a 'Receive Disable' string allows the administrator to specify a string that, if matched in the body, immediately marks the pool member down.

Answer

Configure the monitor with a 'Receive' string that matches the database error message to validate failure.

Answer

Change the monitor type to ICMP to detect underlying TCP socket failures automatically.

Answer

Enable reverse validation in the pool properties to invert HTTP status code return logic.