F5-CTS-LTM BIG-IP Local Traffic Manager Practice Test 3 — 15 Questions

Question 1

An LTM administrator is configuring a new virtual server and needs to ensure that the BIG-IP does not accept traffic unless the virtual server is fully configured. Which setting should be checked?

Accepted Answer

Set the virtual server status to 'Enabled'.. The 'Auto Last Hop' feature and virtual server state settings are critical. More specifically, ensuring that the Virtual Server is in the 'Enabled' state and that the associated pool has at least one active member is required for traffic to be processed. If the virtual server is not enabled, it will not accept any connections, regardless of whether the backend servers are healthy or reachable.

Answer

Enable the 'Strictly Bound' option in the global settings.

Answer

Configure the virtual server to use 'Performance (L4)' profile.

Answer

Disable the 'Default Persistence' profile.

Question 2

Refer to the exhibit. An administrator receives this error while trying to disable a pool member. What is the most likely cause?

Accepted Answer

Active persistence records are holding sessions to that member.. This error typically occurs when attempting to perform an operation on a pool member while persistent sessions are actively bound to it. The BIG-IP prevents the modification or disabling of a member if active connections or persistence records are currently referencing that specific member, ensuring that existing traffic flows are not abruptly terminated, which would cause application errors for the end users.

Answer

The pool member is currently part of an active iApp deployment.

Answer

The administrator lacks sufficient privileges for the operation.

Answer

The pool member has reached its connection limit.

Question 3

Which THREE conditions must be met for a SNAT (Secure Network Address Translation) to correctly translate a client's source IP address?

Accepted Answer

The client's source IP must match the defined SNAT criteria.. SNAT requires that the traffic matches the defined SNAT address or pool, that the traffic is not already excluded by a more specific routing rule, and that the traffic flow is correctly mapped from the client side. The BIG-IP must also have a return path to the client. These conditions ensure that the translation is only applied when intended and that the return traffic can be correctly routed back through the BIG-IP.

Answer

The destination server must be in the same L2 broadcast domain as the client.

Answer

The virtual server must have SNAT Automap enabled.

Question 4

Which component of the F5 BIG-IP architecture is responsible for processing traffic, including packet filtering, NAT, and load balancing decisions?

Accepted Answer

The Traffic Management Microkernel (TMM).. The Traffic Management Operating System (TMOS) is the foundation of the BIG-IP. It includes the Traffic Management Microkernel (TMM), which is a high-performance, purpose-built kernel designed to handle all aspects of traffic processing. TMM operates in user space to provide maximum efficiency and scalability, bypassing the overhead of standard operating system kernels to deliver rapid packet inspection and intelligent load balancing for all traffic types.

Answer

The Linux operating system kernel.

Answer

The configuration utility (GUI/tmsh).

Answer

The ASM (Application Security Manager) module.

Question 5

An administrator configures a standard Virtual Server with a destination IP of 10.10.10.20:443 and applies a Client SSL profile and a OneConnect profile. Users report intermittent connection failures during peak traffic hours. The pool members are web servers listening on port 80. Which component configuration change directly resolves connection reuse issues related to port exhaustion and asymmetric load distribution?

Accepted Answer

Modify the OneConnect source mask from the default host-based setting to a broader subnet mask to allow sharing of backend connections across distinct clients.. The OneConnect profile transforms client-side connections to persistent server-side connections. Without an adequate source address translation mechanism like SNAT or a modified OneConnect mask, backend servers see identical source IPs, causing port exhaustion and reuse failures across different client requests. Proper configuration prevents this bottleneck, ensuring reliable high-throughput traffic management and optimal backend server utilization during traffic spikes.

Answer

Disable the OneConnect profile completely to ensure every client request gets a dedicated backend TCP handshake, bypassing all connection reuse limits.

Answer

Change the Virtual Server port from 443 to 80 and remove the Client SSL profile to allow direct unencrypted communication with the backend application pool members.

Answer

Apply a Server SSL profile to the Virtual Server to re-encrypt traffic between the BIG-IP system and the backend web pool members listening on port 80.

Question 6

An administrator is troubleshooting a newly deployed FastL4 Virtual Server that drops inbound TCP SYN packets instead of processing them. Which TWO configuration elements must be verified to ensure proper operation of a FastL4 Virtual Server? (Choose two.)

Accepted Answer

Ensure that a valid SNAT Pool or SNAT Automap is configured if the virtual server receives traffic destined for networks without a direct return path.. FastL4 Virtual Servers bypass the full proxy TCP stack to achieve high throughput, relying heavily on proper IP forwarding and port matching. Misconfigured VLAN assignments or missing wildcard/specific IP destinations prevent the Traffic Management Microkernel from correctly identifying and forwarding packets matching the FastL4 profile rules.

Answer

Verify that an HTTP profile is explicitly assigned to the FastL4 Virtual Server to parse application-layer headers and manage cookie persistence.

Answer

Ensure that a Client SSL profile is bound to the virtual server to handle cryptographic handshakes before layer 4 packet inspection occurs.

Answer

Check that the Virtual Server type is set to Standard rather than Performance L4 to enable deep packet inspection and request-level logging.

Question 7

An enterprise application requires persistent client sessions across multiple virtual servers sharing the same backend pool. Users connect via HTTP and HTTPS virtual servers. Which persistence method guarantees that a client is directed to the same pool member regardless of whether they connect over port 80 or port 443?

Accepted Answer

Universal Persistence implemented via an iRule that extracts a unique transaction ID or token from the application layer payload.. Universal persistence allows administrators to write custom iRules that extract specific identifiers, such as username, session ID, or transactional tokens, from the payload. Because the identifier remains consistent across ports, universal persistence tracks and maps the client session to the exact same pool member across different virtual servers.

Answer

Source Address Affinity Persistence based strictly on the client IP address mask applied across both virtual servers.

Answer

Cookie Insert Persistence configured with identical cookie names and expiration parameters on both virtual servers.

Answer

Hash Persistence configured using the source port as the primary hash key input parameter for the session table lookup.

Question 8

An administrator needs to ensure that client requests are routed to the same pool member based on the source IP address for a duration of one hour. Which persistence method is most appropriate for this requirement?

Accepted Answer

Source Address Affinity persistence. Source Address Affinity persistence, also known as sticky persistence, maps the client's source IP address to a specific pool member for a defined period. This is essential for applications that do not support cookies but require session consistency. By setting the timeout to 3600 seconds, the administrator ensures that the client remains bound to the same server, preventing session drops that would otherwise occur if the load balancer distributed requests across different backend servers.

Answer

Cookie Insert persistence

Answer

Universal persistence

Answer

SSL persistence

Question 9

An administrator wants to ensure that a health monitor marks a node as 'down' only if it fails to respond to three consecutive checks. Which setting should be adjusted in the health monitor configuration?

Accepted Answer

Set the Timeout to three times the Interval.. The 'Time Until Up' and 'Interval' settings are relevant, but the specific behavior of requiring multiple consecutive failures to mark a node as 'down' is controlled by the 'Time Until Up' or 'Failure Interval' logic in older versions, or more commonly, the number of successful checks versus failed checks. In modern TMOS, this is typically handled by setting the 'Interval' and 'Timeout' values appropriately.

Answer

Set the Interval to 3 and the Timeout to 1.

Answer

Set the Up Interval to 3 and the Down Interval to 1.

Answer

Enable the 'Manual Resume' setting in the monitor.

Question 10

Refer to the exhibit. The BIG-IP is marking the pool members as 'down' even though the server is responding to the GET request with '200 OK'. What is the most likely cause?

Accepted Answer

The 'recv' string does not match the exact format of the server's response.. The 'recv' string is set to '200 OK'. However, the HTTP response from the server usually includes a status line like 'HTTP/1.1 200 OK'. If the server sends 'HTTP/1.1 200 OK', the BIG-IP will match the '200 OK' part. The issue often lies in trailing whitespace, hidden characters, or the fact that the 'recv' string is case-sensitive and must exactly match a portion of the raw HTTP response body or headers.

Answer

The 'send' string is missing the User-Agent header.

Answer

The timeout is too short for the server to process the request.

Answer

The connection is being closed prematurely by the BIG-IP.

Question 11

Which THREE conditions must be met for the BIG-IP to perform SNAT (Source Network Address Translation) correctly when traffic leaves the BIG-IP to the backend servers?

Accepted Answer

The BIG-IP must have a floating IP address configured on the server-side VLAN.. SNAT is essential when the backend servers are not using the BIG-IP as their default gateway. Without SNAT, the return traffic would go directly to the client, bypassing the BIG-IP. This creates an asymmetric routing scenario that the client will reject. The BIG-IP must translate the source IP to its own address so the return traffic is forced back through the BIG-IP system for proper synchronization and delivery.

Answer

The backend servers must have the BIG-IP as their default gateway.

Answer

The client traffic must be encrypted using SSL.

Question 12

A user is complaining about intermittent access to an application. The logs show that some connections are failing at the TCP handshake stage. What should the administrator check first?

Accepted Answer

Check for route and network connectivity issues.. When TCP handshakes fail, it often indicates a network-level issue or a discrepancy in connection handling. Checking the virtual server's 'Idle Timeout' is a logical first step, but more importantly, looking for IP address conflicts or VLAN misconfigurations on the BIG-IP is essential. In an LTM context, verifying if the backend servers have the correct route back to the client or the BIG-IP is the most common cause of handshake failures.

Answer

Check the persistence profile settings.

Answer

Check the iRules associated with the virtual server.

Answer

Check the HTTP profile configuration.

Question 13

An administrator wants to ensure that specific types of traffic are blocked based on the client IP address. Which feature should be used?

Accepted Answer

Configure an iRule to drop connections from the specified IP.. The 'Network Firewall' or simple 'Packet Filter' can block traffic, but for LTM-specific policy enforcement, an iRule or a Local Traffic Policy is the most granular and effective tool. Policies allow for defining rules based on various criteria, including client IP, protocol, and other L7 attributes, providing a declarative and easily manageable way to secure the virtual server at the entry point of the application.

Answer

Modify the server's local firewall.

Answer

Change the pool member's health monitor.

Answer

Disable the Virtual Server.

Question 14

Which THREE items are included in a standard BIG-IP UCS (User Configuration Set) archive file?

Accepted Answer

The full BIG-IP license file.. A UCS file is the primary method for backing up a BIG-IP configuration. It contains the essential files required to restore a BIG-IP system to a known good state. This includes the configuration files (bigip.conf), the internal database (bigip_base.conf), and the license file. It is the recommended format for migrating or rolling back changes during maintenance or after a failed upgrade.

Answer

The entire operating system image (ISO).

Answer

The /var/log/ directory content.

Question 15

An LTM Specialist notices that a virtual server using a Cookie Insert persistence profile is not correctly routing returning clients to their original pool members. Which configuration issue is the most likely cause?

Accepted Answer

The virtual server does not have an HTTP profile enabled.. Cookie Insert persistence relies on the BIG-IP device injecting a cookie into the HTTP response header. If the persistence profile is not associated with the virtual server, or if the HTTP profile is missing from the virtual server configuration, the BIG-IP cannot perform the necessary header manipulation. This process is critical for session affinity in stateless web applications where the client IP address may frequently change due to proxy environments.

Answer

The virtual server is missing a required Client SSL profile.

Answer

The pool member health monitor is set to a Gateway ICMP type.

Answer

The persistence profile timeout is set to zero.