F5-CTS-LTM BIG-IP Local Traffic Manager Practice Test 5 — 15 Questions

Question 1

An enterprise environment requires high availability and seamless failover for mission-critical web applications managed by BIG-IP LTM. Which THREE statements regarding connection mirroring and persistence mirroring are accurate? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Connection mirroring replicates the active TCP sequence numbers and state tables to the standby unit.. Connection mirroring replicates active TCP and UDP connection state tables to the peer BIG-IP device, ensuring existing flows persist without interruption after a failover. Persistence mirroring syncs persistence record entries so returning clients maintain affinity to the same pool member. State replication consumes additional CPU and memory resources.

Answer

Connection mirroring automatically forces all backend pool members to maintain mirrored keep-alive probes.

Answer

Enabling mirroring eliminates the need for session synchronization protocols like ConfigSync across the device cluster.

Question 2

An administrator configures a BIG-IP Virtual Server with an HTTP profile and an iRule that inspects the HTTP URI. Users report that certain requests containing uppercase characters in specific URI paths fail to match the iRule condition. What is the most efficient way to resolve this issue in the iRule?

Accepted Answer

Rewrite the iRule conditional statements to evaluate the URI using the [string tolower [HTTP::uri]] command.. HTTP URIs are case-sensitive by default in BIG-IP iRules. To ensure consistent matching regardless of user input capitalization, the string being evaluated should be converted to lowercase using the string tolower command before executing conditional evaluations, preventing case-mismatch application errors.

Answer

Modify the HTTP profile to enforce lowercase normalization on all inbound client request headers.

Answer

Replace the standard HTTP profile with a FastHTTP profile to automatically handle case-insensitive URI matching.

Answer

Configure a local traffic policy with regular expression wildcards to bypass iRule processing constraints.

Question 3

A BIG-IP administrator configures a performance L4 Virtual Server. A user attempts to access an application through this virtual server, but the BIG-IP system drops the SYN packet. Upon inspecting packet captures, the administrator notices that the SYN packet lacks a valid three-way handshake acknowledgement because packet filters dropped it. Which condition causes a Performance L4 Virtual Server to reject traffic in this manner?

Accepted Answer

The incoming packet violated active packet filter rules or port lockdown settings configured on the receiving self IP.. Performance L4 virtual servers rely heavily on underlying packet filter rules and strict port forwarding logic. If packet filters or Port Lockdown settings on self IPs block the incoming traffic, the L4 profile drops the packet before creating a connection table entry, optimizing performance by bypassing full software proxy processing.

Answer

The virtual server destination port does not match an explicit listener definition in the Packet Filter table.

Answer

The FastL4 profile dropped the packet because it lacked an active server-side pool member connection state.

Answer

The SYN packet was dropped because Layer 7 application profiles require full proxy inspection before forwarding.

Question 4

An LTM administrator needs to ensure that client SSL sessions are terminated at the BIG-IP device while maintaining the original client IP address for the backend web servers. Which configuration approach satisfies this requirement?

Accepted Answer

Enable the 'Insert X-Forwarded-For' option in the HTTP profile and apply a Client SSL profile to the virtual server.. To maintain the client IP, the BIG-IP must use an X-Forwarded-For HTTP profile insert. SSL termination is handled by the Client SSL profile applied to the virtual server. This combination allows the BIG-IP to decrypt traffic, inject the header, and pass the original client address to backend servers, which is critical for logging and application-level security policies that depend on source visibility.

Answer

Apply a SNAT pool on the virtual server and use a Server SSL profile to re-encrypt traffic to the backend.

Answer

Configure the virtual server as a Layer 4 performance (L4) virtual server to pass traffic without inspection.

Answer

Disable SNAT on the virtual server and use a transparent VLAN configuration without an HTTP profile.

Question 5

Which TWO of the following are valid methods to ensure that high availability (HA) state changes are synchronized between BIG-IP devices in a device group?

Accepted Answer

Configuring a dedicated ConfigSync IP address on each device in the device group.. To maintain synchronized configuration across a device group, F5 utilizes ConfigSync and Auto-Sync mechanisms. ConfigSync allows administrators to push or pull changes manually, while Auto-Sync enables the system to automatically propagate changes. Ensuring these are configured correctly is essential for maintaining consistent policy enforcement and preventing traffic disruption during failover events between members of a device group.

Answer

Enabling the 'Sync-Only' mode on all virtual servers to force state updates.

Answer

Setting the HA group to 'Active-Active' mode for all traffic processing.

Answer

Manually restarting the MCPD service on both devices after every configuration change.

Question 6

An LTM administrator wants to ensure that specific URIs on a web application are handled by a different server pool than the main application. Which feature is best suited for this requirement?

Accepted Answer

Configure a Local Traffic Policy to match the HTTP URI and select the appropriate pool.. Local Traffic Policies are the modern, recommended method for traffic steering. They allow for granular matching based on HTTP URI, host, or other request attributes, and then applying actions like 'forward to pool'. This approach is more performant and easier to manage than legacy iRules, making it the standard choice for routing traffic based on path-based logic in modern LTM environments.

Answer

Create an iRule using the 'switch' statement on the HTTP_REQUEST event.

Answer

Use a persistence profile configured to look at the URI content.

Answer

Apply a SNAT pool to the virtual server to differentiate the traffic sources.

Question 7

Which THREE actions are performed by the BIG-IP when a 'Cookie Insert' persistence profile is active?

Accepted Answer

The BIG-IP injects a Set-Cookie header into the response from the pool member.. Cookie Insert persistence involves the BIG-IP injecting a cookie into the server response. This allows the client to provide that cookie in subsequent requests, enabling the BIG-IP to maintain server affinity without relying on source IP or other unstable identifiers. This is a critical mechanism for ensuring session consistency in load-balanced environments where clients may have dynamic or changing IP addresses.

Answer

The BIG-IP deletes all existing cookies sent by the backend server.

Answer

The BIG-IP automatically fails over to the standby unit if the cookie is missing.

Question 8

Which THREE conditions must be met for a SNAT (Source Network Address Translation) to correctly translate client traffic?

Accepted Answer

The SNAT must be applied to the virtual server or globally on the VLAN.. SNAT is essential for ensuring that return traffic from the backend server flows back through the BIG-IP. Without a proper SNAT configuration, if the server's default gateway is not the BIG-IP, traffic might take an asymmetric path and be dropped by the client or network firewalls. Understanding these conditions is critical for designing robust network topologies where the BIG-IP is not the default gateway for backend pool members.

Answer

The BIG-IP must be the default gateway for the backend server.

Answer

The virtual server must use a 'Performance L4' profile to process the SNAT.

Question 9

An LTM administrator needs to ensure that client SSL sessions are terminated at the BIG-IP device while maintaining the original client IP address for the backend servers. Which configuration profile and feature combination is required to achieve this?

Accepted Answer

Configure an HTTP profile with 'Insert X-Forwarded-For' enabled and use SNAT None.. To preserve the client's original IP address when terminating SSL, the BIG-IP must insert the client IP into an HTTP header. The 'X-Forwarded-For' feature within an HTTP profile is the standard method for this. Since the BIG-IP terminates the SSL, it acts as the proxy, making this header insertion necessary for backend visibility. This is a critical design pattern in modern load balancing architectures to maintain logging integrity.

Answer

Enable SNAT Automap on the virtual server and use a TCP profile.

Answer

Apply a FastL4 profile and enable source address persistence.

Answer

Use a OneConnect profile and disable the SSL profile.

Question 10

An administrator observes that nodes in a pool are being marked 'down' even though they are reachable via ping. Which TWO of the following monitor configurations could cause this behavior?

Accepted Answer

The HTTP monitor 'Receive String' does not match the content returned by the server.. Health monitors must accurately reflect application-level availability. If a monitor is configured with an incorrect receive string or an overly aggressive interval/timeout, the node may be marked down despite being alive at the ICMP level. This distinction is vital for LTM specialists, as ping only verifies network reachability, whereas LTM must verify that the service port is actually responding to the expected application-layer protocol requests.

Answer

The 'Interval' is set to 5 seconds and the 'Timeout' is set to 16 seconds.

Answer

The pool member is configured with an explicit 'Health Monitor' set to 'None'.

Answer

The 'Reverse' option is enabled in the health monitor configuration.

Question 11

Refer to the exhibit. The administrator reports that pool members are intermittently marked down. Traffic analysis shows the server is responding with 'HTTP/1.1 200 OK' and the requested page. What is the most likely cause?

Accepted Answer

The 'Connection: Close' header is causing the server to reset the connection too quickly.. The monitor configuration includes 'Connection: Close' in the send string. If the server closes the connection before the BIG-IP has finished reading the response, or if the server response does not contain the exact '200 OK' string in the expected buffer, the monitor fails. Precise character matching is required, and timing issues during connection termination are common causes for intermittent monitor failures in production environments.

Answer

The 'Host' header in the send string is causing a 404 error on the web server.

Answer

The 'recv' string must be case-insensitive to match the server response correctly.

Answer

The 'interval' is too short, causing a TCP exhaustion on the server.

Question 12

Refer to the exhibit. An administrator has configured this cookie persistence profile. What is the impact of 'match-across-services enabled' in this environment?

Accepted Answer

The persistence record is shared across all virtual servers using this profile.. Enabling 'match-across-services' allows the BIG-IP to maintain persistence for the same client even if they access different virtual servers sharing the same pool or persistence context. This is crucial for applications that utilize multiple ports or services but require the client to remain attached to the same backend server instance to maintain session state, such as shopping carts or authenticated sessions.

Answer

The persistence record is only shared if the virtual servers share the same IP address.

Answer

The 'timeout 0' setting forces the cookie to expire immediately upon browser closure.

Answer

This setting enables persistence for non-HTTP traffic types.

Question 13

Which THREE actions are required to successfully implement SSL offloading on a BIG-IP LTM system?

Accepted Answer

Assign a Client SSL profile to the virtual server.. SSL offloading requires the BIG-IP to handle the cryptographic handshake, which involves a Client SSL profile, a server certificate, and a corresponding private key. The process effectively shifts the processing burden from the backend server to the BIG-IP. This is a standard LTM task that improves overall application performance and simplifies certificate management, as certificates are managed in one central location rather than on every individual server.

Answer

Install a Server SSL profile on the virtual server.

Answer

Enable SNAT Automap on the virtual server.

Question 14

Which component is used to monitor the health of a pool member by specifically verifying that a SQL query returns the correct result?

Accepted Answer

External Monitor. A custom database monitor, often based on an external script or a dedicated monitor type, is required to perform application-layer checks like database queries. Simple port checks are insufficient because they only verify that the database service is running, not that it is functional and capable of processing data. This ensures high availability by detecting failures at the query-processing level.

Answer

TCP Monitor

Answer

HTTP Monitor

Answer

ICMP Monitor

Question 15

An LTM administrator is troubleshooting a 'Connection Reset' error. Which BIG-IP feature should be used to capture traffic for analysis while filtering for a specific client IP address?

Accepted Answer

Use the 'tcpdump -i 0.0 host 10.1.1.1' command.. The 'tcpdump' utility is the standard CLI tool for capturing packets on the BIG-IP. Using it with specific filters (like 'host <IP>') is the most effective way to isolate traffic related to a single client. This allows the administrator to analyze the TCP handshake and reset packets in detail, which is critical for identifying whether the reset originates from the client, the BIG-IP, or the backend server.

Answer

Configure a 'Packet Capture' profile on the virtual server.

Answer

Check the LTM logs for 'Connection Reset' entries.

Answer

Enable 'Debug' mode in the TCP profile.