F5-CTS-LTM BIG-IP Local Traffic Manager Practice Test 6 — 15 Questions

Question 1

An LTM administrator needs to ensure that a pool member remains in the pool but stops receiving new connections while existing connections are allowed to finish. Which action should the administrator perform?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the pool member state to Disabled.. Setting a member to 'Disabled' status allows the F5 to stop sending new traffic to that specific resource while maintaining existing persistent connections. This is critical during maintenance windows or server patching scenarios where abrupt connection termination would cause application errors or data loss. By using the Disable state, the BIG-IP gracefully drains the server of active traffic before the administrator takes the server offline for actual maintenance tasks.

Answer

Set the pool member state to Offline.

Answer

Remove the pool member from the pool configuration.

Answer

Apply a forced-down health monitor to the member.

Question 2

Which TWO of the following statements regarding SNAT automap are true?

Accepted Answer

SNAT automap uses the self-IP of the egress VLAN.. SNAT automap uses the self-IP address associated with the egress VLAN of the backend server. It is a fundamental feature for handling asymmetric routing and ensuring that backend servers do not attempt to send return traffic directly to the client's public IP. Understanding SNAT behavior is vital for troubleshooting connectivity issues where return traffic might be dropped due to network path mismatches or firewall restrictions within the local data center.

Answer

SNAT automap always uses the Virtual Server IP address.

Answer

SNAT automap maintains the original client source IP address.

Answer

SNAT automap consumes one virtual server instance per connection.

Question 3

An administrator wants to redirect all HTTP traffic to HTTPS. Which configuration object is best suited for this task?

Accepted Answer

A Local Traffic Policy with a redirect action.. An iRule using the 'HTTP::redirect' command is the standard way to force traffic from insecure to secure ports. While Local Traffic Policies can also perform this, iRules provide granular control for complex logic like URI inspection or header manipulation. Mastering redirects ensures compliance with security mandates and improves user experience by ensuring that all sensitive interactions are encrypted via TLS/SSL before any application data is exchanged.

Answer

A standard Virtual Server pool assignment.

Answer

A SNAT pool configuration.

Answer

A FastL4 profile.

Question 4

Which THREE criteria determine if a connection is considered a 'matching' connection for an existing persistence record?

Accepted Answer

The persistence key value.. Connection persistence relies on specific criteria to identify recurring clients. By matching elements like the persistence key, virtual server, and pool, the BIG-IP ensures traffic consistency. If these criteria are not met, the system will ignore the existing record and initiate a new load-balancing decision, which can cause session drops or unexpected behavior in stateful applications requiring continuous affinity.

Answer

The client's source IP address.

Answer

The client's browser user-agent string.

Question 5

An administrator configures a standard Virtual Server with a destination IP of 10.10.10.50:443 and applies a Client SSL profile and an HTTP profile. Users report that they receive connection timeout errors when attempting to access the application. Upon checking the BIG-IP system, the administrator notices that the associated pool has zero active members. What configuration component must the administrator verify to ensure traffic is correctly handled when no pool members are available?

Accepted Answer

Check the Fallback Host setting within the HTTP profile to ensure clients receive a redirection response instead of experiencing a connection timeout.. The HTTP profile and overall virtual server processing rely on defined fallback behaviors or fallback host settings when pool members are unavailable. If no pool members are active, the connection drops unless a specific HTTP response or fallback mechanism is configured. Verifying pool membership status and fallback settings ensures proper error handling rather than silent connection timeouts for requesting clients.

Answer

Verify that the SNAT pool assigned to the virtual server includes internal IP addresses matching the client subnet to prevent asymmetrical routing paths.

Answer

Ensure the Client SSL profile contains a valid certificate and private key chain matching the requested domain name to complete the handshake.

Answer

Modify the idle timeout value in the FastL4 profile to allow long-lived TCP connections to remain open without dropping packets prematurely.

Question 6

A BIG-IP LTM administrator deploys a One-Pass Virtual Server configuration to optimize internal traffic processing. The architecture requires both Client SSL and Server SSL profiles to be applied simultaneously to decrypt incoming secure traffic, inspect application payloads via iRules, and re-encrypt the traffic before sending it to backend pool members. What is a critical design requirement for this configuration to function properly?

Accepted Answer

The Server SSL profile must be associated with a valid cipher group that matches the supported cryptographic standards required by the backend pool members.. One-Pass architecture and SSL profile combinations demand precise configuration of connection reuse and proxy options to avoid session state mismatches. Ensuring both profiles interact correctly through proper SNI and server-side authentication parameters prevents handshake failures and maintains end-to-end security compliance across the load balancing boundary.

Answer

The SNAT automap feature must be disabled on the virtual server to ensure backend servers receive the original client IP address directly without modification.

Answer

The HTTP profile must be explicitly disabled because standard layer 7 payload inspection interferes with the cryptographic handshake of server-side SSL sessions.

Answer

The virtual server destination port must be changed to port 80 to allow the BIG-IP to downgrade the incoming secure stream into cleartext internally.

Question 7

An administrator needs to configure a high-performance HTTP virtual server that offloads SSL processing and performs layer 7 persistence based on HTTP cookies. Which TWO profile types must be explicitly assigned to the virtual server configuration to achieve this behavior? (Choose two.)

Accepted Answer

HTTP Profile. Layer 7 cookie persistence requires an HTTP profile to parse application traffic and insert or read session cookies. Additionally, processing encrypted client connections demands a Client SSL profile to handle decryption before the BIG-IP evaluates the HTTP payload. Selecting both profiles ensures correct session affinity and secure transport layer termination.

Answer

TCP Profile

Answer

Server SSL Profile

Answer

FastL4 Profile

Question 8

An LTM Specialist needs to configure a virtual server to load balance UDP traffic for a DNS service. The virtual server must support a high volume of short-lived queries and must not maintain connection state for longer than necessary. Which configuration should the Specialist use?

Accepted Answer

A performance (Layer 4) virtual server with a FastL4 profile and the 'Stateless' option enabled.. For high-volume, short-lived UDP traffic such as DNS, a performance (Layer 4) virtual server with FastL4 and the 'Stateless' option enabled is optimal. This configuration eliminates connection state tracking, reducing overhead and improving performance. Other options either maintain state or use inappropriate profiles like OneConnect, which is for TCP. The stateless FastL4 approach is specifically designed for scenarios where connection state is not needed.

Answer

A performance (Layer 4) virtual server with a FastL4 profile and a UDP profile.

Answer

A standard virtual server with a UDP profile and a source IP persistence profile.

Answer

A standard virtual server with a UDP profile and a OneConnect profile.

Question 9

An LTM Specialist is troubleshooting a virtual server where health monitors are failing despite the backend servers responding to ICMP. The health monitor is configured for HTTPS. Which TWO items should the specialist verify to ensure the monitor accurately reflects service availability?

Accepted Answer

The cipher suite compatibility between the BIG-IP and the pool member.. When HTTPS monitors fail despite successful ICMP responses, the issue usually involves TLS handshake failures or application-layer response mismatches. Checking the cipher compatibility ensures the BIG-IP and server can establish a secure connection. Verifying the receive string is vital because a 200 OK status code does not guarantee the application is actually functional; the BIG-IP must receive the expected content within the response body to confirm service health.

Answer

The ICMP timeout value on the internal VLAN interface.

Answer

The persistence profile assigned to the virtual server.

Answer

The SNAT pool associated with the virtual server.

Question 10

Refer to the exhibit. The LTM Specialist discovers that the HTTPS monitor is failing. The server logs indicate that the requests are reaching the web server, but the server is returning a 400 Bad Request error. What is the most likely cause?

Accepted Answer

The Host header in the send string does not match the server's expected virtual host.. The exhibit shows a manually defined send string that includes a Host header. A 400 Bad Request often indicates that the server does not recognize the Host header or the HTTP version specified in the request. In this configuration, the 'Host: example.com' header might be mismatched with the server's virtual host configuration, causing it to reject the request, which prevents the monitor from correctly identifying the server as healthy.

Answer

The BIG-IP is using the wrong SSL profile for the monitor.

Answer

The monitor is missing a 'Receive String' definition.

Answer

The monitor is using the wrong HTTP method.

Question 11

Which BIG-IP feature allows an LTM Specialist to perform granular inspection and modification of HTTP traffic headers before they reach the backend server?

Accepted Answer

iRules. iRules are the primary tool for custom traffic manipulation on the BIG-IP. They provide an event-driven Tcl-based scripting environment that allows specialists to intercept, inspect, and modify any part of the packet, including HTTP headers. This is essential for advanced load balancing scenarios, such as header-based routing, security obfuscation, or dynamic application integration that standard profiles cannot handle natively.

Answer

Local Traffic Policy

Answer

Persistence Profile

Answer

FastL4 Profile

Question 12

A client is experiencing intermittent connection resets when accessing a virtual server. The LTM Specialist observes that the backend servers are occasionally overwhelmed during traffic spikes. Which feature should be implemented to mitigate this impact on the backend servers?

Accepted Answer

Enable Connection Limits on the pool members.. Connection limits are the direct way to prevent backend servers from becoming overwhelmed. By setting a per-member connection limit, the BIG-IP will stop sending traffic to a server once it hits capacity, instead directing it to other available servers. This protects the backend from failure, ensuring the overall application remains available even when specific nodes are under extreme load conditions during traffic bursts.

Answer

Increase the idle timeout in the TCP profile.

Answer

Configure a SNAT pool with more IP addresses.

Answer

Change the load balancing method to Least Connections.

Question 13

An LTM Specialist needs to configure a virtual server to handle both HTTP and HTTPS traffic on the same IP address. Which THREE steps are required to implement this? (Select THREE)

Accepted Answer

Create two virtual servers using the same virtual IP address.. To support both protocols, the BIG-IP needs a virtual server for each port (80 and 443). To handle them identically, they must share a pool. Additionally, the HTTPS virtual server requires an SSL profile to decrypt the traffic before it is load-balanced to the backend. This architecture allows the BIG-IP to manage both cleartext and encrypted sessions efficiently while centralizing management of the backend pool.

Answer

Configure a single virtual server with a wildcard port.

Answer

Disable the HTTP profile on the HTTPS virtual server.

Question 14

Refer to the exhibit. The virtual server is showing client-side traffic but no server-side traffic. What is the most likely reason?

Accepted Answer

All pool members are currently marked down by health monitors.. When a virtual server shows incoming client traffic but zero outgoing server traffic, it usually indicates that the BIG-IP cannot establish a connection to the pool members. This is often caused by a pool being empty, all members being marked down by health monitors, or a routing issue preventing the BIG-IP from reaching the backend servers. The lack of server-side connections confirms the BIG-IP is not successfully forwarding requests.

Answer

The virtual server is configured with an incorrect destination IP address.

Answer

The client is sending traffic that does not match the HTTP profile.

Answer

The BIG-IP is configured with an incorrect default gateway.

Question 15

An application requires persistence based on a specific custom header named 'X-Session-ID'. The LTM Specialist has confirmed the header is always present in requests. Which persistence method is most appropriate?

Accepted Answer

Universal persistence. Universal persistence is the only method that allows the BIG-IP to persist traffic based on arbitrary data found within the request. By extracting the value of the 'X-Session-ID' header using an iRule and mapping it to a persistence record, the BIG-IP can ensure that all requests with the same session ID are consistently routed to the same backend server, regardless of the client's IP address.

Answer

Cookie Insert persistence

Answer

Source Address persistence

Answer

Hash persistence