F5-CTS-LTM BIG-IP Local Traffic Manager Practice Test 7 — 15 Questions

Question 1

A virtual server is configured with a OneConnect profile. What is the primary benefit of enabling OneConnect in this scenario?

Accepted Answer

It reduces the number of TCP connections opened on backend servers.. OneConnect allows the BIG-IP to reuse existing TCP connections between the BIG-IP and the backend pool members. By multiplexing many client-side requests over a smaller number of established server-side connections, it significantly reduces the overhead of TCP handshake (SYN/ACK) processes on the backend servers. This is particularly effective for high-traffic applications that use short-lived HTTP connections, leading to improved server resource utilization and overall application latency.

Answer

It enables hardware-based SSL offloading.

Answer

It forces all traffic to be encrypted using the strongest ciphers.

Answer

It eliminates the need for Source Address persistence.

Question 2

Refer to the exhibit. Clients are reporting 'SSL Handshake Failure' errors. What is the most likely cause?

Accepted Answer

The cipher string excludes TLS 1.0, which some clients require.. The cipher string 'DEFAULT:!SSLv3:!TLSv1' explicitly disables TLS 1.0. Many legacy clients still require TLS 1.0 to establish a handshake. By excluding it, the BIG-IP is rejecting any connection attempt from clients that do not support TLS 1.1 or higher. This is a common configuration error when trying to harden security without auditing the client base's compatibility first.

Answer

The certificate has expired.

Answer

The virtual server is missing an HTTP profile.

Answer

The key and certificate do not match.

Question 3

An LTM Specialist is asked to prevent users from accessing a specific subdirectory on a website, e.g., '/admin'. What is the most secure and efficient way to do this?

Accepted Answer

Use a Local Traffic Policy to reject requests for '/admin'.. Using a Local Traffic Policy is the most efficient and secure way to block access to specific URI paths. By creating a policy rule that matches the request path against '/admin' and setting the action to 'reject' or 'drop', the BIG-IP intercepts the malicious or unauthorized request before it ever reaches the backend servers. This provides a clear, configurable, and high-performance security boundary for the application.

Answer

Create an iRule to log the request and drop the connection.

Answer

Configure a custom health monitor to mark the server down.

Answer

Enable a Persistence profile to filter the URI.

Question 4

An LTM Specialist needs to ensure that client traffic is distributed evenly across four backend servers, but some servers are more powerful than others. Which load balancing method should be chosen?

Accepted Answer

Ratio. Ratio load balancing is the appropriate method when server capacities differ. By assigning a higher ratio weight to the more powerful servers, the BIG-IP will send a proportionally larger amount of traffic to them. This ensures that the load is balanced relative to the processing power of each backend node, maximizing the performance of the overall application cluster and preventing smaller servers from being overwhelmed.

Answer

Round Robin

Answer

Least Connections

Answer

Observed

Question 5

A company requires that traffic be load balanced based on server response time. The LTM must dynamically select the server that is currently responding the fastest. Which load balancing algorithm should be used?

Accepted Answer

Fastest. The 'Fastest' load balancing algorithm tracks the time it takes for a server to respond to a request. The BIG-IP uses this metric to dynamically direct new connections to the pool member that currently provides the lowest latency. This is highly effective in environments where server performance varies due to heterogeneous hardware or fluctuating application loads.

Answer

Round Robin

Answer

Least Connections

Answer

Observed

Question 6

Which THREE conditions must be met for Connection Mirroring to function correctly between two BIG-IP devices in a high-availability pair?

Accepted Answer

The devices must be members of a Sync-Failover device group.. Connection Mirroring requires specific synchronization prerequisites. The devices must be in a device group, a mirror IP address must be defined for the VLANs, and the virtual server must have mirroring explicitly enabled. This ensures that the state information of TCP and persistence sessions is replicated, allowing for hitless failover where clients do not have to re-establish their connections upon a standby-to-active transition.

Answer

The virtual server must use a 'Fast L4' profile.

Answer

The pool members must be in the same subnet as the BIG-IP.

Question 7

Which health monitor should be used to verify that a web application is not just responding to TCP connections, but is actually serving the correct content?

Accepted Answer

HTTP Monitor. An HTTP or HTTPS monitor is required to verify the content of the response. Unlike a simple TCP monitor, which only checks for a successful three-way handshake, an HTTP monitor sends a GET request to a specific URI and checks the response for a 'Receive String'. This ensures the application layer is functioning and the web server is actually serving the expected site content.

Answer

TCP Monitor

Answer

ICMP Monitor

Answer

External Monitor

Question 8

Which TWO of the following are benefits of using SNAT (Source Network Address Translation) on a BIG-IP LTM?

Accepted Answer

Simplifies return routing for backend servers.. SNAT simplifies return routing by ensuring traffic returns to the BIG-IP rather than the client, and it hides the backend infrastructure from the public internet. By SNATing the traffic to the BIG-IP's self-IP, the backend server sees the request as coming from the BIG-IP. This prevents asymmetric routing issues and enhances security by abstracting the backend server IP addresses from the end-user environment.

Answer

Increases the encryption speed of the SSL handshake.

Answer

Improves the load balancing algorithm's accuracy.

Answer

Enables the use of cookie-based persistence.

Question 9

Which BIG-IP feature allows an administrator to modify the HTTP header of a request before it reaches the backend server?

Accepted Answer

iRule. An iRule is the primary mechanism for manipulating traffic at the application layer. By using events like HTTP_REQUEST, an administrator can insert, modify, or delete HTTP headers on the fly. This is essential for scenarios like adding X-Forwarded-For headers, removing security-sensitive headers, or injecting custom application-specific tokens to communicate information to the backend servers that the client did not initially provide.

Answer

SNAT Pool

Answer

HTTP Profile

Answer

Virtual Server

Question 10

An administrator wants to redirect all incoming HTTP traffic on port 80 to HTTPS on port 443. What is the most effective approach?

Accepted Answer

Use an iRule on a separate HTTP virtual server to send a redirect.. Creating a separate HTTP virtual server that uses an iRule to perform a 301 or 302 redirect is the most effective method. This keeps the logic clean and separates the handling of unencrypted traffic (redirecting it) from the encrypted virtual server that handles the actual application traffic, ensuring clear separation of concerns in the configuration while maintaining a secure user experience.

Answer

Configure the existing HTTPS VS to also listen on port 80.

Answer

Enable 'Force HTTPS' in the pool configuration.

Answer

Use a SNAT pool to force traffic to port 443.

Question 11

What happens to the BIG-IP system when the failover trigger occurs in a high-availability pair?

Accepted Answer

The secondary unit becomes the active unit and assumes the floating IPs.. During a failover, the standby unit assumes control by taking over the floating IP addresses and processing the traffic load. The former active unit transitions to standby mode. This process is orchestrated by the failover mechanism to ensure high availability, with the 'active' status moving to the secondary unit to prevent service disruption, provided that connection mirroring was configured for active sessions.

Answer

The configuration is wiped and reset to factory defaults.

Answer

The traffic is dropped until an administrator reboots the system.

Answer

The BIG-IP enters a maintenance mode to run diagnostics.

Question 12

Which component of the BIG-IP architecture is responsible for performing the actual load balancing of traffic to pool members?

Accepted Answer

The TMM (Traffic Management Microkernel). The TMM (Traffic Management Microkernel) is the heart of the BIG-IP system. It is a specialized, high-performance kernel that handles all traffic processing, including load balancing, SSL termination, and iRule execution. Unlike the standard Linux kernel, which handles management tasks, the TMM is optimized for high-throughput packet processing, which is the core requirement for LTM services in modern network environments.

Answer

The Linux kernel

Answer

The Control Plane

Answer

The Configuration Utility (GUI)

Question 13

What happens when a health monitor fails for a pool member?

Accepted Answer

The BIG-IP marks the member as 'down' and stops sending new connections.. When a health monitor fails, the BIG-IP marks the pool member as 'down' and immediately stops sending new traffic to it. Depending on the virtual server configuration, existing connections may be maintained or terminated. This automated process ensures that only healthy, verified backend servers receive traffic, which is critical for maintaining overall application availability and preventing user exposure to non-functional server components.

Answer

The BIG-IP sends an alert to the administrator and keeps the member active.

Answer

The BIG-IP automatically attempts to reboot the backend server.

Answer

The BIG-IP automatically removes the member from the pool configuration.

Question 14

An administrator configures a standard Virtual Server with a destination IP of 10.10.10.20:443, using a SNAT Pool instead of Auto Map. During peak hours, connections begin to fail because the SNAT pool only contains a single IP address and port exhaustion occurs. Which architectural adjustment best resolves this issue while maintaining security?

Accepted Answer

Add additional IP addresses to the existing SNAT pool to increase the total number of available ephemeral translation ports.. Expanding the SNAT pool by adding multiple IP addresses provides a larger translation address space and multiplies the available ephemeral port capacity per destination. This prevents port exhaustion during traffic spikes without sacrificing the controlled source IP mapping required by downstream security policies.

Answer

Switch the source address translation setting from SNAT Pool to Auto Map to leverage all available self IP addresses.

Answer

Increase the connection timeout profile value to allow closed connections to linger and free up sockets more gradually.

Answer

Configure a OneConnect profile on the virtual server to enable HTTP connection multiplexing across backend servers.

Question 15

An administrator needs to ensure that client SSL traffic is terminated at the BIG-IP LTM while maintaining persistence based on a specific session cookie. Which profile combination correctly enables this functionality?

Accepted Answer

Client SSL profile and Cookie Persistence profile. To terminate SSL, a Client SSL profile must be assigned to the Virtual Server. To persist based on a cookie, a Cookie Persistence profile must be enabled. This combination is standard for web applications requiring secure transport and session stickiness. Understanding this architecture is vital because the LTM must decrypt traffic to inspect and insert the persistence cookie, allowing the BIG-IP to make intelligent load-balancing decisions based on application-layer data.

Answer

Server SSL profile and Source Address Affinity profile

Answer

Client SSL profile and Source Address Affinity profile

Answer

Server SSL profile and Cookie Persistence profile