F5-CTS-LTM BIG-IP Local Traffic Manager — Timed 10 Questions

Question 1

An LTM Specialist notices that a virtual server using a Cookie Insert persistence profile is not correctly maintaining session affinity for users. The application serves content over HTTPS and uses secure cookies. What must be configured to ensure persistence functions correctly?

10 minute time limit — choose an answer to begin.

Accepted Answer

Configure the persistence profile with the 'Secure' flag enabled.. Persistence using Cookie Insert relies on the client returning the cookie provided by the BIG-IP. Because the application uses Secure cookies, the BIG-IP must be configured to match those security attributes. If the cookie is flagged as Secure but the persistence profile does not reflect this, the browser will ignore the set-cookie header, resulting in persistence failure. This is critical in load balancing environments where session state is maintained on specific backend pool members.

Answer

Enable the 'Always Send' option in the persistence profile.

Answer

Increase the persistence timeout to match the application session timeout.

Answer

Change the persistence method to Source Address Affinity.

Question 2

An LTM Specialist needs to ensure that all traffic sent to a specific virtual server is logged for auditing purposes. Which method is most efficient for capturing detailed request and response information without significantly degrading performance?

Accepted Answer

Configure High-Speed Logging (HSL) via an iRule.. High-speed logging (HSL) is the recommended way to log traffic on BIG-IP. Unlike older logging methods that rely on local syslog, HSL sends logs to a remote collector over a dedicated, non-blocking path. This prevents the BIG-IP's management processor from becoming a bottleneck, ensuring that auditing requirements are met without impacting the performance of the data plane or the availability of the application services.

Answer

Enable verbose debug logging in the Local Traffic log level.

Answer

Use iRules with the 'log' command to write to /var/log/ltm.

Answer

Capture traffic using tcpdump and save it to a file.

Question 3

Which THREE conditions must be met for a SNAT to be used by a virtual server to translate the source IP address of outbound traffic?

Accepted Answer

The Virtual Server must have a SNAT pool or 'Automap' configured.. SNAT is necessary when the server cannot route directly back to the client, or when the server needs to see a consistent source IP for policy reasons. The virtual server must be configured with a SNAT type (either Automap or a specific SNAT pool), the BIG-IP must be in the traffic path for both directions, and the packet must be traversing the BIG-IP as a full proxy. If any of these are missing, the SNAT will not engage.

Answer

The Virtual Server must be configured with a FastL4 profile.

Answer

The backend server must have the BIG-IP as its default gateway.

Question 4

An LTM administrator needs to ensure that client requests are consistently mapped to the same backend server based on the source IP address for a duration of 30 minutes. Which persistence method should the administrator configure?

Accepted Answer

Source Address Affinity. Source Address Affinity persistence, also known as sticky persistence, is the correct mechanism here. It uses the client's source IP address to map the session to a specific pool member. By setting the timeout to 1800 seconds, the BIG-IP ensures the mapping persists for exactly 30 minutes. This is critical for applications requiring session state continuity without cookie support or specific application headers.

Answer

Cookie Persistence

Answer

Universal Persistence

Answer

SSL Session ID Persistence

Question 5

Refer to the exhibit. An LTM administrator observes that 10.1.1.5 is marked as 'disabled'. How will this affect traffic flow for existing and new connections to the virtual server associated with this pool?

Accepted Answer

New connections are sent to 10.1.1.6; existing connections are maintained.. When a pool member is marked as disabled, the BIG-IP stops sending new connections to that member while allowing existing connections to complete if persistence or connection mirroring is active. This state differs from 'down' which implies a health monitor failure. Understanding these states is vital for graceful maintenance procedures without dropping active user sessions abruptly during server rotation or patching cycles.

Answer

New connections are dropped; existing connections are immediately reset.

Answer

New connections are rejected; existing connections are sent to 10.1.1.6.

Answer

The virtual server will stop responding to all traffic.

Question 6

An LTM administrator is implementing a new virtual server and needs to ensure secure traffic handling. Which TWO of the following configurations are required to terminate SSL traffic at the BIG-IP?

Accepted Answer

Assign a Client SSL profile to the virtual server.. SSL termination requires a Client SSL profile to decrypt incoming traffic and a Server SSL profile if re-encryption to the backend is required (though strictly for termination, the Client SSL profile is the core requirement). By decrypting at the BIG-IP, the device can inspect, manipulate, and load-balance traffic based on Layer 7 headers, which is essential for advanced application delivery services.

Answer

Enable SNAT automap on the virtual server.

Answer

Assign a Server SSL profile to the virtual server.

Answer

Enable iRule processing on the virtual server.

Question 7

An LTM administrator needs to block traffic from a specific range of malicious IP addresses. What is the most efficient way to achieve this at the BIG-IP level?

Accepted Answer

Use an iRule to check the client IP against a Data Group.. Using an LTM Network Firewall policy or an iRule with an IP data group is the industry standard. However, the most efficient way is a 'Network Firewall' or 'Advanced Firewall Manager' policy if licensed, or an iRule with a data group for standard LTM. These methods scale significantly better than individual firewall rules by using high-performance lookups against optimized memory structures.

Answer

Apply a packet filter to the virtual server.

Answer

Create an individual virtual server for each blocked IP.

Answer

Configure each pool member to reject the traffic.

Question 8

An administrator notices that the BIG-IP is not correctly identifying the client's IP address when connections are proxied through an upstream device. What should the administrator configure to solve this?

Accepted Answer

Enable 'X-Forwarded-For' in the HTTP profile.. When an upstream device proxies traffic, the BIG-IP's source IP appears as the upstream device's IP. To see the true client IP, the administrator must configure the BIG-IP to inspect headers, typically the 'X-Forwarded-For' header. This is done via an HTTP profile where the header insertion or parsing logic is configured to extract the original client IP from the HTTP request headers.

Answer

Configure a SNAT pool with the upstream IP address.

Answer

Change the load balancing algorithm to 'Least Connections'.

Answer

Disable the Client SSL profile on the virtual server.

Question 9

Refer to the exhibit. An administrator wants to modify this virtual server to support HTTPS. What is the minimum configuration change required?

Accepted Answer

Change port to 443 and add a Client SSL profile.. To support HTTPS, the virtual server must handle encrypted traffic. This requires changing the port to 443 (as defined by HTTPS standards) and attaching a Client SSL profile. The HTTP profile must also be kept to allow the BIG-IP to decrypt and parse the HTTP traffic after the SSL handshake is terminated by the Client SSL profile, ensuring the BIG-IP can perform application-layer operations.

Answer

Add a Server SSL profile to the virtual server.

Answer

Change the destination address to 10.0.0.1:443.

Answer

Remove the HTTP profile and add a Client SSL profile.

Question 10

An LTM administrator is troubleshooting a Virtual Server that is failing to pass traffic. The pool members are marked as UP. Which TWO of the following configurations could cause the traffic to drop at the virtual server level?

Accepted Answer

The Virtual Server has an iRule assigned that triggers a 'drop' command under specific conditions.. Virtual Server traffic flow relies on proper mapping of profiles and services. If the configuration is inconsistent, such as missing an iRule dependency or having a conflicting port/protocol mismatch, the LTM drops the connection. Identifying these misconfigurations is essential for LTM troubleshooting, as it differentiates between backend server application failures and middle-box configuration errors that block traffic before it even reaches the load-balanced pool members.

Answer

The pool members are configured with a different port than the Virtual Server destination port.

Answer

The Virtual Server is assigned a Client SSL profile while the protocol is set to UDP.

Answer

The SNAT pool is exhausted and cannot allocate source ports for the connection.