F5-CTS-LTM BIG-IP Local Traffic Manager — Timed 20 Questions

Question 1

An LTM Specialist notices that a virtual server using a Cookie Insert persistence profile is not correctly maintaining session affinity for users. The application serves content over HTTPS and uses secure cookies. What must be configured to ensure persistence functions correctly?

20 minute time limit — choose an answer to begin.

Accepted Answer

Configure the persistence profile with the 'Secure' flag enabled.. Persistence using Cookie Insert relies on the client returning the cookie provided by the BIG-IP. Because the application uses Secure cookies, the BIG-IP must be configured to match those security attributes. If the cookie is flagged as Secure but the persistence profile does not reflect this, the browser will ignore the set-cookie header, resulting in persistence failure. This is critical in load balancing environments where session state is maintained on specific backend pool members.

Answer

Enable the 'Always Send' option in the persistence profile.

Answer

Increase the persistence timeout to match the application session timeout.

Answer

Change the persistence method to Source Address Affinity.

Question 2

An LTM Specialist needs to ensure that all traffic sent to a specific virtual server is logged for auditing purposes. Which method is most efficient for capturing detailed request and response information without significantly degrading performance?

Accepted Answer

Configure High-Speed Logging (HSL) via an iRule.. High-speed logging (HSL) is the recommended way to log traffic on BIG-IP. Unlike older logging methods that rely on local syslog, HSL sends logs to a remote collector over a dedicated, non-blocking path. This prevents the BIG-IP's management processor from becoming a bottleneck, ensuring that auditing requirements are met without impacting the performance of the data plane or the availability of the application services.

Answer

Enable verbose debug logging in the Local Traffic log level.

Answer

Use iRules with the 'log' command to write to /var/log/ltm.

Answer

Capture traffic using tcpdump and save it to a file.

Question 3

Which THREE conditions must be met for a SNAT to be used by a virtual server to translate the source IP address of outbound traffic?

Accepted Answer

The Virtual Server must have a SNAT pool or 'Automap' configured.. SNAT is necessary when the server cannot route directly back to the client, or when the server needs to see a consistent source IP for policy reasons. The virtual server must be configured with a SNAT type (either Automap or a specific SNAT pool), the BIG-IP must be in the traffic path for both directions, and the packet must be traversing the BIG-IP as a full proxy. If any of these are missing, the SNAT will not engage.

Answer

The Virtual Server must be configured with a FastL4 profile.

Answer

The backend server must have the BIG-IP as its default gateway.

Question 4

An LTM administrator needs to ensure that client requests are consistently mapped to the same backend server based on the source IP address for a duration of 30 minutes. Which persistence method should the administrator configure?

Accepted Answer

Source Address Affinity. Source Address Affinity persistence, also known as sticky persistence, is the correct mechanism here. It uses the client's source IP address to map the session to a specific pool member. By setting the timeout to 1800 seconds, the BIG-IP ensures the mapping persists for exactly 30 minutes. This is critical for applications requiring session state continuity without cookie support or specific application headers.

Answer

Cookie Persistence

Answer

Universal Persistence

Answer

SSL Session ID Persistence

Question 5

Refer to the exhibit. An LTM administrator observes that 10.1.1.5 is marked as 'disabled'. How will this affect traffic flow for existing and new connections to the virtual server associated with this pool?

Accepted Answer

New connections are sent to 10.1.1.6; existing connections are maintained.. When a pool member is marked as disabled, the BIG-IP stops sending new connections to that member while allowing existing connections to complete if persistence or connection mirroring is active. This state differs from 'down' which implies a health monitor failure. Understanding these states is vital for graceful maintenance procedures without dropping active user sessions abruptly during server rotation or patching cycles.

Answer

New connections are dropped; existing connections are immediately reset.

Answer

New connections are rejected; existing connections are sent to 10.1.1.6.

Answer

The virtual server will stop responding to all traffic.

Question 6

An LTM administrator is implementing a new virtual server and needs to ensure secure traffic handling. Which TWO of the following configurations are required to terminate SSL traffic at the BIG-IP?

Accepted Answer

Assign a Client SSL profile to the virtual server.. SSL termination requires a Client SSL profile to decrypt incoming traffic and a Server SSL profile if re-encryption to the backend is required (though strictly for termination, the Client SSL profile is the core requirement). By decrypting at the BIG-IP, the device can inspect, manipulate, and load-balance traffic based on Layer 7 headers, which is essential for advanced application delivery services.

Answer

Enable SNAT automap on the virtual server.

Answer

Assign a Server SSL profile to the virtual server.

Answer

Enable iRule processing on the virtual server.

Question 7

An LTM administrator needs to block traffic from a specific range of malicious IP addresses. What is the most efficient way to achieve this at the BIG-IP level?

Accepted Answer

Use an iRule to check the client IP against a Data Group.. Using an LTM Network Firewall policy or an iRule with an IP data group is the industry standard. However, the most efficient way is a 'Network Firewall' or 'Advanced Firewall Manager' policy if licensed, or an iRule with a data group for standard LTM. These methods scale significantly better than individual firewall rules by using high-performance lookups against optimized memory structures.

Answer

Apply a packet filter to the virtual server.

Answer

Create an individual virtual server for each blocked IP.

Answer

Configure each pool member to reject the traffic.

Question 8

An administrator notices that the BIG-IP is not correctly identifying the client's IP address when connections are proxied through an upstream device. What should the administrator configure to solve this?

Accepted Answer

Enable 'X-Forwarded-For' in the HTTP profile.. When an upstream device proxies traffic, the BIG-IP's source IP appears as the upstream device's IP. To see the true client IP, the administrator must configure the BIG-IP to inspect headers, typically the 'X-Forwarded-For' header. This is done via an HTTP profile where the header insertion or parsing logic is configured to extract the original client IP from the HTTP request headers.

Answer

Configure a SNAT pool with the upstream IP address.

Answer

Change the load balancing algorithm to 'Least Connections'.

Answer

Disable the Client SSL profile on the virtual server.

Question 9

Refer to the exhibit. An administrator wants to modify this virtual server to support HTTPS. What is the minimum configuration change required?

Accepted Answer

Change port to 443 and add a Client SSL profile.. To support HTTPS, the virtual server must handle encrypted traffic. This requires changing the port to 443 (as defined by HTTPS standards) and attaching a Client SSL profile. The HTTP profile must also be kept to allow the BIG-IP to decrypt and parse the HTTP traffic after the SSL handshake is terminated by the Client SSL profile, ensuring the BIG-IP can perform application-layer operations.

Answer

Add a Server SSL profile to the virtual server.

Answer

Change the destination address to 10.0.0.1:443.

Answer

Remove the HTTP profile and add a Client SSL profile.

Question 10

An LTM administrator is troubleshooting a Virtual Server that is failing to pass traffic. The pool members are marked as UP. Which TWO of the following configurations could cause the traffic to drop at the virtual server level?

Accepted Answer

The Virtual Server has an iRule assigned that triggers a 'drop' command under specific conditions.. Virtual Server traffic flow relies on proper mapping of profiles and services. If the configuration is inconsistent, such as missing an iRule dependency or having a conflicting port/protocol mismatch, the LTM drops the connection. Identifying these misconfigurations is essential for LTM troubleshooting, as it differentiates between backend server application failures and middle-box configuration errors that block traffic before it even reaches the load-balanced pool members.

Answer

The pool members are configured with a different port than the Virtual Server destination port.

Answer

The Virtual Server is assigned a Client SSL profile while the protocol is set to UDP.

Answer

The SNAT pool is exhausted and cannot allocate source ports for the connection.

Question 11

Refer to the exhibit. An administrator notices that the pool members are marked as DOWN. The backend servers are responding to TCP SYN packets, but the application is not returning HTTP 200 OK statuses. What is the cause of this behavior?

Accepted Answer

The monitor is actually an HTTP monitor, not a TCP monitor, causing health check failures.. The pool is using the default TCP monitor, which only checks for a successful three-way handshake. Since the servers respond to SYN packets, the TCP monitor marks the members as UP. However, the user states they are DOWN. This implies the monitor is not actually a simple TCP monitor or the configuration provided is incomplete. In the context of LTM, health monitors must match application behavior to ensure accurate availability reporting.

Answer

The TCP monitor is configured to expect an HTTP 200 OK response.

Answer

The BIG-IP LTM has an internal firewall rule blocking port 80 traffic.

Answer

The pool members need a custom iRule to respond to the TCP monitor probes.

Question 12

When configuring a SNAT (Secure Network Address Translation) pool, what is the primary benefit of using a SNAT pool instead of 'Automap'?

Accepted Answer

SNAT pools provide a dedicated set of IP addresses that can be whitelisted by backend servers.. Automap uses the self-IP of the egress interface, which limits scalability and can cause port exhaustion in high-traffic environments. A SNAT pool allows for a defined range of IP addresses, distributing the connection load across multiple addresses. This approach is critical for large-scale enterprise deployments where a single IP address would be insufficient to handle the volume of concurrent connections generated by thousands of users hitting the BIG-IP.

Answer

SNAT pools allow for more efficient use of internal BIG-IP system resources.

Answer

SNAT pools are required for SSL termination and decryption to function.

Answer

SNAT pools automatically enable persistence for all connections.

Question 13

Which object in the BIG-IP LTM configuration is responsible for translating a client's destination IP address to a pool of backend servers?

Accepted Answer

Virtual Server. The Virtual Server is the front-end object that listens for client traffic. It acts as a proxy, receiving the request and then applying the load-balancing logic configured in the pool. Understanding the relationship between Virtual Servers and Pools is fundamental to LTM operations, as this mapping defines how traffic enters the network and how it is distributed among available resources to maintain high availability and performance.

Answer

Node

Answer

Profile

Answer

SNAT

Question 14

Which THREE of the following are valid load-balancing methods available in the BIG-IP LTM?

Accepted Answer

Round Robin. Load balancing methods determine how traffic is distributed among pool members. Selecting the appropriate method is critical for performance tuning. While Round Robin is the default, advanced methods like Least Connections or Observed are necessary for heterogeneous environments where servers may have varying capacities or workloads, ensuring that no single member becomes a bottleneck while others remain underutilized, thereby maximizing the efficiency of the entire server farm.

Answer

Fastest Connection

Answer

Random Weight

Question 15

Which TWO of the following are true regarding the behavior of the BIG-IP LTM when a pool member is marked 'DOWN'?

Accepted Answer

New connections are sent to the remaining 'UP' pool members.. When a pool member is marked DOWN, the BIG-IP LTM immediately stops sending new connections to that node. Understanding how the BIG-IP handles existing connections versus new ones is vital. By default, existing connections are usually preserved depending on persistence settings, but new requests are diverted to healthy members, ensuring continuous service without interrupting users already in active sessions.

Answer

The BIG-IP drops all existing connections to that pool member.

Answer

The BIG-IP automatically removes the node from the configuration.

Answer

The BIG-IP sends an ICMP unreachable message to the client.

Question 16

An LTM expert is troubleshooting a scenario where persistent traffic is failing to reach the same pool member. Which TWO factors should the expert investigate as potential causes for persistence failure?

Accepted Answer

The persistence profile timeout is set to a value shorter than the client's session duration.. Persistence ensures that a client's subsequent requests are handled by the same server. When this fails, it is often due to misconfiguration of the persistence profile or environmental factors like source NAT. Investigating the profile type and the persistence timeout is critical because mismatched configurations or premature expiration of table entries will result in the client being load balanced to a different server member unexpectedly.

Answer

The pool members are located in different data centers.

Answer

The virtual server is using the 'Round Robin' load balancing algorithm.

Answer

The VLAN associated with the pool member is disabled.

Question 17

An LTM administrator needs to configure a virtual server to handle both HTTP and HTTPS traffic using a single VIP. What is the most effective way to achieve this on a BIG-IP?

Accepted Answer

Use a single virtual server with a wildcard port configuration.. To handle both protocols on one virtual server, the administrator can utilize an iRule or a Local Traffic Policy to inspect the incoming traffic. If the traffic is plain HTTP, it can be redirected to HTTPS. By using a single VIP with a 'Performance (L4)' or standard profile, the administrator can ensure consistent security policies and simplified configuration management across the entire application delivery chain.

Answer

Create two separate virtual servers, one for port 80 and one for port 443.

Answer

Enable 'Port Translation' on the virtual server.

Answer

Configure the virtual server with 'Address Translation' disabled.

Question 18

What is the primary function of the 'Default Persistence Profile' in a virtual server configuration?

Accepted Answer

It provides a fallback mechanism for session stickiness.. The default persistence profile determines how the BIG-IP tracks client sessions if no specific persistence logic is defined or if the initial connection needs a fallback method. It ensures that, in the absence of more specific application-layer cookies or headers, the system maintains consistent server selection based on common criteria like the client's source IP, preventing disruption in services that require session continuity.

Answer

It defines the health monitor behavior for all pool members.

Answer

It dictates the load balancing algorithm for the pool.

Answer

It encrypts the communication between the BIG-IP and the server.

Question 19

An LTM administrator needs to ensure that client SSL connections are terminated at the BIG-IP, but the original client IP address must be preserved for the backend web servers. Which configuration approach should the administrator implement?

Accepted Answer

Apply an HTTP profile with 'Insert X-Forwarded-For' enabled to the virtual server.. To preserve client IP addresses while performing SSL termination, the BIG-IP must insert an X-Forwarded-For header into the HTTP request header before forwarding it to the pool member. This is achieved by attaching an HTTP profile with the 'Insert X-Forwarded-For' option enabled to the virtual server. This ensures that backend applications can identify the true source of the traffic despite the SNAT or proxy nature of the BIG-IP.

Answer

Enable Source Address Translation (SNAT) Automap on the virtual server.

Answer

Configure a FastL4 profile with the 'Loose Initiation' setting enabled.

Answer

Use a OneConnect profile to multiplex client connections to the backend.

Question 20

Refer to the exhibit. The administrator notices that the pool members are marked as 'down' despite being reachable. What is the most likely cause based on the provided configuration?

Accepted Answer

The pool monitor lacks a 'send' string specifying the Host header.. The pool is configured with a basic 'http' monitor. By default, the HTTP monitor requires a specific URI to check, and if none is provided, it defaults to GET / with no host header. If the backend web server is configured for virtual hosting, it will reject the request without a valid Host header, causing the health check to fail and marking the member as down.

Answer

The virtual server is missing a SNAT pool definition.

Answer

The TCP profile is incompatible with the pool member IP addresses.

Answer

The virtual server lacks an iRule to handle the traffic.