F5-CTS-LTM BIG-IP Local Traffic Manager Practice Question
Exhibit
ltm profile client-ssl /Common/example_ssl {
defaults-from /Common/clientssl
cert /Common/example.crt
key /Common/example.key
ciphers DEFAULT:!SSLv3:!TLSv1
}
ltm virtual /Common/vs_https {
destination 10.0.0.1:443
profiles { /Common/example_ssl { context clientside } }
}Refer to the exhibit. Clients are reporting 'SSL Handshake Failure' errors. What is the most likely cause?
⚠ Common exam trap
Candidates assume the cipher string is just about security strength, missing that '!TLSv1' explicitly disables compatibility for older clients, which is the most common cause of handshake failures in legacy environments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The cipher string excludes TLS 1.0, which some clients require.
The cipher string 'DEFAULT:!SSLv3:!TLSv1' explicitly disables TLS 1.0. Many legacy clients still require TLS 1.0 to establish a handshake. By excluding it, the BIG-IP is rejecting any connection attempt from clients that do not support TLS 1.1 or higher. This is a common configuration error when trying to harden security without auditing the client base's compatibility first.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The certificate has expired.
Why it's wrong here
An expired certificate will trigger an 'Untrusted Certificate' or 'Expired' warning in the browser, but it will not prevent the SSL handshake from completing. The handshake failure indicates a mismatch in protocol version or cipher suite negotiation, not a certificate validation issue.
- ✓
The cipher string excludes TLS 1.0, which some clients require.
Why this is correct
The exclusion '!TLSv1' removes support for TLS 1.0. If the connecting client only supports TLS 1.0, the handshake will fail immediately because there is no common protocol version that both the BIG-IP and the client can agree upon for the encrypted session.
- ✗
The virtual server is missing an HTTP profile.
Why it's wrong here
The absence of an HTTP profile would prevent the BIG-IP from processing HTTP requests, but it would not cause an SSL handshake failure. SSL handshake occurs at the layer 4/5 boundary, before the HTTP profile is ever invoked to parse the application-layer headers.
- ✗
The key and certificate do not match.
Why it's wrong here
If the key and certificate did not match, the BIG-IP would typically fail to load the SSL profile during configuration or startup. If it managed to load, it would prevent the handshake, but it would show as a server-side config error rather than a protocol negotiation failure.
About these practice questions
Courseiva writes every F5-CTS-LTM question from scratch — 119 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official F5 exam blueprint
This F5-CTS-LTM practice question is part of Courseiva's free F5 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the F5-CTS-LTM exam.