F5CAB3 Questions and Answers

Using “at least one” ensures each member is marked up based on its relevant service monitor.

SSH is a TCP Layer 4 protocol. Applying an HTTP profile causes BIG-IP to expect HTTP headers, breaking SSH sessions. Removing the HTTP profile allows raw TCP forwarding.

In BIG-IP systems,iRules influence traffic only when they are attached to a Virtual Server. If application traffic is being sent tonodes or pool members that are not defined in the pool, this typically indicates that an iRule is overriding the default load-balancing behavior by explicitly selecting a pool or node.

According toBIG-IP Administration: Data Plane Configurationand official F5 guidance:

iRules areassociated with Virtual Servers, not directly with pools or nodes.

To determine whether an iRule is actively affecting traffic, the administrator must inspect theVirtual Server configuration.

Explanation of the correct answers:

B. Via the GUI at the Resources tab for the virtual serverTheResourcestab in the Configuration Utility displays all traffic-handling objects applied to the Virtual Server, includingassigned iRules. This is the primary GUI location to verify whether an iRule is influencing data plane traffic.

C. Via TMSH with the list /ltm virtual <virtual_server> commandThis TMSH command displays the full Virtual Server configuration, including anyiRules listed under the rules section. It is the authoritative CLI method to confirm iRule usage.

Why the other options are incorrect:

A. Via TMSH with the list /ltm rule <irule> commandThis command only shows the contents of an iRule and does not indicate whether the iRule is attached to or used by any Virtual Server.

D. Via the GUI at the iRule tab for the virtual serverBIG-IP does not provide a dedicated “iRule” tab on Virtual Servers. iRules are viewed and managed under theResourcestab.

Correct Conclusion:

To verify whether an iRule is responsible for unexpected node selection, the BIG-IP Administrator must examine theVirtual Server configuration, either through theResources tab in the GUIor by usingTMSH to list the Virtual Server configuration.

DNS traffic is primarily transported usingUDP port 53. In the exhibit, the Virtual Server is configured with theProtocol set to TCP, which prevents standard DNS queries from being processed correctly. BIG-IP Virtual Servers must be configured with the correct Layer 4 protocol to match the application traffic they are handling.

According to theBIG-IP Administration: Data Plane Configurationdocumentation:

TheProtocolsetting on a Virtual Server defines whether traffic is processed as TCP, UDP, or another supported transport protocol.

Standard DNS queries and responses useUDP, whileTCP is only required for DNS zone transfers (AXFR)or exceptionally large responses.

When a DNS Virtual Server is incorrectly configured with TCP, UDP-based DNS queries are dropped, causing all requests to fail.

Why the other options are incorrect:

A. Protocol profile (Client) to DNS_OPTIMIZEDA DNS profile enhances DNS functionality but does not correct an incorrect transport protocol configuration.

B. Type to Performance (HTTP)Performance (HTTP) Virtual Servers are designed for HTTP traffic and are not suitable for DNS services.

C. Source Address to 192.168.10.0/24The existing source IPs already fall within the allowed range, so this setting does not address the failure.

Correct Resolution:

Changing theProtocol to UDPaligns the Virtual Server with standard DNS transport requirements, allowing DNS queries to be successfully processed and load-balanced.

APerformance (Layer 4)virtual server does not inspect or process application-layer data such as HTTP headers or cookies. Therefore, onlyLayer 4–compatible persistence methodscan be used.

According to theBIG-IP Administration: Data Plane Configurationdocumentation:

Source Address Affinity persistenceoperates at Layer 4 and uses the client IP address to maintain session persistence.

It is fully compatible with Performance (Layer 4) virtual servers.

It works regardless of encryption, making it suitable forTLS-secured applications.

Why the other options are incorrect:

B. Cookie persistenceRequires an HTTP profile and Layer 7 inspection, which is not supported on Performance virtual servers.

C. Microsoft RDP persistenceIs protocol-specific and not applicable to web-based TLS traffic.

D. Host persistenceRequires HTTP host header inspection, which is not available at Layer 4.

Correct Resolution:

Source Address Affinity persistenceis the appropriate choice for maintaining persistence on a Performance (Layer 4) virtual server handling TLS traffic.

Below isBatch 1 (Questions 1–10)extractedonlyfrom your uploaded document that aredirectly related toBIG-IP Administration: Data Plane Configurationtopics(Virtual Servers, Pools, Load Balancing, Monitors, Persistence, SNAT, Profiles).

I haveexcluded system-only, licensing, support, hardware, HA management-only, and admin UI questionsthat arenot Data Plane–focused.

Source: Your uploadedTMOS Administration v2.0document

✅BATCH 1 (10 Questions)

Connection rate limits restrict how many new connections are accepted per second, protecting application resources.

A red diamond indicates that the Virtual Server is enabled but unavailable, typically due to all pool members being down.