A Fully Updated 2026 F5CAB3 Exam Dumps - PDF Questions and Testing Engine
Easy Success F5 F5CAB3 Exam in First Try
NEW QUESTION # 12
Users are unable to reach an application. The Virtual Server shows a red diamond status in the Configuration Utility.
What is the cause?
- A. HTTPS traffic sent to HTTP Virtual Server
- B. Virtual Server is disabled
- C. All pool members are down
- D. All pool members are disabled
Answer: C
Explanation:
A red diamond indicates the Virtual Server is enabled but unavailable due to all pool members being down.
NEW QUESTION # 13
A BIG-IP Administrator finds the following log entry after a report of user issues connecting to a virtual server:
01010201: Intercept exhaustion on 10.70.110.112 to 192.28.123.250:80 (proto 6) How should the BIG-IP Administrator modify the SNAT pool that is associated with the virtual server?
(Choose one answer)
- A. Increase the timeout of the SNAT addresses
- B. Remove the SNAT pool and apply SNAT Automap
- C. Add an IP address to the SNAT pool
- D. Remove an IP address from the SNAT pool
Answer: C
Explanation:
The log message "Intercept exhaustion" indicates that the BIG-IP system has exhausted the available source port translations for one or more SNAT addresses. This occurs when too many concurrent client connections are being translated through a limited number of SNAT IP addresses, and all ephemeral source ports (typically ~64,000 per SNAT IP) are in use.
According to the BIG-IP Administration: Data Plane Configuration documentation:
Each SNAT IP address provides a finite number of available source ports.
When the number of concurrent connections exceeds the available port space, the BIG-IP logs an Intercept exhaustion error and new connections fail.
The recommended resolution is to increase the available SNAT resources by adding additional IP addresses to the SNAT pool.
Why the other options are incorrect:
A). Increase the timeout of the SNAT addressesIncreasing timeouts may actually worsen the problem by keeping ports allocated longer, accelerating port exhaustion.
B). Remove the SNAT pool and apply SNAT AutomapSNAT Automap uses the Self IP addresses on the egress VLAN, which may not provide additional capacity and can introduce routing or design issues. This is not a direct or recommended fix for SNAT exhaustion.
C). Remove an IP address from the SNAT poolThis would reduce the number of available source ports and further exacerbate the intercept exhaustion condition.
Correct Resolution:
By adding an IP address to the SNAT pool, the BIG-IP increases the total number of available source ports, alleviating intercept exhaustion and restoring successful client connections.
NEW QUESTION # 14
What is the status of a pool member when manual resume is enabled and a health check first fails and then passes?
- A. Available (Disabled)
- B. Offline (Enabled)
- C. Offline (Disabled)
- D. Available (Enabled)
Answer: C
Explanation:
With manual resume enabled, BIG-IP does not automatically return a pool member to service after recovery. The member remains offline until manually re-enabled.
NEW QUESTION # 15
Which type of Virtual Server requires the use of a FastL4 profile?
- A. Performance (Layer 4)
- B. Stateless
- C. Performance (HTTP)
- D. Standard
Answer: A
Explanation:
Performance (Layer 4) virtual servers rely on FastL4 profiles to provide high-speed L4 processing without full proxy overhead.
Below is BATCH 2 (next 10 questions) extracted only from your uploaded document that are clearly related to BIG-IP Administration: Data Plane Configuration topics.
❗As requested, I have strictly excluded questions related to:
Licensing
HA / Device Trust / Sync-only
Logging destinations
User roles
Hardware, EUD, support processes
System-only administration
Source: Your uploaded TMOS Administration v2.0 document
NEW QUESTION # 16
A Standard Virtual Server for a web application is configured with Automap for the Source Address Translation option. The original source address of the client must be known by the backend servers. What should the BIG-IP Administrator configure to meet this requirement?
- A. An HTTP Transparent profile
- B. An HTTP profile to insert the X-Forward-For header
- C. A SNAT Pool with the client IP
- D. The Virtual Server type as Performance (HTTP)
Answer: B
Explanation:
SNAT Automap is a common configuration that replaces the client ' s original source IP address with one of the BIG-IP ' s self IP addresses. This ensures that the backend servers send return traffic back through the BIG-IP, which is necessary for the ADC to process the traffic correctly. However, a side effect of SNAT is that the backend servers only see the BIG-IP ' s IP in their logs, losing visibility into the true identity of the client.
To resolve this while still using SNAT for routing purposes, the administrator must configure the BIG-IP to " pass " the client ' s IP address at the application layer. This is achieved by using an HTTP Profile with the Insert X-Forwarded-For setting enabled. When this profile is applied to the Virtual Server, the BIG-IP intercepts the HTTP request, adds a header (X-Forwarded-For) containing the client ' s original IP, and then forwards the modified request to the server. The backend web server can then be configured to read this header and log the original client IP instead of the BIG-IP ' s SNAT address.
Other options are incorrect for this requirement. Performance (HTTP) (Option A) is a virtual server type optimized for speed but often lacks the full Layer 7 header manipulation capabilities of a Standard Virtual Server. SNAT Pool with the client IP (Option C) is technically impossible as SNAT pools use static, pre- defined IPs. There is no such thing as an HTTP Transparent profile (Option D) in standard BIG-IP administration for this purpose. The X-Forwarded-For header insertion within the HTTP profile is the standard procedural method for maintaining client visibility in SNAT-enabled environments.
NEW QUESTION # 17
A BIG-IP Administrator adds new pool members to a highly utilized pool. The application begins failing.
What pool-level setting should be checked?
- A. Slow Ramp Time
- B. Action On Service Down
- C. Allow SNAT
- D. Availability Requirement
Answer: A
Explanation:
Slow Ramp Time prevents new members from being overwhelmed immediately after activation.
NEW QUESTION # 18
In the BIG-IP Configuration Utility, a user requests a single screen view to determine the status of all Virtual Servers and associated pool members, as well as any iRules in use. Where should the BIG-IP Administrator instruct the user to find this view?
- A. Local Traffic > Virtual Servers
- B. Local Traffic > Network Map
- C. Local Traffic > Monitors
- D. Statistics
Answer: B
Explanation:
The Local Traffic > Network Map provides a single consolidated view within the BIG-IP Configuration Utility that displays the full relationship hierarchy of all application delivery objects simultaneously. This includes Virtual Servers, their associated Pools, individual Pool Members, applied iRules, profiles, and the health status of each object - all rendered in a single topological screen.
This view is specifically designed for administrators and users who need rapid situational awareness across the data plane without navigating multiple menu screens. Each object is colour-coded to reflect its current availability state (green = available, red = unavailable, yellow = degraded).
The alternative options do not satisfy all requirements:
* Local Traffic > Monitors only displays health monitor configurations, not virtual server or pool member relationships.
* Statistics provides performance counters and throughput data, not object relationship mapping.
* Local Traffic > Virtual Servers lists virtual server configurations individually but does not provide a unified topology view inclusive of pool members and iRules in a single screen.
The Network Map is the authoritative single-pane-of-glass tool for application object visibility on BIG-IP.
Reference: BIG-IP Administration - Data Plane Configuration, Module: Monitoring and Managing Application Traffic - Network Map.
NEW QUESTION # 19
Users report that traffic is negatively affected every time a BIG-IP device fails over. The traffic becomes stabilized after a few minutes. What should the BIG-IP Administrator do to reduce the impact of future failovers?
- A. Configure MAC Masquerade
- B. Enable Failover Multicast Configuration
- C. Set up Failover Method to HA Order
- D. Configure a global SNAT Listener
Answer: A
Explanation:
When a failover occurs in a standard BIG-IP High Availability (HA) pair, the newly active device takes over the floating IP addresses (Virtual Servers, Self IPs). By default, the new active device sends Gratuitous ARP (GARP) messages to the local network switch to inform it that these IP addresses are now associated with its own physical MAC addresses. However, network switches and intermediate routers often have ARP aging timers or security features that may delay the updating of their ARP tables, leading to "black-holed" traffic or dropped packets for several seconds or minutes until the network infrastructure correctly relearns the new path.
To eliminate this delay and ensure a seamless transition, a BIG-IP Administrator should Configure MAC Masquerade. MAC Masquerade allows the administrator to assign a unique, "virtual" MAC address to a specific traffic group. Instead of using the hardware-burned MAC address of the individual appliance, the active device uses this shared virtual MAC address for all communication involving floating IPs. When a failover occurs, the standby device assumes control of the traffic group and begins using the exact same virtual MAC address. Because the MAC address associated with the VIPs never changes from the switch's perspective, there is no need for the switch to update its MAC address table or for the surrounding infrastructure to update its ARP caches. This effectively eliminates the "stabilization period" reported by users, as the data plane transition happens almost instantaneously at Layer 2, maintaining continuous traffic flow without being hindered by external network re-convergence times.
NEW QUESTION # 20
An LTM device has a virtual server mapped to www.f5.com with a pool assigned. The objects are defined as follows: Virtual server: Destination 192.168.245.100:443 netmask 255.255.255.0. Persistence: Source address persistence netmask 255.0.0.0. SNAT: Automap. Profiles: HTTP/TCP. How should the BIG-IP Administrator modify the persistence profile so that each unique IP address creates a persistence record?
- A. netmask 0.0.0.0
- B. netmask 255.255.255.0
- C. netmask 255.255.0.0
- D. netmask 255.255.255.255
Answer: D
Explanation:
Source Address Affinity (Persistence) works by tracking the source IP address of incoming packets to ensure a client stays connected to the same backend server. The "netmask" setting within the persistence profile determines the "granularity" of this tracking. A netmask tells the BIG-IP how many bits of the source IP address to ignore when creating the persistence record. For example, the current setting of 255.0.0.0 (a /8 mask) means the BIG-IP only looks at the first octet of the IP; this results in all users from the same large Class A network (e.g., everyone from 10.0.0.0 to 10.255.255.255) being persisted to the exact same server, which can lead to severe load imbalance.
To ensure that each unique IP address creates its own individual persistence record, the administrator must set the netmask to 255.255.255.255 (for IPv4). This is a "host mask" or /32, which instructs the BIG-IP to evaluate all 32 bits of the client's source IP address. With this setting, 10.1.1.1 and 10.1.1.2 will be treated as distinct entities and can be load balanced to different servers, each maintaining their own "stickiness". While Option A (255.255.255.0) would group users by their local subnet, only the full 255.255.255.255 mask satisfies the requirement for true unique-IP persistence. This configuration is standard for internet-facing applications where users arrive from diverse locations and the administrator wants to maintain the most granular and balanced distribution of traffic possible.
NEW QUESTION # 21
A BIG-IP Administrator creates a new Virtual Server. The end user is unable to access the page. During troubleshooting, the administrator learns that the connection between the BIG-IP system and server is NOT set up correctly. What should the administrator do to solve this issue? (Choose one answer)
- A. Disable Address Translation
- B. Set Address Translation to Auto Map, configure a SNAT pool, and have pool members in the same subnet as the servers
- C. Set Address Translation to SNAT and configure a specific translation address
- D. Set Address Translation to SNAT and have a self-IP configured in the same subnet as the servers
Answer: D
Explanation:
The issue described is a classic symptom of asymmetric routing, which frequently occurs when the BIG-IP system and the back-end servers reside on the same subnet (often referred to as a "one-arm" deployment).
The Routing Problem: By default, the BIG-IP system preserves the original client source IP address when forwarding traffic to a pool member. If the server is in the same subnet as the client or if the server's default gateway is not the BIG-IP, the server will attempt to send its response directly back to the client's IP address, bypassing the BIG-IP.
Stateful Failure: Since the BIG-IP is a Full Proxy, it maintains a state table. Because the response packet never returns through the BIG-IP, the system cannot complete the three-way handshake or manage the application session, resulting in a connection failure for the user.
The Solution (SNAT): Enabling Source Network Address Translation (SNAT) solves this by changing the source IP address of the request to an IP address owned by the BIG-IP (typically a self-IP).
Requirement for Subnet Alignment: To ensure the server sends the response back to the BIG-IP, the translation address must be reachable. By using a self-IP configured in the same subnet as the servers, the BIG-IP ensures that the server sees the request coming from a local "neighbor." The server will then naturally send the response back to that self-IP, allowing the BIG-IP to translate the packet back and forward it to the client.
Why other options are incorrect:
A: Disabling address translation would ensure the server-side traffic uses the client IP, making asymmetric routing inevitable in this scenario.
B: This is technically contradictory; "Auto Map" specifically uses existing self-IPs and does not require or use a "SNAT pool" configuration.
C: While using a specific translation address can work, it does not inherently guarantee the Layer 2/Layer 3 reachability mentioned in the scenario as effectively as ensuring the self-IP is correctly placed in the server's subnet.
NEW QUESTION # 22
Application administrators are reporting that nodes different from those configured in the pool are selected.
The use of an iRule is suspected. How can the BIG-IP Administrator check if an iRule is used for this traffic?
(Pick the 2 correct responses below)
- A. Via the GUI at the Resources tab for the virtual server.
- B. Via the GUI at the iRule tab for the virtual server.
- C. Via TMSH with the list /ltm rule < irule > command.
- D. Via TMSH with the list /ltm virtual < virtual_server > command.
Answer: A,D
Explanation:
To determine if an iRule is influencing traffic for a specific Virtual Server, the administrator must verify the association between the Virtual Server object and any applied scripts. In the BIG-IP Configuration Utility (GUI), this association is found under the Resources tab of the specific Virtual Server. While there is an " iRules " sub-menu under Local Traffic, checking the Virtual Server ' s Resources tab is the definitive way to see which specific rules are currently active and in what order they are being processed for that particular traffic flow.
From the Command Line Interface (CLI), the tmsh list /ltm virtual < virtual_server > command provides a full text-based output of the virtual server ' s configuration. If iRules are applied, they will appear within a " rules { ... } " block in the command output. This is more effective than Option A, which only lists the contents of the iRule itself but does not show if or where it is applied. Option C is a common misconception; while some versions of the GUI have reorganized menus, the standard location for managing the association of profiles, policies, and iRules to a Virtual Server remains the " Resources " section. By identifying the applied iRule, an administrator can then review the script logic-often containing commands like pool or node-to see if it is overriding the default pool selection based on specific HTTP headers, URI paths, or client IP addresses.
NEW QUESTION # 23
The BIG-IP Administrator is investigating whether better TCP performance is possible for a virtual server.
Which built-in profile should be tried first? (Choose one answer)
- A. f5-tcp-progressive
- B. No option
- C. f5-tcp-legacy
- D. f5-tcp-mobile
Answer: A
Explanation:
BIG-IP provides several built-in TCP profiles optimized for different traffic patterns and network conditions.
When attempting to improve general TCP performance, the recommended starting point is f5-tcp-progressive.
According to the BIG-IP Administration: Data Plane Configuration documentation:
* f5-tcp-progressive is designed as a balanced, general-purpose TCP optimization profile.
* It dynamically adjusts TCP behavior to improve throughput and latency for most enterprise applications.
* It is the recommended first-choice profile when tuning TCP performance before moving to more specialized profiles.
Why the other options are incorrect:
* A. f5-tcp-legacyThis profile exists for backward compatibility and does not include modern TCP optimizations.
* C. f5-tcp-mobileThis profile is optimized specifically for high-latency, lossy mobile networks and is not suitable for general-purpose environments.
* D. No optionBIG-IP explicitly provides built-in TCP profiles for performance tuning; using none would forgo optimization opportunities.
Correct Resolution:
The administrator should first apply f5-tcp-progressive to evaluate potential TCP performance improvements before considering more specialized profiles.
NEW QUESTION # 24
The BIG-IP Administrator is investigating if better TCP performance is possible for a virtual server. Which built-in profile should be tried first?
- A. f5-tcp-wan
- B. f5-tcp-progressive
- C. f5-tcp-legacy
- D. f5-tcp-mobile
Answer: B
Explanation:
F5 provides several pre-configured (built-in) TCP profiles designed to optimize traffic for different network conditions. When an administrator is looking to improve general performance but does not have a specific, narrow use case (like strictly mobile or strictly long-haul WAN), the f5-tcp-progressive profile is the recommended starting point.
The f5-tcp-progressive profile is designed as a modern, high-performance replacement for the older default TCP settings. It incorporates several advanced congestion control algorithms and buffer management techniques that allow it to adapt dynamically to varying network latencies and packet loss scenarios. Unlike f5-tcp-legacy (Option A), which uses older, less efficient stacks, the progressive profile leverages modern TMM (Traffic Management Microkernel) optimizations.
While f5-tcp-mobile (Option B) is highly effective for high-loss cellular networks and f5-tcp-wan (Option D) is optimized for high-latency long-distance links, they can sometimes be too aggressive or poorly suited for standard campus or data center environments. The f5-tcp-progressive profile acts as a "best-of-all-worlds" template that typically provides an immediate performance boost for most web applications by improving window scaling and fast-retransmit behavior. Therefore, it is the procedural "first step" in TCP performance tuning before moving to more specialized, niche profiles.
NEW QUESTION # 25
How can a BIG-IP Administrator identify a configuration object that has been configured within an iApp?
- A. In both the GUI and the CLI the path will repeat the name of the object with .app appended to it, and the object type will be appended to the name. Example: ltm virtual /Common/testhttp.app/testhttp_vs
- B. In both the GUI and the CLI the path will repeat the name of the object with .app appended to it and then name of the object. Example: ltm virtual /Common/testhttp.app/testhttp
- C. Using the CLI run the appropriate tmsh command to view the path and see the .app in it and the object type will be appended to the name. Example: ltm virtual /Common/testhttp.app/testhttp.vs
Answer: B
Explanation:
In F5 BIG-IP systems, an iApp is a template-driven framework used to deploy and manage application- specific configurations. When an iApp is deployed, the system creates a specialized folder or "Application Service" container to hold all the resulting Local Traffic Manager (LTM) objects, such as virtual servers, pools, and profiles. This container is visually and programmatically identified by the .app extension in its path name.
The naming convention for these objects follows a specific hierarchical structure: /<partition>/<iapp_name>.
app/<object_name>. For example, if an administrator creates an iApp named "testhttp" in the "/Common" partition, the virtual server created by that iApp would be identified in the configuration (TMSH) and the GUI as /Common/testhttp.app/testhttp. This structure allows the BIG-IP system to distinguish between manually created objects and those managed by the iApp's automation logic.
This identification is crucial because iApp-managed objects typically have Strict Updates enabled, which prevents administrators from making direct manual changes to the object settings outside of the iApp's reconfigure interface. Attempting to modify such an object directly will result in an error message stating that the application service must be updated using an application management interface. By recognizing the .app path and the repeated name within the structure, an administrator can immediately identify that the object belongs to an iApp and should be managed through the iApp's specific management screen rather than standard LTM configuration menus.
NEW QUESTION # 26
A BIG-IP Administrator is creating a new Trunk on the BIG-IP device. What objects should be added to the new Trunk being created?
- A. Interfaces
- B. VLANs
- C. Network routes
- D. IP addresses
Answer: A
Explanation:
In F5 BIG-IP architecture, a Trunk is a logical aggregation of physical interfaces designed to increase bandwidth and provide link redundancy through 802.3ad Link Aggregation Control Protocol (LACP).
When creating a Trunk object within the BIG-IP configuration, the administrator must assign physical Interfaces to it - these are the underlying hardware ports (e.g., 1.1, 1.2, 1.3) that will be bundled together to form the aggregated logical link.
It is critical to understand the layered object hierarchy on the BIG-IP platform:
* Interfaces # assigned to Trunks
* Trunks (or individual Interfaces) # assigned to VLANs (as tagged or untagged members)
* VLANs # assigned Self IP addresses
* Self IPs / Routes # configured at the network layer above
VLANs are not added to a Trunk; rather, a Trunk is added as a member of a VLAN. IP addresses and network routes are configured independently at a higher abstraction layer and have no direct association with Trunk creation.
This layered design ensures proper separation of concerns across the data plane. Misunderstanding this hierarchy is a common configuration error that can result in traffic forwarding failures.
Reference: BIG-IP Administration - Data Plane Configuration, Module: Network Objects - Interfaces, Trunks, and VLANs.
NEW QUESTION # 27
A web server administrator informs the BIG-IP Administrator that web servers currently load-balanced require encrypted traffic. Starting next month, the web server administrator will offload SSL. Starting next month, the BIG-IP device will terminate SSL to reduce web server load. The BIG-IP device is already using Client SSL, Client port, and iRules on HTTP traffic. What actions should the BIG-IP Administrator take to achieve the desired configuration? (Choose one answer)
- A. Remove the server SSL profile and configure the pool members to use HTTP
- B. Remove the client SSL profile and change the Virtual Server to accept HTTP traffic
- C. Remove the server SSL profile and change the Virtual Server to accept HTTP traffic
- D. Remove the client SSL profile and configure the pool members to use HTTP
Answer: A
Explanation:
To solve this requirement, we must distinguish between the two "legs" of an SSL connection in a BIG-IP environment: Client-side and Server-side.
Current State (SSL Bridging): The administrator states the servers currently require encrypted traffic. This means the BIG-IP is likely performing "SSL Bridging." In this setup, a Client SSL profile terminates encryption from the user, and a Server SSL profile re-encrypts the traffic before sending it to the back-end servers.
Target State (SSL Offloading): The requirement is to "offload SSL" to reduce web server load. This means the BIG-IP will continue to handle the encryption for the users (keeping the Client SSL profile) but will communicate with the back-end servers using unencrypted HTTP.
Why Option A is correct:
Remove the Server SSL profile: By removing this profile, the BIG-IP stops attempting to initiate an SSL/TLS handshake with the pool members.
Configure Pool Members to use HTTP: The service port for the pool members must be changed (typically from port 443 to port 80) so that the BIG-IP sends standard HTTP traffic to the servers.
Why other options are incorrect:
B & D: These suggest removing the Client SSL profile. If you remove this, the users can no longer connect via HTTPS, which violates the requirement for encrypted communication between the users and the BIG-IP.
C: Changing the Virtual Server to accept HTTP traffic would mean the user-to-BIG-IP connection is no longer encrypted, which is the opposite of SSL termination/offloading.
NEW QUESTION # 28
Refer to the exhibit.
A BIG-IP Administrator needs to configure health monitors for a newly configured server pool named Pool_B. Which health monitor settings will ensure that all pool members will be accurately marked as available or unavailable?
- A. HTTPS and HTTP with the Availability Requirement of at least one health monitor
- B. HTTPS, HTTP, FTP, and SSH with the Availability Requirement of all health monitors
- C. HTTPS, HTTP, FTP, and SSH, with the Availability Requirement of at least one monitor
- D. HTTPS, HTTP, FTP, and ICMP, with the Availability Requirement of all health monitors
Answer: C
Explanation:
The pool member list in the exhibit shows servers listening on four distinct service ports: 80 (HTTP), 21 (FTP), 443 (HTTPS), and 22 (SSH). To accurately monitor a pool where members provide different services, the administrator must apply monitors that correspond to each of those specific services.
The key to this configuration is the Availability Requirement (also known as "Monitor Rule"). If the administrator sets the requirement to "All health monitors," every single monitor (HTTP, HTTPS, FTP, and SSH) must pass for a member to be marked "Up." This would cause an immediate failure: for example, a server listening only on port 80 would fail the HTTPS, FTP, and SSH checks, resulting in the member being marked "Down" even if the HTTP service is healthy.
To ensure accuracy, the administrator should apply all four relevant monitors and set the Availability Requirement to at least one monitor. With this setting, the BIG-IP marks a member as "Up" if any of the assigned monitors return a successful response. Therefore, the member at 10.200.50.210:80 will stay "Up" as long as the HTTP monitor passes, even though it fails the FTP, HTTPS, and SSH monitors. This configuration allows a single pool to contain diverse service types while ensuring that the specific port defined for each member is verified correctly. Option C is incorrect because ICMP only checks if the IP is alive, not if the specific service port is functioning.
NEW QUESTION # 29
To increase available bandwidth of an existing Trunk, the BIG-IP Administrator is adding additional interfaces. Which command should the BIG-IP Administrator run from within the bash shell?
- A. tmsh create /net trunk trunk_A interfaces add {1.3 1.4}
- B. tmsh modify /sys trunk trunk_A interfaces add {1.3 1.4}
- C. tmsh create /sys trunk trunk_A interfaces add {1.3 1.4}
- D. tmsh modify /net trunk trunk_A interfaces add {1.3 1.4}
Answer: D
Explanation:
This question tests precise knowledge of both TMSH command syntax and BIG-IP object namespace hierarchy . Two critical distinctions must be correctly identified:
1. create vs. modify: Since the Trunk already exists and the administrator is adding interfaces to it, the correct verb is modify - not create . Using create on an existing object would either throw an error or attempt to overwrite the object entirely, neither of which is the desired outcome.
2. /sys vs. /net namespace: Trunk objects in BIG-IP reside within the /net namespace, which encompasses network-layer constructs including Trunks, VLANs, Self IPs, and Routes. The /sys namespace is reserved for system-level objects such as management settings, software, and licensing - it does not contain Trunk objects.
Therefore, the only syntactically and functionally correct command is:
tmsh modify /net trunk trunk_A interfaces add {1.3 1.4}
This command appends interfaces 1.3 and 1.4 to the existing trunk_A object without disrupting currently assigned interfaces, increasing aggregated bandwidth accordingly.
Options A and C use the incorrect /sys namespace, and options A and B incorrectly use the create verb for an existing object.
Reference: BIG-IP Administration - Data Plane Configuration, Module: TMSH Command Syntax - Network Object Management.
NEW QUESTION # 30
Refer to the exhibit.
DNS queries from two internal DNS servers are being load-balanced to external DNS servers via a virtual server on a BIG-IP device. The DNS queries originate from:
192.168.10.100
192.168.10.200
and target:
192.168.2.150
All DNS queries destined for the external DNS servers fail.
Which property change should the BIG-IP Administrator make in the Virtual Server to resolve this issue? (Choose one answer)
- A. Source Address to 192.168.10.0/24
- B. Type to Performance (HTTP)
- C. Protocol to UDP
- D. Protocol profile (Client) to DNS_OPTIMIZED
Answer: C
Explanation:
DNS traffic is primarily transported using UDP port 53. In the exhibit, the Virtual Server is configured with the Protocol set to TCP, which prevents standard DNS queries from being processed correctly. BIG-IP Virtual Servers must be configured with the correct Layer 4 protocol to match the application traffic they are handling.
According to the BIG-IP Administration: Data Plane Configuration documentation:
The Protocol setting on a Virtual Server defines whether traffic is processed as TCP, UDP, or another supported transport protocol.
Standard DNS queries and responses use UDP, while TCP is only required for DNS zone transfers (AXFR) or exceptionally large responses.
When a DNS Virtual Server is incorrectly configured with TCP, UDP-based DNS queries are dropped, causing all requests to fail.
Why the other options are incorrect:
A . Protocol profile (Client) to DNS_OPTIMIZED
A DNS profile enhances DNS functionality but does not correct an incorrect transport protocol configuration.
B . Type to Performance (HTTP)
Performance (HTTP) Virtual Servers are designed for HTTP traffic and are not suitable for DNS services.
C . Source Address to 192.168.10.0/24
The existing source IPs already fall within the allowed range, so this setting does not address the failure.
Correct Resolution:
Changing the Protocol to UDP aligns the Virtual Server with standard DNS transport requirements, allowing DNS queries to be successfully processed and load-balanced.
NEW QUESTION # 31
During a high-demand event, the BIG-IP Administrator needs to limit the number of new connections per second to a Virtual Server.
What should be applied?
- A. OneConnect profile
- B. Connection Rate Limit
- C. Connection Limit
- D. HTTP Compression profile
Answer: B
Explanation:
Connection rate limits restrict how many new connections are accepted per second, protecting application resources.
NEW QUESTION # 32
A BIG-IP Administrator uses backend servers to host multiple services per server. There are multiple virtual servers and pools defined, referencing the same backend servers. Which load balancing algorithm is most appropriate to have an equal number of connections on each backend server?
- A. Least Connections (member)
- B. Predictive (node)
- C. Predictive (member)
- D. Least Connections (node)
Answer: D
Explanation:
This question addresses the critical architectural distinction between "member-based" and "node-based" load balancing in environments where servers are multi-homed or host multiple virtualized services. On a BIG-IP, a node represents the underlying IP address of a physical or virtual server, while a pool member represents a specific combination of that IP and a service port (e.g., 10.1.1.10:80).
When multiple pools reference the same IP address across different ports or Virtual Servers, using Least Connections (member) (Option D) only balances connections relative to that specific pool. For example, if Pool_A and Pool_B both use Server_X, and Pool_A has 100 connections while Pool_B has only 5, a member- based algorithm for Pool_B only sees the 5 connections and may continue to send traffic there even if Server_X is CPU-saturated by Pool_A.
The Least Connections (node) algorithm (Option B) solves this by tracking the aggregate total of all active connections directed to that specific node (IP address) across every pool on the system. By selecting the node with the absolute lowest total connection count, the BIG-IP ensures a more equitable distribution of work at the hardware resource level. Predictive methods (Options A and C) use a ranking system based on the trend of connection counts over time, but for the specific requirement of maintaining an equal number of current connections on multi-service servers, the direct Least Connections (node) calculation is the standard and most effective procedural choice.
NEW QUESTION # 33
......
F5CAB3 Study Material, Preparation Guide and PDF Download: https://examcollection.dumpsactual.com/F5CAB3-actualtests-dumps.html
