Free Practice Questions for F5 F5CAB2 Exam

In a BIG-IP environment, load balancing and persistence work together but serve different purposes. While a load balancing method likeLeast Connectionsattempts to distribute traffic based on current connection counts, apersistence profileoverrides this logic for returning clients.

Persistence Overrides Load Balancing:When a persistence profile (such as Source Address or Cookie persistence) is applied to a Virtual Server, the BIG-IP system tracks which client was sent to which backend member.

Sticky Sessions:If a client with a valid persistence record returns, the BIG-IP will send that client to thesame pool memberit was previously assigned to, regardless of the load balancing algorithm's current preference.

Uneven Distribution:If certain clients generate significantly more traffic or stay connected longer than others, the persistence table will "lock" those high-volume flows to specific members, resulting in an uneven distribution of connections across the pool.

Although remote authentication (LDAP, RADIUS, TACACS+) is acontrol-plane / management-planefeature, it directly affectsavailability and resiliency of administrative access, which is a critical operational HA consideration.

How BIG-IP Remote Authentication Works:

BIG-IP can authenticate administrators against:

LDAP

RADIUS

TACACS+

When remote authentication is enabled, BIG-IPby default relies on the remote serverfor user authentication

If the remote authentication server becomes unreachable, administrators may belocked outunless fallback is configured

Why “Fallback to Local” Is Required:

TheFallback to Localoption allows BIG-IP to:

Attempt authentication against theremote authentication server first

If the remote server isunreachable or unavailable, fall back to:

Local BIG-IP user accounts (admin, or other locally defined users)

This ensures:

Continuous administrative access

Safe recovery during:

Network outages

Authentication server failures

Maintenance windows

This behavior is explicitly recommended as abest practicein BIG-IP administration to avoid loss of management access.

Why the Other Options Are Incorrect:

A. Configure a second remote user directory

Provides redundancyonly if both directories are reachable

Does not help if remote authentication as a whole is unavailable

B. Configure a remote role group

Maps remote users to BIG-IP roles

Does not affect authentication availability

D. Set partition access to “All”

Controls authorization scope after login

Has no impact on authentication success

Key Availability Concept Reinforced:

To maintainadministrative access resiliency, BIG-IP administrators should always enableFallback to Localwhen using remote authentication. This prevents lockouts and ensures access even during authentication infrastructure failures.

===========

The diagram illustrates a specific TCP handshake sequence where the BIG-IP system acts as a transparent forwarder rather than a full proxy. The key indicators that identify this as aForwarding (IP) virtual serverare as follows:

Initial Packet Processing: The diagram explicitly states that the LTM evaluates the packet lookingonly at the destination IP address. This is the fundamental characteristic of a Forwarding IP virtual server, which uses the system's routing table to make forwarding decisions instead of load balancing to a pool of members.

Handshake Sequence: Unlike aStandardvirtual server, which completes the three-way handshake with the client (SYN, SYN-ACK, ACK)beforeinitiating a separate connection to the server, the Forwarding IP virtual server passes the client's originalSYNpacket directly to the destination node.

Response Timing: The BIG-IP system waits for theSYN-ACKfrom the destination node before it sends a SYN-ACK back to the client. It essentially "passes through" the handshake signals while still maintaining a state entry in the connection table to track the flow.

Packet-by-Packet Logic: While it tracks the state, it does not perform address translation (unless SNAT is specifically configured) or deep packet inspection like a full proxy would.

Why other options are incorrect:

Standard virtual server: A Standard virtual server is a "full proxy." It would finish the handshake with the client first and only then open a second, independent TCP connection to the backend server.

Stateless virtual server: A stateless virtual server does not track connections in the connection table. The diagram shows the system meticulously passing sequence numbers ($seq\_num$) and acknowledgment numbers ($ack\_num$) between the two sides, which requires stateful tracking of the TCP flow.

TheForced Offlinestate is a critical administrative tool used during maintenance to ensure a device remains in a non-functional state relative to the traffic group.

Preventing Active Status:When a device is in "Forced Offline," it is effectively disqualified from the HA election process. Even if the other peer fails, a device in Forced Offline willnotbecome active. This is vital during maintenance (like firmware upgrades or hardware replacement) to prevent an unstable or half-configured device from attempting to process traffic.

Traffic Termination:Placing a device in Forced Offline triggers the system to stop accepting new connections and, depending on the configuration, can facilitate the termination of existing connections so that the administrator can perform work without the data plane actively utilizing system resources.

Persistence Handling:Unlike the "Disabled" state, Forced Offline ignores persistence records, ensuring that no new traffic is steered to the device via session affinity.

In a BIG-IP high availability (HA) configuration,Auto-Syncis a device trust feature that automatically synchronizes configuration changesfrom the Active device to the Standby devicewithin a Sync-Failover device group.

Key principles from BIG-IP Administration Data Plane Concepts:

TheActive device is always the authoritative source of configuration

Configuration changes are intended to be madeonly on the Active device

WithAuto-Sync enabled, any time the Active device configuration changes, the system automatically pushes the configuration to all Standby members of the device group

Configuration changes made directly on aStandby device are not preserved

In this scenario:

The administrator modifies a Virtual Server on theStandbydevice

That change islocal onlyand does not alter the device group’s synchronized configuration

When Auto-Sync next runs (triggered by a change on the Active device or an internal sync event), theActive device configuration overwrites the Standby configuration

As a result, the configuration change made on the Standby device isundone.

Why the Other Options Are Incorrect:

A– The change is not undone only when another change is made; it is undone during the next Auto-Sync operation

B– Changes made on the Standby device are never propagated to the Active device

D– Auto-Sync does not merge or promote Standby changes into the HA pair configuration

Best Practice Reinforced:

Always perform configuration changes on theActive BIG-IP devicewhen Auto-Sync is enabled to ensure consistent and predictable HA behavior.

===========

The primary distinction between Activ41e and Standby units revolves around which unit is currently processing traffic.

Traffic Objects (C & E):The unit in the43Activestate is the only one that answers ARP requests forVirtual Server addressesandFloating Self-IPs. The Standby unit remains "quiet" for these addresses to avoid IP conflicts on the network.

Monitors (A - False):Boththe Active and Standby units perform health monitors on pool members by default. This ensures that the Standby unit is ready to take over with an up-to-date view of the pool's health.

Failover (B - False):A failover trigger (like a VLAN fail-safe) causes the Active unit to go Standby and the Standby unit to go Active; it affects both.

Management (D - False):Configuration changes can technically be made on either unit (though it is best practice to make them on the Active unit) and then synchronized to the peer.

Understanding the default behavior of aStandard Virtual Serverregarding address and port translation is fundamental to BIG-IP administration.

Source Address Translation (SNAT):By default, the BIG-IP system doesnotperform Source Address Translation (SNAT). This means that the packet's source IP address (theClient IP) remains preserved as it passes through the BIG-IP to the pool member. This is critical for backend servers to identify the original client for logging and security purposes. Therefore, the client IP address is unchanged between the client-side and server-side connections.

Destination Address Translation (DAT):By default, a Standard Virtual Serveralwaysperforms Destination Address Translation. The BIG-IP system changes the destination IP from the Virtual Server's IP address to the IP address of the specificPool Memberselected by the load balancing algorithm. Consequently, the server-side destination IP is different from the client-side destination IP.

Port Translation:By default,Port Translationis enabled. If a Virtual Server is listening on port 80 and the selected pool member is configured for port 8080, the BIG-IP will translate the destination port. Even if the ports happen to be the same, thesettingallows for change, whereas the default SNAT setting (None) ensures the client IP remains static.

In the BIG-IP object hierarchy, the destination port for backend traffic is defined at thePool Memberlevel. While a Virtual Server listens on a specific port, the Pool determines where that traffic is directed after the load balancing decision is made.

Pools and Pool Members: A pool is a collection of devices, often called pool members, to which the BIG-IP system passes traffic. Each pool member is defined by an IP address and a service port.

Port Translation: When an administrator needs to change the port the BIG-IP uses to communicate with backend servers, they must navigate to the specific Pool and modify the service port for each member within that pool.

Logical Separation:

Virtual Serversdefine the "front-end" port where clients connect.

Poolsdefine the "back-end" port where the application resides.

Nodesrepresent the physical server's IP address and do not contain port-specific configuration.

In the Traffic Management Shell (TMSH), there is a distinct difference between list and show commands.

List Command: Used to view theconfigurationof an object (what is stored in the config file). list net route would show you the static routes you have manually configured.

Show Command: Used to view thestatus, statistics, and real-time stateof an object.

TMM Routes: Because the routing table (RIB/FIB) is a dynamic entity that includes both static routes and learned routes (such as those from a routing protocol or connected subnets), the show net route command is required to see the active routing table as it exists in the Traffic Management Microkernel (TMM).

Key Command Breakdown:

show net route: Displays the active TMM routing table, including destination, gateway, and the status of the route.