F5CAB3 Exam Dumps - F5-CA Questions and Answers

Fallback persistence is used when the primary persistence method fails. Source Address Affinity is a Layer 4 persistence method and is fully supported as a fallback option for most virtual server types.

SSH is a TCP Layer 4 protocol. Applying an HTTP profile causes BIG-IP to expect HTTP headers, breaking SSH sessions. Removing the HTTP profile allows raw TCP forwarding.

The pool member list in the exhibit shows servers listening on four distinct service ports: 80 (HTTP), 21 (FTP), 443 (HTTPS), and 22 (SSH). To accurately monitor a pool where members provide different services, the administrator must apply monitors that correspond to each of those specific services.

The key to this configuration is the Availability Requirement (also known as "Monitor Rule"). If the administrator sets the requirement to "All health monitors," every single monitor (HTTP, HTTPS, FTP, and SSH) must pass for a member to be marked "Up." This would cause an immediate failure: for example, a server listening only on port 80 would fail the HTTPS, FTP, and SSH checks, resulting in the member being marked "Down" even if the HTTP service is healthy.

To ensure accuracy, the administrator should apply all four relevant monitors and set the Availability Requirement to at least one monitor. With this setting, the BIG-IP marks a member as "Up" if any of the assigned monitors return a successful response. Therefore, the member at 10.200.50.210:80 will stay "Up" as long as the HTTP monitor passes, even though it fails the FTP, HTTPS, and SSH monitors. This configuration allows a single pool to contain diverse service types while ensuring that the specific port defined for each member is verified correctly. Option C is incorrect because ICMP only checks if the IP is alive, not if the specific service port is functioning.

WAN TCP profiles are optimized for high latency and packet loss typical of Internet clients, while LAN profiles are ideal for backend servers.

A red diamond indicates the Virtual Server is enabled but unavailable due to all pool members being down.

A red diamond indicates that the Virtual Server is enabled but unavailable, typically due to all pool members being down.

Application-level monitors ensure that only the affected service is marked down, not the entire node.

To provide encrypted communication between users and a virtual server, the BIG-IP system acts as a transparent SSL/TLS proxy. The administrative configuration required for this is a Client SSL profile.

When multiple hostnames (FQDNs) are associated with a single IP address, the system must determine which SSL certificate to present to the client during the initial TLS handshake. This is achieved using an extension of the TLS protocol called Server Name Indication (SNI).

The configuration logic is as follows:

Profile Type: The Client SSL profile is responsible for terminating the SSL connection from the client (the user) to the BIG-IP system.

The Setting: Within the Client SSL profile (under the "Advanced" view), there is a field specifically called Server Name. By entering the specific hostname (e.g., www.example.com) in this field, the BIG-IP system can match the hostname requested by the client in the ClientHello message to the correct profile.

Implementation: The administrator typically creates multiple Client SSL profiles—one for each hostname—and assigns them all to the same virtual server. One of these profiles must be designated as the Default SSL Profile for SNI to handle requests where the client does not provide a hostname or provides one that does not match any specific profile.

By using the Client SSL profile and the Server Name setting, the BIG-IP system ensures that each user receives the correct certificate for the specific site they are trying to reach, even though all sites share a single virtual server IP.

Source Address Affinity (Persistence) works by tracking the source IP address of incoming packets to ensure a client stays connected to the same backend server. The "netmask" setting within the persistence profile determines the "granularity" of this tracking. A netmask tells the BIG-IP how many bits of the source IP address to ignore when creating the persistence record. For example, the current setting of 255.0.0.0 (a /8 mask) means the BIG-IP only looks at the first octet of the IP; this results in all users from the same large Class A network (e.g., everyone from 10.0.0.0 to 10.255.255.255) being persisted to the exact same server, which can lead to severe load imbalance.

To ensure that each unique IP address creates its own individual persistence record, the administrator must set the netmask to 255.255.255.255 (for IPv4). This is a "host mask" or /32, which instructs the BIG-IP to evaluate all 32 bits of the client's source IP address. With this setting, 10.1.1.1 and 10.1.1.2 will be treated as distinct entities and can be load balanced to different servers, each maintaining their own "stickiness". While Option A (255.255.255.0) would group users by their local subnet, only the full 255.255.255.255 mask satisfies the requirement for true unique-IP persistence. This configuration is standard for internet-facing applications where users arrive from diverse locations and the administrator wants to maintain the most granular and balanced distribution of traffic possible.

The configuration provided utilizes Priority Group Activation in conjunction with the min_active_members setting. Priority groups allow an administrator to define primary servers and "backup" servers within the same pool. The BIG-IP prioritizes traffic based on the assigned priority number, with the highest number receiving traffic first.

In this specific configuration, the priority 3 group is the primary group. Therefore, connections are first distributed to all pool members with priority 3 as long as they are available. The system will continue to use only the priority 3 group unless the number of available members in that group falls below the min_active_members value, which is set to 2.

If the priority 3 group has fewer than two active members, the BIG-IP "activates" the next available priority group (priority 2) and distributes traffic among the remaining members of priority 3 and all members of priority 2. This cascading logic continues down the list. Consequently, if both the priority 3 group and the priority 2 group have fewer than two members available, traffic is directed to the priority 1 group. This ensures that even in a multi-server failure scenario, the system has a last-resort group of servers to handle the traffic.

Option D is incorrect because if only one member of priority 3 goes down, there are still two members active (10.12.10.8 and 10.12.10.9). Since 2 is not less than the min_active_members threshold of 2, the priority 2 group will not yet be activated. Option B is incorrect because traffic flows from high priority to low priority, not the other way around.