F5CAB2 F5 BIG-IP Administration Data Plane Concepts (F5CAB2) exam Free Practice Exam Questions (2026 Updated)

Configuring networking objects in BIG-IP requires using the correct TMSH module path and verb .

Module Path: Trunks are networking objects, so they reside under the /net module, not /sys.

Verb: Since the trunk already exists, the modify verb must be used to update its properties rather than create.

Syntax: The correct syntax to append physical interfaces to an existing trunk is tmsh modify /net trunk [name] interfaces add { [port list] }.

Data Plane Impact: Adding interfaces to a trunk (Link Aggregation) increases the total aggregate bandwidth available to the system and provides additional hardware redundancy.

When establishing a redundant pair, each device must know where to send its health heartbeats and sync data.

The Peer IP: The Failover Peer IP is the IP address belonging to the other BIG-IP device in the HA pair. This is typically a 34 Self-IP on a dedicated " HA " or " Internal " VLAN, or the Management IP.

Purpose: It identifies the destination for the " Heartbeat " (the " Are you alive? " check).

Setup Context: During the initial setup, you tell Device A to look for Device B at its " Failover Peer IP, " and you tell Device B to look for Device A at its respective " Failover Peer IP. "

For BIG-IP to send or receive traffic on a VLAN, that VLAN must be bound to a physical interface or a trunk . Creating a VLAN object and a Self IP alone is not sufficient to establish data-plane connectivity.

From the exhibit:

The VLAN ( vlan_1033 ) exists and has a tag defined.

A Self IP is configured and associated with the VLAN.

However, traffic cannot reach servers on that VLAN.

This indicates a Layer 2 connectivity issue , not a Layer 3 or HA issue.

Why assigning a physical interface fixes the problem:

BIG-IP VLANs do not carry traffic unless they are explicitly attached to:

A physical interface (e.g., 1.1), or

A trunk

Without an interface assignment, the VLAN is effectively isolated and cannot transmit or receive frames, making servers unreachable regardless of correct IP addressing.

Why the other options are incorrect:

A. Set Port Lockdown to Allow All Port Lockdown controls which services can be accessed on the Self IP (management-plane access), not whether BIG-IP can reach servers on that VLAN.

B. Change Auto Last Hop to enabled Auto Last Hop affects return traffic routing for asymmetric paths. It does not fix missing Layer 2 connectivity.

D. Create a Floating Self IP address Floating Self IPs are used for HA failover. They do not resolve reachability issues on a single device when the VLAN itself is not connected to an interface.

Conclusion:

The servers are unreachable because the VLAN has no physical interface assigned . To restore connectivity, the BIG-IP Administrator must assign a physical interface (or trunk) to the VLAN , enabling Layer 2 traffic flow.

In an Active/Standby BIG-IP design, application availability during failover depends on both units having equivalent data-plane connectivity for the networks that carry application traffic. Specifically:

VLANs are bound to specific interfaces (and optionally VLAN tags).

Floating self IPs / traffic groups move to the new Active device during failover.

For traffic to continue flowing after failover, the new Active device must have the same VLANs available on the correct interfaces that connect to the upstream/downstream networks.

What the symptom tells you:

Traffic works when Device A is Active

Traffic fails when Device B becomes Active

Failback immediately restores traffic

This pattern strongly indicates the Standby unit does not have the VLAN connected the same way (wrong physical interface assignment), so when it becomes Active, it owns the floating addresses but cannot actually pass traffic on the correct network segment.

Why Interface mismatch is the best match:

If the Active unit is already working, its interface mapping is correct.

The fix is to make the Standby unit’s VLAN/interface assignment match the Active unit.

That corresponds to changing the Standby device interface to 1.1 .

Why the Tag options are less likely here (given the choices and the exhibit intent):

Tag issues can also break failover traffic, but the question/options are clearly driving toward the classic HA requirement: consistent VLAN-to-interface mapping on both devices so the data plane remains functional after the traffic group moves.

Conclusion: To avoid an outage on the next failover, the BIG-IP Administrator must ensure the Standby device uses the same interface (1.1) for the relevant VLAN(s) that carry the application traffic, so when it becomes Active it can forward/receive traffic normally.

Understanding the default behavior of a Standard Virtual Server regarding address and port translation is fundamental to BIG-IP administration.

Source Address Translation (SNAT): By default, the BIG-IP system does not perform Source Address Translation (SNAT). This means that the packet ' s source IP address (the Client IP ) remains preserved as it passes through the BIG-IP to the pool member. This is critical for backend servers to identify the original client for logging and security purposes. Therefore, the client IP address is unchanged between the client-side and server-side connections.

Destination Address Translation (DAT): By default, a Standard Virtual Server always performs Destination Address Translation. The BIG-IP system changes the destination IP from the Virtual Server ' s IP address to the IP address of the specific Pool Member selected by the load balancing algorithm. Consequently, the server-side destination IP is different from the client-side destination IP.

Port Translation: By default, Port Translation is enabled. If a Virtual Server is listening on port 80 and the selected pool member is configured for port 8080, the BIG-IP will translate the destination port. Even if the ports happen to be the same, the setting allows for change, whereas the default SNAT setting (None) ensures the client IP remains static.

Comprehensive and Detailed Explanation From BIG-IP Administration Data Plane Concepts/Course Guide/topics:

BIG-IP evaluates a new connection against eligible virtual servers using increasingly specific traffic-matching criteria. F5 ' s certification material states that, for BIG-IP 11.3 and later, virtual-server precedence considers destination address first, source address second, and service port third , with the most specific applicable listener taking precedence. F5, Inc.

Option B initially appears attractive because it specifies the exact destination 10.16.2.100:445. However, its source 192.168.5.1/32 restricts that virtual server to traffic originating from that single source. The actual packet originates from 10.10.1.1 , so B is not an eligible match. F5 explicitly documents that the source address setting can restrict a virtual server to packets originating from a defined address or range.

Option C is eliminated because its destination is 10.120.6.10, not 10.16.2.100. Option D is the broad catch-all forwarding virtual (0.0.0.0:any, protocol any). Option A , however, is an applicable TCP forwarding virtual for the requested traffic and is preferred over the generic catch-all forwarding listener.

Study Guide References/Topics: Virtual Server Order of Precedence; Source Address Matching; Forwarding (IP) Virtual Servers; FastL4 Processing; Virtual Server Traffic Matching.

In BIG-IP high availability (HA) deployments, one of the primary causes of traffic disruption during failover is Layer 2 and Layer 3 relearning by upstream network devices (switches and routers). When traffic groups move from the Active device to the Standby device, the network must quickly associate the IP addresses with the new device.

Why MAC Masquerading Minimizes Failover Impact:

MAC masquerading allows a traffic group to use a floating, shared MAC address for its Self IPs. This MAC address moves with the traffic group during failover.

Key benefits:

The MAC address does not change when failover occurs

Upstream switches do not need to relearn ARP entries

Traffic resumes almost immediately after failover

Dramatically reduces packet loss and connection interruption

From BIG-IP Administration Data Plane Concepts:

MAC masquerade is specifically designed to provide fast failover

It is a best practice for HA pairs, especially in environments sensitive to latency and connection loss

Why the Other Options Are Incorrect:

A. External monitors

Used to check the availability of external resources

Do not reduce network convergence or failover disruption

B. Clone pool

Used for traffic mirroring or security analysis

Has no impact on failover behavior

C. OneConnect profile

Optimizes server-side TCP connections

Does not address ARP or MAC relearning during failover

Key HA Concept Reinforced:

To minimize failover impact on live traffic, BIG-IP administrators should ensure Layer 2 continuity . MAC masquerading is the primary mechanism that enables near-instant failover by preventing ARP and MAC table reconvergence delays.

===========

In BIG-IP architecture, link aggregation and redundancy at Layer 2 are implemented using Trunks , not virtual servers or pools.

According to BIG-IP Administration Data Plane Concepts:

Interfaces are the physical network ports on the BIG-IP device

A Trunk is a logical grouping of multiple interfaces

Trunks can be configured to use LACP (Link Aggregation Control Protocol) to:

Provide link redundancy

Increase aggregate bandwidth

Allow automatic detection of link failures

VLANs are then assigned to the trunk , not directly to individual interfaces, once aggregation is in place

Correct Design for the Scenario:

To connect BIG-IP to two upstream switches with LACP:

One physical interface from BIG-IP connects to Switch A

Another physical interface from BIG-IP connects to Switch B

Both interfaces are placed into the same trunk

LACP is enabled on the trunk and on the switches

This configuration allows:

Traffic to continue flowing if one interface or switch fails

Proper LACP negotiation between BIG-IP and the upstream switches

Clean separation of responsibilities (Layer 2 handled by trunking, Layer 4–7 by virtual servers)

Why Option D Is Correct:

A Trunk containing an interface connected to each switch is exactly how BIG-IP implements LACP-based interface binding

The trunk handles link state, load distribution, and failover at the data plane

Why the Other Options Are Incorrect:

A & B – Virtual servers operate at Layers 4–7 and have nothing to do with physical link aggregation or LACP

C – VLAN IDs and MAC addresses are not configured inside a trunk definition; trunks aggregate interfaces, and VLANs are applied to trunks

Key Data Plane Concept Reinforced:

On BIG-IP systems, LACP is always configured on a Trunk , which aggregates physical interfaces to provide Layer 2 resiliency and bandwidth aggregation . Virtual servers and pools are not involved in physical interface binding.

===========

In BIG-IP high availability (HA) configurations, MAC Masquerade is used to speed up failover by allowing traffic-group-associated Self IPs to retain the same MAC address when moving between devices. This prevents upstream switches and routers from having to relearn ARP entries during a failover event, resulting in near-instant traffic recovery.

By default, MAC masquerade applies one MAC address per traffic group, regardless of how many VLANs the traffic group spans. This can create problems in some network designs because the same MAC address appearing on multiple VLANs may violate network policies or confuse switching infrastructure.

To address this, BIG-IP provides Per-VLAN MAC Masquerade, enabled by the database variable:

`tm.macmasqaddr_per_vlan = true`

When this feature is enabled:

BIG-IP derives a unique MAC address per VLAN

The base MAC address configured on the traffic group remains the first four octets

The last two octets are replaced with the VLAN ID expressed in hexadecimal

The VLAN ID is encoded in network byte order (high byte first, low byte second)

### VLAN ID Conversion:

VLAN ID: 1501 (decimal)

Convert to hexadecimal:

1501₁₀ = 0x05DD

High byte: 05

Low byte: DD

### Resulting MAC Address:

Base MAC: `02:12:34:56:00:00`

Per-VLAN substitution → last two bytes = `05:DD`

Final MAC address:

`02:12:34:56:05:dd`

### Why the Other Options Are Incorrect:

A (01:15) – Incorrect hexadecimal conversion of 1501

B (dd:05) – Byte order reversed (little-endian, not used by BIG-IP)

D (15:01) – Uses decimal values instead of hexadecimal

### Key BIG-IP HA Concept Reinforced:

Per-VLAN MAC Masquerade ensures Layer 2 uniqueness per VLAN while preserving the fast failover benefits of traffic groups, making it the recommended best practice in multi-VLAN HA deployments.

When managing a large environment with hundreds of Virtual Servers, the most efficient way to identify the relationship between an iRule and the objects it manages is to view the properties of the iRule itself.

iRule Properties: Within the BIG-IP Configuration Utility, navigating to Local Traffic > iRules and selecting a specific iRule provides a " Statistics " or " Usage " tab (depending on the version). This view explicitly lists all Virtual Servers currently associated with that specific iRule.

Centralized Management: Instead of manually checking 235 individual Virtual Servers under the " Virtual Servers " menu, the iRules menu acts as a central point of reference for that specific logic.

Data Plane Impact: Because iRules can modify traffic flow, headers, and load balancing decisions, seeing the full list of affected Virtual Servers is critical before making adjustments to avoid unintended side effects across the application portfolio.

Cookie Persistence is a Layer 7 persistence method that leverages an HTTP cookie to track a user session.

IP Independence: Unlike " Source Address Affinity " (which relies on the client ' s IP), Cookie persistence identifies the session base 16 d on a unique token provided by the BIG-IP system. This is crucial for environments where many users share a single gateway (NAT) or where a client ' s IP might change mid-session.

Encryption and Decryption: For the BIG-IP to insert or read a cookie, it must be able to see the HTTP header. If the traffic is encrypted end-to-end (SSL Pass-through), the BIG-IP cannot use cookie persistence. SSL must be terminated at the BIG-IP (Option B is false).

Security: By default, BIG-IP cookies are encoded, not clear text. Modern versions allow for easy encryption of these cookies to prevent information leakage (Option C is false).

Memory vs. Disk: The default behavior is " session-based " (In-memory). A cookie is only written to the client ' s file system (disk) if an Expiration is configured in the persistence profile (Option D is false).

A Self IP is an IP address on the BIG-IP system that you associate with a specific VLAN .

VLAN Association: A Self IP cannot exist independently; it must be bound to a VLAN to define which network segment the BIG-IP can communicate with.

Layer 2 to Layer 3 Mapping: While a VLAN is associated with physical interfaces or trunks (Layer 2), the Self IP provides the Layer 3 identity for the BIG-IP on that VLAN.

Traffic Processing: Self IPs are used by the BIG-IP for health checking backend servers, acting as a default gateway for servers, and for HA heartbeat communication.

In BIG-IP traffic management, persistence profiles cause existing client connections (and subsequent requests) to be repeatedly sent to the same pool member. When persistence is enabled, simply preventing new connections is not sufficient if the requirement is to immediately remove all existing connections .

Key behavior of pool member states:

Forced Offline

Immediately removes the pool member from load balancing.

Terminates all existing connections , regardless of persistence.

Prevents new connections from being established.

This is the correct state when urgent maintenance or troubleshooting is required.

Disabled

Prevents new connections from being sent to the pool member.

Allows existing connections to continue , which is not acceptable when persistence is configured and connections must be cleared immediately.

Offline (non-forced)

Similar to Disabled behavior depending on context.

Does not guarantee immediate termination of existing connections.

Manually deleting connections via the command line

Is unnecessary and operationally inefficient.

BIG-IP already provides a supported mechanism ( Forced Offline ) to cleanly and immediately remove traffic.

Conclusion:

To immediately remove all existing connections , including those maintained by persistence, the BIG-IP Administrator must set the pool member to a Forced Offline state. This directly satisfies the requirement without additional manual steps.

An Application Delivery Controller (ADC) provides application traffic-management functions between clients and application servers. Two fundamental ADC capabilities represented here are SSL offloading and load balancing .

SSL offloading allows the BIG-IP system to terminate client-side SSL/TLS connections and perform the cryptographic processing that would otherwise consume application-server resources. F5 specifically describes SSL offload as the BIG-IP system performing the SSL handshake and encryption/decryption functions normally performed by the destination server. Client SSL profiles are commonly applied to virtual servers to implement this functionality.

Load balancing is another core ADC function. BIG-IP LTM uses pools and configured load-balancing algorithms to select an appropriate pool member for each connection or request. For example, with Round Robin, BIG-IP distributes incoming requests sequentially across available pool members. F5 identifies the load-balancing method as a fundamental property of a server pool.

Log collecting can occur as part of system administration and telemetry, but it is not one of the fundamental ADC functions being tested here. Screen sharing is an end-user collaboration capability and has no role in ADC traffic delivery.

Study Guide References/Topics: Application Delivery Controller Functions; SSL/TLS Offload; Virtual Servers and SSL Profiles; Pools; Load-Balancing Methods.

===============

When handling high-volume UDP traffic where the BIG-IP does not need to maintain any session history or relationship between packets, a Stateless virtual server is the appropriate choice.

No Connection Tracking: A stateless virtual server does not create or maintain entries in the BIG-IP connection table. This means the system processes each packet as an individual event, without " considering previous connections " or packets from the same source.

High Performance: Because the system bypasses the overhead of state management, stateless virtual servers provide the highest possible throughput for UDP and ICMP traffic.

Use Cases: This is ideal for services like DNS (stateless queries) or some types of syslog traffic where each packet is independent and doesn ' t require the persistence or protocol inspection typically provided by a full-proxy.

Why other options are incorrect:

Forwarding: While a Forwarding (IP) virtual server can handle UDP, it still maintains a state entry in the connection table to ensure return traffic is handled correctly.

Standard: This is a full-proxy virtual server. It is inherently stateful and requires a connection table entry for every flow it manages.

Reject: This is a special virtual server type that simply drops incoming traffic and, in the case of TCP, sends a reset (RST) or, for UDP, sends an ICMP unreachable message. It is not a load balancing type.

To meet the requirement of fault tolerance when one interface goes down , BIG-IP must use link aggregation so that loss of a single physical link does not isolate the VLAN(s).

How the objects relate (data plane view)

Interfaces = physical links.

Trunk (LACP) = bundles multiple interfaces into one logical link that provides redundancy (and possibly bandwidth aggregation).

VLANs are assigned to interfaces or trunks. If you need multiple VLANs on the same trunk , they must use 802.1Q tagging (because you can only have one untagged VLAN per interface/trunk).

Self IPs are then placed on the VLANs to provide BIG-IP presence and routing/ARP functions, but self IPs are not what provides link resiliency— the trunk does .

Why Option D is correct

You have two physical interfaces and you want resiliency if one fails → put both interfaces into one trunk with LACP enabled .

You need both external and internal VLANs on those same two links → both VLANs should be configured as tagged on that trunk, so they can coexist on the same aggregated link.

If either physical interface fails, the trunk remains up via the remaining interface, keeping both VLANs operational .

Why the other options are incorrect

A : Two VLANs cannot both be untagged on the same trunk/interface. Only one untagged VLAN is possible; additional VLANs must be tagged.

B : Two trunks “each with one VLAN” would typically mean splitting VLANs across separate trunks. With only two interfaces total, that becomes one interface per trunk—if one interface goes down, the VLAN on that interface is down (no redundancy for that VLAN).

C : Same redundancy problem as B, and disabling LACP removes the negotiated aggregation behavior expected when the switch engineer specifically requested LACP.

===========

In a High Availability (HA) environment, a failover event occurs when the active BIG-IP system stops processing traffic and the standby unit takes over. This transition can cause a brief disruption in network traffic because the surrounding switches need to update their ARP tables to associate the Virtual IP (VIP) and floating Self-IPs with the MAC address of the new active unit.

MAC Masquerade Functionality: To minimize this impact, an administrator can configure MAC masquerading . This feature allows the administrator to assign a unique, " shared " MAC address to a traffic group.

Seamless Transition: When a failover occurs, the new active unit begins using this shared MAC address immediately. Since the MAC address for the traffic group remains the same regardless of which physical device is active, the upstream switches do not need to update their ARP tables or learn a new MAC-to-port mapping.

Packet Loss Reduction: By maintaining a constant MAC address, MAC masquerading significantly reduces the time it takes for traffic to resume, effectively eliminating the " gratuitous ARP " dependency and minimizing packet loss during the handover.

Why other options are incorrect:

External monitors: These are used for advanced health checking of pool members and do not directly impact the speed or smoothness of a device-level failover.

OneConnect profile: This is a performance optimization tool that aggregates multiple client-side requests into a single server-side TCP connection; it is not a failover mechanism.

Clone pool: This is used to replicate traffic for IDS or monitoring purposes and has no role in high availability or failover optimization.

The Forced Offline state is a critical administrative tool used during maintenance to ensure a device remains in a non-functional state relative to the traffic group.

Preventing Active Status: When a device is in " Forced Offline, " it is effectively disqualified from the HA election process. Even if the other peer fails, a device in Forced Offline will not become active. This is vital during maintenance (like firmware upgrades or hardware replacement) to prevent an unstable or half-configured device from attempting to process traffic.

Traffic Termination: Placing a device in Forced Offline triggers the system to stop accepting new connections and, depending on the configuration, can facilitate the termination of existing connections so that the administrator can perform work without the data plane actively utilizing system resources.

Persistence Handling: Unlike the " Disabled " state, Forced Offline ignores persistence records, ensuring that no new traffic is steered to the device via session affinity.

In this scenario, two specific High Availability and Persistence requirements must be met to ensure session continuity during a failover.

Persistence Mirroring: By default, persistence records (which map a client to a specific server) exist only on the memory of the active BIG-IP. If a failover occurs, the standby unit has no knowledge of these sessions and will re-load-balance the client, likely to a different server. Enabling Persistence Mirroring ensures that the persistence table is synchronized in real-time to the standby peer.

Match Across Services: The requirement specifies that the session must persist across both HTTP and FTP . These are different Virtual Servers (and likely different ports). The Match Across Services setting in the persistence profile allows the BIG-IP to use the same persistence record for any Virtual Server that shares the same IP address and pool, regardless of the service port.