F5CAB5 F5 BIG-IP Administration Support and Troubleshooting (F5CAB5) exam Free Practice Exam Questions (2025 Updated)

The pool member is markedDOWNbecause it is monitored bymultiple health monitors, specifically anHTTPmonitor and anHTTP/2monitor. The status message clearly shows that theHTTP monitor is UP, while theHTTP/2 monitor is DOWN. In BIG-IP, when multiple monitors are assigned to a pool member, the default behavior isAND logic, meaningall assigned monitors must succeedfor the pool member to be considered healthy.

In this scenario, the server is responding successfully to standard HTTP (likely HTTP/1.1) requests but does not support or respond correctly to HTTP/2 requests. As a result, the HTTP/2 monitor fails, which causes the overall monitor status to beDOWN, even though HTTP traffic itself is working.

This behavior is expected and documented in BIG-IP monitoring logic. Unless the monitor rule is explicitly changed to“at least one of”, a single failing monitor will mark the pool member down. Therefore, the correct conclusion is that the pool member isonly serving HTTP traffic, not HTTP/2.

The resolution would be to either remove the HTTP/2 monitor, correct the application to support HTTP/2, or adjust the monitor rule to match the intended health-check logic.

Comprehensive and Detailed Explanation From BIG-IP Administration Support and Troubleshooting documents: Monitoring resource utilization is essential for maintaining system stability. If the root (/) file system reaches 100% capacity, the BIG-IP may become unresponsive, fail to save configuration changes, or experience daemon crashes83. When the / partition is full, the immediate troubleshooting step is to identify large or unnecessary files—such as old log files, core dumps, or temporary installer files—located specifically within that file system84. In the provided exhibit, /dev/md4 is explicitly listed at 100% usage for the / mount point85. Checking other partitions like /usr (which is at 82% in the exhibit) would not resolve the immediate "Full" status of the root directory86. Administrators often use the du (disk usage) command via the CLI to find the problematic files. Managing disk space is a proactive task; however, when utilization hits 100%, it becomes a reactive troubleshooting emergency that must be resolved to restore the management plane's functionality.

When a virtual server's traffic flow is disrupted only during failover events and takes several minutes to stabilize, the issue is typically related to the ARP cache on upstream network devices47. By default, each BIG-IP in an HA pair uses its own unique hardware MAC address for traffic4848. When a failover occurs, the new active device takes over the floating IP addresses, but the upstream switch may still have the MAC address of the old device cached4949. Traffic fails until the switch's ARP entry is updated. "MAC Masquerade" is a troubleshooting feature that assigns a shared, virtual MAC address to the floating traffic group. Regardless of which BIG-IP is currently active, it will use this masqueraded MAC address for all traffic related to that group52. Because the MAC address seen by the network never changes during a failover, the upstream devices do not need to relearn ARP entries, resulting in an instantaneous transition and eliminating the performance drop reported by users

The exhibit shows the virtual serverapplication_vswith a status indicating it isoffline but enabled. In BIG-IP terminology, this status means the virtual server itself is administratively enabled, but it is unable to pass traffic becauseno usable pool members are available.

Two common and documented causes for this condition are:

Pool member(s) administratively disabled (Option A):When all pool members are administratively disabled, BIG-IP removes them from load-balancing decisions. Even though the virtual server remains enabled, it has no available pool members to send traffic to, resulting in an offline status.

Node(s) administratively disabled (Option C):Pool members inherit the status of their parent nodes. If a node is administratively disabled, all associated pool members are also marked unavailable. This condition causes the virtual server to show as offline, even though the virtual server configuration itself is correct.

The other options are incorrect:

Forced offline pool members (Option B)result in a different operational intent and are explicitly set for maintenance scenarios.

Virtual server administratively disabled (Option D)would show the virtual server as disabled, not enabled/offline.

This behavior is consistent with BIG-IP traffic management logic and is commonly verified by reviewingpool and node availability stateswhen diagnosing virtual server availability issues.

Comprehensive and Detailed Explanation From BIG-IP Administration Support and Troubleshooting documents: In F5 TMOS administration, the traffic flow is processed through specific event huddles w3ithin iRules. To troubleshoot or m4odify traffic based on a URI (Uniform Resource Identifier), the BIG-IP system must first parse the application-layer data. The HTTP_REQUEST event is triggered when the system has fully received and parsed the HTTP request headers from the client5. This is the correct point to implement logic that selects a pool or pool member based on the path or file requested (e.g., /images or /api). Using CLIENT_ACCEPTED would be too early in the troubleshooting process because that event triggers at the L4 (TCP) connection establishment phase, before any URI information is available6. Conversely, HTTP_RESPONSE occurs during the return traffic from the server, which is too late to make a load balancing decision7. For troubleshooting virtual server behavior where URIs are involved, ensuring the iRule is attached to a Virtual Server with an HTTP profile and using the HTTP_REQUEST event is essential for proper traffic steering and inspection.

When a pool is not working as expected immediately after adding new members to a busy environment, the "Slow Ramp Time" setting is a critical factor

In a pool using the "Least Connections" load balancing method, a new member starts with zero active connections5858. Without a slow ramp time, the BIG-IP will immediately direct a high volume of new traffic to this server to "equalize" it with other members. This sudden surge can overwhelm the server's application stack before it has fully initialized or warmed its caches, leading to failures. By configuring a "Slow Ramp Time," the administrator ensures that the system gradually increases the amount of traffic sent to the new member over a specified duration. The traffic sent is proportional to the time the member has been available relative to the ramp time setting62. If the application fails only for users routed to new servers, reviewing this setting helps ensure that new capacity is integrated into the pool without disrupting service performance

Understanding High Availability (HA) synchronization behavior is critical for maintaining a stable environment. In a device group where "Auto-Sync" is enabled, the BIG-IP system monitors the management plane for any configuration updates across all members. While best practices often suggest making changes on the "Active" device, TMOS allows changes on any device within the group. When a change is made on the "Standby" device, the system detects a configuration mismatch and, because Auto-Sync is enabled, it automatically pushes those changes to the other devices in the sync group, including the current Active member. To troubleshoot if this is working correctly, the administrator should review the "Sync Status" stats in the Configuration Utility. If the changes do not propagate, it suggests9 a breakdown i10n the HA trust relationship or network connectivity issues on the failover VLAN. Proper interpretation of this scenario confirms that the HA functionality is operating correctly, ensuring that both devices have a consistent set of virtual servers and pools, which is vital f11or seamless failover.

To collect application-layer details such asHTTP status codes(200, 404, 500, etc.) andHTTP methods(GET, POST, PUT, DELETE), the BIG-IP system must use a profile designed for traffic visibility and reporting rather than basic traffic handling. TheAnalytics profile (Option C)is the correct choice because it is specifically designed to collect, store, and present detailed statistics about HTTP and TCP traffic passing through a virtual server.

When an Analytics profile is attached to a virtual server, BIG-IP can record metrics such as HTTP response codes, request methods, URI paths, latency, throughput, and client-side/server-side performance data. These statistics are then accessible through the BIG-IP GUI underStatistics → Analytics, allowing administrators to validate application behavior and troubleshoot performance or functional issues.

TheHTTP profile (Option B)enables HTTP protocol awareness and features like header insertion and compression, but it does not provide historical or statistical reporting of HTTP methods and response codes.Request Adapt (Option A)is used for ICAP-based content adaptation, not visibility.Statistics (Option D)is not a standalone profile and does not provide HTTP-level insight.

Therefore, the Analytics profile is the only default profile that fulfills this requirement.

Comprehensive and Detailed Explanation From BIG-IP Administration S73upport and Troubleshooting documents: Persistence is critical for ensuring that a client's session remains with the same pool member throughout its duration. If primary persistence (like Cookie Persistence) fails—for instance, because the client has disabled cookies—load balancing will not work as expected, and the session may be broken. A "Fallback Persistence Profile" provides a backup method75. The most common and reliable fallback method is "Source Address Affinity"76. This method tracks the client's IP address in the BIG-IP's persistence table and ensures that any subsequent requests from that IP are routed to the same pool member, even if the primary persistence token is missing. Troubleshooting session drops often involves checking if a fallback method is configured to handle scenarios where the primary method is unsupported by the client's browser or environment. Without a fallback, the BIG-IP would revert to standard load balancing, potentially sending the client to a different server that lacks their session data.

This scenario describes a classic network performance issue known as the "Mega-Proxy" problem. When an organization routes all employee traffic through a single proxy server, the BIG-IP sees thousands of unique users as having the exact same source IP address. If the administrator has configured "Source Address Affinity" persistence, the BIG-IP will correctly follow the rule but incorrectly route all users to the same single backend pool member. This creates a severe load imbalance where one server is overwhelmed while others remain idle, leading to poor application response times. To resolve this, the administrator must change the persistence profile to "HTTP Cookie". Cookie-based persistence allows the BIG-IP to place a unique identifier in each user's browser, allowing the system to distinguish between individual sessions even if they share the same source IP. This fix ensures that traffic is distributed evenly across the pool members, restoring4 the expect5ed load balancing functionality and resolving the slow performance reported by users behind the corporate proxy.

When a pool member is markedDOWN, it indicates that the configured health monitor is failing. The most effective troubleshooting approach is to focus on the monitor behavior and the actual traffic between BIG-IP and the pool member.

Enabling monitor logging (Option B)is a recommended first step. Monitor logging provides detailed information about why the health check is failing, such as timeouts, connection refusals, incorrect responses, or unexpected status codes. This directly correlates with BIG-IP troubleshooting best practices and allows administrators to confirm whether the failure is due to application behavior, incorrect monitor configuration, or network reachability.

Collecting a TCPdump packet capture (Option D)is also a highly effective method. A packet capture allows the administrator to verify whether the monitor probes are being sent, whether responses are received, and whether packets are being dropped, reset, or malformed. This is especially valuable when diagnosing firewall issues, SSL problems, or application-level failures.

Reviewing pool statistics (Option C) is useful for general monitoring but does not explainwhya health monitor is failing. Reviewing the routing table (Option A) is typically unnecessary unless there is evidence of a broader routing issue affecting multiple destinations.