Verified F5CAB5 Exam Dumps PDF [2026] Access using BraindumpsPrep
Try Best F5CAB5 Exam Questions from Training Expert BraindumpsPrep
F5 F5CAB5 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 32
A BIG-IP Administrator configured the following virtual server to pass traffic on all addresses and ports.
After configuration is completed, the BIG-IP Administrator notices that the virtual server is unable to pass traffic.
Plaintext
ltm virtual forwarding_any_vs {
destination 0.0.0.0:any
ip-forward
mask 255.255.255.255
profiles {
fastL4 {}
}
serverssl-use-sni disabled
source 0.0.0.0/0
translate-address disabled
translate-port disabled
}
Which part of the configuration is the cause of the issue?
- A. Incorrect mask 255.255.255.255
- B. Incorrect translate-address configured
- C. Incorrect destination configured
Answer: A
Explanation:
The failure of the Forwarding (IP) virtual server is caused by an incorrect Network Mask configuration for a wildcard destination.
* Wildcard Destination: The administrator intends to create a "Wildcard" Virtual Server that listens for any destination IP address (0.0.0.0).
* The Mask Conflict: A mask of 255.255.255.255 (or /32) tells the BIG-IP to look for a specific, single host address. When combined with 0.0.0.0, the system is literally looking for traffic destined for the IP
0.0.0.0, which is not a valid routable destination for standard traffic.
* Correct Configuration: To allow the virtual server to catch traffic for any IP address, the mask must be changed to 0.0.0.0 (or /0). This signifies that the system should ignore all bits of the destination address and match everything.
* Forwarding Logic: The rest of the configuration-including ip-forward (Forwarding IP type), translate-address disabled, and translate-port disabled-is correct for a BIG-IP acting as a router
/gateway.
NEW QUESTION # 33
A BIG-IP Administrator creates a new Virtual Server. The end user is unable to access the page. During troubleshooting, the administrator learns that the connection between the BIG-IP system and server is NOT set up correctly. What should the administrator do to solve this issue?
- A. Disable Address Translation
- B. Set Address Translation to SNAT and have self-IP configured in the same subnet of servers
- C. Set Address Translation to SNAT and configure a specific translation address
- D. Set Address Translation to Auto Map, configure a SNAT pool, and have pool members in the same subnet of the servers
Answer: C
Explanation:
When a virtual server is not working as expected despite the pool members being marked "UP" (Green), the issue is frequently a return-path routing failure. If the BIG-IP forwards a request with the original client's source IP address, the backend server will try to respond directly to that client. If the server does not have its default gateway pointed back to the BIG-IP, the response packet will be routed elsewhere (or dropped), resulting in a connection timeout for the user. To resolve this, the administrator must configure "Source Address Translation" (SNAT). By setting SNAT to "Automap" or a specific SNAT address, the BIG-IP replaces the client's IP with its own internal self-IP. The backend server then sees the BIG-IP as the source and sends the response back to it locally. This troubleshooting step ensures a functional, symmetric tr18affic flow. Identifying the need for SNAT is one of the most common troubleshooting tasks for new virtual server deployments where the BIG-IP is not the default gateway for the backend servers.
NEW QUESTION # 34
A BIG-IP Administrator adds new Pool Members into an existing, highly utilized pool. Soon after, there are reports that the application is failing to load for some users. What pool level setting should the BIG-IP Administrator check?
- A. Action On Service Down
- B. Allow SNAT
- C. Slow Ramp Time
- D. Availability Requirement
Answer: C
Explanation:
When troubleshooting a pool that is not working correctly after adding new members, the "Slow Ramp Time" setting is a primary suspect. In a pool that is already under high load and using a "Least Connections" load balancing method, a newly added server has zero connections. Without a slow ramp time, the BIG-IP will immediately direct a massive flood of new connections to the new server to "balance" it with the others. This
"thundering herd" effect can crash a newly initialized application server before it has time to warm up its caches or establish its own database connections. By setting a "Slow Ramp Time" (typically in seconds), the administrator ensures the BIG-IP gradually increases the connection ratio to the new member. This allows the server to stabilize and scale up its performance over time. If users report intermittent failures specifically coinciding with the expansion of a pool, checking this setting is a vital troubleshooting step to maintain pool health during maintenance.
NEW QUESTION # 35
Which two methods should the BIG-IP Administrator troubleshoot a Pool-member that's been marked
"DOWN" by its Health Monitor? (Pick the 2 correct responses below)
- A. Enable Monitor Logging for the Pool-member that's "DOWN".
- B. Review the Pool & Pool-member Statistics table for error data.
- C. Review the BIG-IP's routing table using "netstat -rn" to show all routes.
- D. Collect a TCPdump packet capture for the "DOWN" Pool-member.
Answer: A,D
Explanation:
When a health monitor marks a member "Down," the goal is to determine if the issue is at the network level or the application level.
* Monitor Logging (Option A): In the Pool Member configuration, an administrator can enable
"Monitor Logging". This generates a detailed text file in /var/log/monitors/ that shows the exact "Send" string sent by the BIG-IP and the exact "Receive" string (or lack thereof) returned by the server.
* TCPdump (Option C): This is the most definitive way to see if the monitor traffic is even leaving the BIG-IP and if the server is responding with a TCP RST (reset) or an ICMP unreachable message. A command such as tcpdump -ni <vlan> host <member_ip> and port <member_port> is standard for this task.
* Why not others? While the routing table (Option B) is useful for general connectivity, if other members in the same subnet are "Up," the routing is likely fine. Statistics (Option D) show that it is down but rarely why it is down at a protocol level.
NEW QUESTION # 36
A BIG-IP device sends out the following SNMP trap: big-ipo.f5.com - bigipExternalLinkChange Link: 1.0 is DOWN. Where in the BIG-IP Configuration utility should the BIG-IP Administrator verify the current status of Link 1.0?
- A. Network > Interfaces > Interface List
- B. Network > Trunks > Trunk List
- C. System > Platform
- D. Statistics > Performance > System
Answer: A
Explanation:
Comprehensive and Detailed Explanation From BIG-IP Administration Support and Troubleshooting documents:Identifying network-level performance issues often starts with investigating hardware-level alerts78. In F5 terminology, a "Link" like "1.0" or "1.1" refers to a physical interface on the appliance79.
When an SNMP trap reports that a link is "DOWN," it indicates a loss of signal or an administrative shutdown of the physical port80. To verify this, the administrator must navigate to Network > Interfaces > Interface List81. This screen provides real-time status, showing whether the interface is "up," "down," or
"uninitialized," as well as any media speed or duplex mismatches that could be causing performance degradation82. Troubleshooting this is the first step in resolving "pool member down" or "VLAN failsafe" issues, as a down interface will take down any VLANs associated with it, immediately halting all traffic flow for the services relying on that physical path.
NEW QUESTION # 37
A BIG-IP Administrator receives reports from users that SSL connections to the BIG-IP device are failing. Upon checking the log files, the administrator notices: SSL transaction (TPS) rate limit reached. stats show a maximum of 1200 client-side SSL TPS and 800 server-side SSL TPS. What is the minimum SSL license limit required to handle this peak?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: B
Explanation:
Troubleshooting failed SSL handshakes involves interpreting the resource limits defined by the system's license8888. The log message SSL transaction (TPS) rate limit reached indicates the BIG-IP is dropping SSL connections because it has exceeded its licensed "Transactions Per Second" capacity. When analyzing stats to determine the correct license level, the administrator must focus on "Client-side" SSL TPS. This represents the initial encrypted handshakes between users and the BIG-IP virtual servers91. In this scenario, the peak client-side demand is 1200 TPS. While the 800 server-side transactions represent re-encryption toward the backend, F5's primary SSL TPS license limits typically apply to the client-facing side of the traffic flow. Therefore, to resolve the intermittent connectivity issues and ensure the virtual server works reliably during peaks, the license must be upgraded to at least 1200 TPS949596969696. 9798Confirming this peak via statistics and comparing it to the current license is a standard troubleshooting step for SSL performance issues.
NEW QUESTION # 38
A BIG-IP Administrator notices that one of the servers that runs an application isNOTreceiving any traffic.
The BIG-IP Administrator examines the configuration status of the application and observes the displayed monitor configuration and affected pool member status.
What is the possible cause of this issue? (Choose one answer)
- A. The node health monitor isNOTresponding.
- B. The application isNOTresponding with the expected Receive String.
- C. HTTP 1.1 isNOTappropriate for monitoring purposes.
- D. The BIG-IP device isNOTable to reach the pool.
Answer: A
Explanation:
The key clue in the exhibit is the pool member's availability showing"Offline (Enabled) - Parent down". In BIG-IP terminology, a pool member inherits the status of itsparent node. If thenodeis marked down (for example, by a node-level monitor or a default "node is down" condition), thenall pool members using that node IPwill also be marked down and will not receive any traffic, even if the application service on the member port might be healthy.
While the HTTPS monitor configuration (send/receive strings) is displayed, the statusspecificallyindicates anode (parent) failure, not a service-level failure. If the problem were the application not matching the receive string, you would typically see the member down due to themember's monitorfailing (and the status would reflect monitor failure details), rather than "parent down." Option D is too broad; BIG-IP can generally reach the subnet (other servers work), and this symptom points to a specific node condition. Option C is incorrect because HTTP/1.1 is commonly used for monitoring and is valid when properly formatted (especially with a Host header). Therefore, the most likely cause is that thenode health monitor is not responding, causing the node-and consequently the member-to be marked down.
NEW QUESTION # 39
A user needs to determine known security vulnerabilities on an existing BIG-IP appliance and how to remediate these vulnerabilities. Which action should the BIG-IP Administrator recommend?
- A. Generate a qkview and upload to iHealth
- B. Verify the TMOS version and review the release notes
- C. Create a UCS archive and upload to iHealth
- D. Create a UCS archive and open an F5 Support request
Answer: A
Explanation:
F5 recommends using the iHealth diagnostic tool to identify security vulnerabilities and receive specific remediation guidance.
* QKView and iHealth: A QKView file is a comprehensive diagnostic snapshot of the BIG-IP system.
When this file is uploaded to the F5 iHealth portal, it is automatically parsed against a database of known issues and security advisories.
* Vulnerability Diagnosis: The iHealth platform includes automated checks specifically designed to surface security gaps and "Heuristics" that match the system's current configuration and software version to known CVEs (Common Vulnerabilities and Exposures).
* Remediation Guidance: For every identified vulnerability, iHealth provides direct links to the relevant F5 Security Advisory (K-article), which contains detailed remediation steps, such as specific software versions that contain a fix or temporary mitigation commands.
* UCS vs. QKView: While a UCS (User Configuration Set) file is a backup of the system configuration, it is not the format used by the iHealth diagnostic engine for automated vulnerability scanning; the QKView is the required format for this process.
NEW QUESTION # 40
A BIG-IP Administrator uses backend servers to host multiple services per server. There are multiple virtual servers and pools defined, referencing the same backend servers. Which load balancing algorithm is most appropriate to have an equal number of connections on each backend server?17
- A. Predictive (member)
- B. Least Connections (member)
- C. Predictive (node)
- D. Least Connections (node)
Answer: D
Explanation:
Comprehensive and Detailed Explanation From BIG-IP Administration Support and Troubleshooting documents: When load balancing is not working as 23expected and connections appear skewed across physical hardware, the administrator must distinguish between "member"24 and "node" level balancing. A
"member" refers to a specific IP and Port combination (e.g., 10.1.1.1:80), whereas a "node" refers to the underlying IP address (10.1.1.1) regardless of the port25. If a single server hosts multiple services (Web, FTP, API) across different pools, using "Least Connections (member)" would only balance connections within each individual pool26. This could lead to a scenario where one server is overwhelmed because it is winning the
"least connections" count in three different pools simultaneously. By selecting "Least Connections (node)," the BIG-IP tracks the total number of concurrent connections to the physical IP address across all pools it belongs to27. This ensures that the administrator can maintain an equal distribution of work across the hardware, preventing performance degradation on backend servers that host multiple application services.
NEW QUESTION # 41
A BIG-IP Administrator uses backend servers to host multiple services per server. There are multiple virtual servers and pools defined, referencing the same backend servers. Which load balancing algorithm is most appropriate to have an equal number of connections on each backend server?17
- A. Predictive (member)
- B. Least Connections (member)
- C. Predictive (node)
- D. Least Connections (node)
Answer: D
Explanation:
Comprehensive and Detailed Explanation From BIG-IP Administration Support and Troubleshooting documents: When load balancing is not working as 23expected and connections appear skewed across physical hardware, the administrator must distinguish between "member"24 and "node" level balancing. A "member" refers to a specific IP and Port combination (e.g., 10.1.1.1:80), whereas a "node" refers to the underlying IP address (10.1.1.1) regardless of the port25. If a single server hosts multiple services (Web, FTP, API) across different pools, using "Least Connections (member)" would only balance connections within each individual pool26. This could lead to a scenario where one server is overwhelmed because it is winning the "least connections" count in three different pools simultaneously. By selecting "Least Connections (node)," the BIG-IP tracks the total number of concurrent connections to the physical IP address across all pools it belongs to27. This ensures that the administrator can maintain an equal distribution of work across the hardware, preventing performance degradation on backend servers that host multiple application services.
NEW QUESTION # 42
A BIG-IP Administrator configured the following virtual server to pass traffic on all addresses and ports. After configuration is completed, the BIG-IP Administrator notices that the virtual server is unable to pass traffic.
Plaintext
ltm virtual forwarding_any_vs {
destination 0.0.0.0:any
ip-forward
mask 255.255.255.255
profiles {
fastL4 {}
}
serverssl-use-sni disabled
source 0.0.0.0/0
translate-address disabled
translate-port disabled
}
Which part of the configuration is the cause of the issue?
- A. Incorrect mask 255.255.255.255
- B. Incorrect translate-address configured
- C. Incorrect destination configured
Answer: A
Explanation:
The failure of the Forwarding (IP) virtual server is caused by an incorrect Network Mask configuration for a wildcard destination.
Wildcard Destination: The administrator intends to create a "Wildcard" Virtual Server that listens for any destination IP address (0.0.0.0).
The Mask Conflict: A mask of 255.255.255.255 (or /32) tells the BIG-IP to look for a specific, single host address. When combined with 0.0.0.0, the system is literally looking for traffic destined for the IP 0.0.0.0, which is not a valid routable destination for standard traffic.
Correct Configuration: To allow the virtual server to catch traffic for any IP address, the mask must be changed to 0.0.0.0 (or /0). This signifies that the system should ignore all bits of the destination address and match everything.
Forwarding Logic: The rest of the configuration-including ip-forward (Forwarding IP type), translate-address disabled, and translate-port disabled-is correct for a BIG-IP acting as a router/gateway.
NEW QUESTION # 43
A BIG-IP device sends out the following SNMP trap: big-ipo.f5.com - bigipExternalLinkChange Link: 1.0 is DOWN. Where in the BIG-IP Configuration utility should the BIG-IP Administrator verify the current status of Link 1.0?
- A. Network > Interfaces > Interface List
- B. Network > Trunks > Trunk List
- C. System > Platform
- D. Statistics > Performance > System
Answer: A
Explanation:
Comprehensive and Detailed Explanation From BIG-IP Administration Support and Troubleshooting documents: Identifying network-level performance issues often starts with investigating hardware-level alerts78. In F5 terminology, a "Link" like "1.0" or "1.1" refers to a physical interface on the appliance79. When an SNMP trap reports that a link is "DOWN," it indicates a loss of signal or an administrative shutdown of the physical port80. To verify this, the administrator must navigate to Network > Interfaces > Interface List81. This screen provides real-time status, showing whether the interface is "up," "down," or "uninitialized," as well as any media speed or duplex mismatches that could be causing performance degradation82. Troubleshooting this is the first step in resolving "pool member down" or "VLAN failsafe" issues, as a down interface will take down any VLANs associated with it, immediately halting all traffic flow for the services relying on that physical path.
NEW QUESTION # 44
A BIG-IP Administrator observes the following pool member status message:
Pool /Common/testpool member /Common/10.120.0.5:8090 monitor status down
[/Common/http: up, /Common/http2: down; last error:]
Why is this pool member being marked down? (Choose one answer)
- A. The pool member is currently only serving UDP traffic.
- B. The pool member is currently only serving HTTP traffic.
- C. The pool member is currently only serving TCP traffic.
- D. The pool member is currently only serving HTTPS traffic.
Answer: B
Explanation:
The pool member is marked DOWN because it is monitored by multiple health monitors, specifically an HTTP monitor and an HTTP/2 monitor. The status message clearly shows that the HTTP monitor is UP, while the HTTP/2 monitor is DOWN. In BIG-IP, when multiple monitors are assigned to a pool member, the default behavior is AND logic, meaning all assigned monitors must succeed for the pool member to be considered healthy.
In this scenario, the server is responding successfully to standard HTTP (likely HTTP/1.1) requests but does not support or respond correctly to HTTP/2 requests. As a result, the HTTP/2 monitor fails, which causes the overall monitor status to be DOWN, even though HTTP traffic itself is working.
This behavior is expected and documented in BIG-IP monitoring logic. Unless the monitor rule is explicitly changed to "at least one of", a single failing monitor will mark the pool member down. Therefore, the correct conclusion is that the pool member is only serving HTTP traffic, not HTTP/2.
The resolution would be to either remove the HTTP/2 monitor, correct the application to support HTTP/2, or adjust the monitor rule to match the intended health-check logic.
NEW QUESTION # 45
During a high-demand traffic event, the BIG-IP Administrator needs to limit the number of new connections per second allowed to a Virtual Server. What should the administrator apply to accomplish this task?
- A. An HTTP Compression profile to the Virtual Server
- B. A OneConnect profile to the Virtual Server
- C. A connection limit to the Virtual Server
- D. A connection rate limit to the Virtual Server
Answer: D
Explanation:
F5 BIG-IP provides two distinct ways to throttle traffic on a Virtual Server: total capacity and velocity.
* Connection Rate Limit: This setting specifically controls the number of new connection attempts per second. It is the correct tool for managing traffic spikes and protecting backend resources from being overwhelmed by a high frequency of new requests.
* Comparison (Connection Limit): A standard Connection Limit (Option C) restricts the total concurrent connections allowed at any one time, regardless of how fast they arrive.
* Other Profiles: OneConnect (Option A) is used for connection pooling and reuse to reduce server-side load, and HTTP Compression (Option B) reduces bandwidth usage but does not limit connection counts or rates.
NEW QUESTION # 46
Without decrypting, what portion of an HTTPS session is visible with a packet capture?
- A. HTTP Request Headers
- B. Cookies
- C. HTTP Response Headers
- D. Source IP Address
Answer: D
Explanation:
When analyzing HTTPS traffic using tools like tcpdump without access to the SSL private keys for decryption, only the Layer 2 through Layer 4 information remains visible.
* Visible Information: You can see the Source and Destination IP addresses, TCP ports, and the TLS handshake headers (such as the Server Name Indication/SNI in the Client Hello).
* Encrypted Information: Once the encrypted tunnel is established, all Layer 7 data is masked. This includes HTTP Request/Response Headers (Option A and D) and Cookies (Option C).
* Troubleshooting Note: To see the headers or cookies, an administrator must either perform the packet capture on the "server-side" of the BIG-IP (if it is performing SSL Offload) or use a tool like Wireshark with the appropriate SSL keys loaded.
NEW QUESTION # 47
Clients report that they cannot reach the virtual server vs-production on port 80, but are able to ping the virtual server address. The configuration is shown below:
Plaintext
ltm virtual vs-production {
destination 10.99.20.50:http
ip-protocol tcp
mask 255.255.255.255
profiles {
http {}
tcp {}
}
source 192.168.0.0/16
translate-address enabled
translate-port enabled
vlans {
external
}
vlans-enabled
}
What is the cause?
- A. The client uses an old browser.
- B. The client comes from an unallowed subnet.
- C. The virtual server is disabled.
- D. The virtual server does NOT listen on port 80.
Answer: B
Explanation:
The issue is caused by the Source Address restriction configured on the virtual server.
Source Filter: The configuration contains the line source 192.168.0.0/16. This acts as an implicit Access Control List (ACL). The virtual server will only accept and process TCP connections if the client's source IP address falls within the 192.168.x.x range.
Why Ping Works: ICMP (Ping) is handled by the Virtual Address object, not the Virtual Server object. Unless ICMP is specifically disabled on the Virtual Address, it will respond to pings from any subnet, even if the Virtual Server itself is restricted by a source filter or is even disabled.
Evaluation of Other Options:
Disabled (Option A): If the VS were disabled, the configuration would typically show disabled or state down, and the symptoms would be similar, but the source filter is a more specific "misconfiguration" in this context.
Port 80 (Option C): The configuration destination 10.99.20.50:http explicitly confirms it is listening on port 80.
Unallowed Subnet: If a client from a different network (e.g., 10.10.1.5) tries to connect, the BIG-IP will silently drop the connection or send a reset because it does not match the defined source criteria.
NEW QUESTION # 48
What is the initial status of a device that has been added to Panorama but has not yet established a connection?
- A. Offline (Enabled)
- B. Available (Disabled)
- C. Available (Enabled)
- D. Offline (Disabled)
Answer: D
Explanation:
The "Manual Resume" feature is a safety mechanism used when a pool is not working as expected due to flapping services or unstable backend applications. Normally, when a health monitor fails, the pool member is marked "Offline" (Red), and when the monitor passes, it automatically returns to "Available" (Green)47.
However, if "Manual Resume" is enabled, the BIG-IP will not automatically put the member back into rotation after a failure48. Even if the health check begins to pass again, the member remains in an "Offline (Disabled)" state49. This requires an administrator to manually intervene and re-enable the member. This is a common point of confusion when troubleshooting; a member may show passing health checks but still not receive traffic because it is waiting for a manual administrative "resume" command. This feature is intended to prevent "unhealthy" servers from receiving traffic until an engineer has confirmed the root cause of the initial failure was resolved.
NEW QUESTION # 49
Which Virtual Server type prevents the use of a default pool?
- A. Standard
- B. Performance (Layer 4)
- C. Performance HTTP
- D. Forwarding (IP)
Answer: D
Explanation:
In BIG-IP TMOS administration, the "Forwarding (IP)" virtual server type is unique because it is designed to act as a high-performance router rather than a typical load balancer. Unlike a "Standard" virtual server, which terminates a connection and directs it to a specific pool of members, a Forwarding (IP) virtual server is intended to forward packets based on the system's routing table. Consequently, the configuration for this type of virtual server explicitly removes the option to associate a default pool. If an administrator is troubleshooting a scenario where they cannot assign a pool to a virtual server, they must verify if the type was accidentally set to Forwarding (IP). This type is most commonly used for outbound internet traffic (outbound SNAT) or to allow the BIG-IP to serve as a gateway between internal subnets. Identifying this constraint is vital for troubleshooting configuration errors where an administrator expects the system to load balance traffic but finds the pool association settings are grayed out or unavailable in the Configuration Utility.
NEW QUESTION # 50
A BIG-IP Administrator configured a virtual server with a pool of 3 members and selected the Round Robin load balancing method to evenly distribute traffic across the pool members. During initial testing, the virtual server failed to respond to http requests.
Plaintext
ltm virtual http.vs {
destination 10.10.1.100:http
ip-protocol tcp
mask 255.255.255.255
pool http.pool
profiles {
tcp{}
}
serverssl-use-sni disabled
source 0.0.0.0/0
translate-address enabled
translate-port enabled
}
ltm pool http_pool {
members {
10.10.1.101:http {
address 10.10.1.101
session monitor-enabled
state checking
}
10.10.1.102:http {
address 10.10.1.102
session monitor-enabled
state checking
}
}
monitor tcp
}
What configuration change on the BIG-IP will resolve this issue?
- A. Add SNAT Auto Map
- B. Add http profile
- C. Add http monitor
Answer: A
Explanation:
The issue described is a classic case of asymmetric routing in a "one-arm" or same-subnet topology.
Symptom Analysis: The Virtual Server (10.10.1.100) and the pool members (10.10.1.101 and 10.10.1.102) are on the same subnet.
The Problem: When a client sends a request to the VIP, the BIG-IP translates the destination IP but keeps the client's original source IP. The server receives the packet and sees a source IP from a different subnet. Instead of sending the response back to the BIG-IP, the server sends it directly to its default gateway. The client receives a response from the server's IP, which it doesn't recognize, causing the connection to fail.
The Solution: Enabling SNAT Auto Map ensures the BIG-IP changes the source IP of the packet to its own self-IP. This forces the pool member to send the response back to the BIG-IP, which then translates it correctly and sends it to the client.
Incorrect Options: Adding an HTTP profile (Option B) or an HTTP monitor (Option C) would enhance the configuration but would not fix the underlying Layer 3 routing issue causing the traffic drop.
NEW QUESTION # 51
A BIG-IP Administrator makes a configuration change to the BIG-IP device. Which file logs the message regarding the configuration change?
- A. /var/log/messages
- B. /var/log/user.log
- C. /var/log/secure
- D. /var/log/audit
Answer: D
Explanation:
The BIG-IP system uses the audit log to track administrative actions and configuration changes.
* Audit Logging Functionality: When a user modifies the configuration via the Configuration Utility (GUI), the Traffic Management Shell (tmsh), or iControl, the system records the event in the audit log.
This includes the name of the user who made the change, the timestamp, and the specific command or object that was modified.
* Log Location: The audit log is stored at /var/log/audit.
* Evaluation of Other Options:
* /var/log/messages (Option A) contains general system and kernel messages but is not the primary source for configuration change details.
* /var/log/secure (Option B) primarily logs authentication and authorization attempts (logins and logouts).
* /var/log/user.log (Option D) is a generic Linux log file for user-level applications and does not track BIG-IP LTM configuration changes.
NEW QUESTION # 52
Which file should the BIG-IP Administrator check to determine when a Virtual Server changed its status from RED to GREEN?
- A. /var/log/lastlog
- B. /var/log/audit
- C. /var/log/monitors
- D. /var/log/ltm
Answer: D
Explanation:
Status changes for local traffic objects (Virtual Servers, Pools, Nodes) are recorded in the Local Traffic Manager (LTM) log.
* Health State Logging: When a health monitor marks a resource as available (Green) or unavailable (Red), the system generates a log message in /var/log/ltm.
* Log Entry Example: A transition from Red to Green will appear as a message similar to: 01010027:3:
Pool /Common/my_pool member /Common/10.0.0.1:80 monitor status up.
* Evaluation of Other Options:
* /var/log/audit (Option A) logs who changed a configuration, not automated state changes from health monitors.
* /var/log/lastlog (Option C) is a standard Linux file that tracks the last login time of users.
* /var/log/monitors (Option D) is not a standard log file on the BIG-IP system.
NEW QUESTION # 53
A user needs to determine known security vulnerabilities on an existing BIG-IP appliance and how to remediate these vulnerabilities. Which action should the BIG-IP Administrator recommend?
- A. Generate a qkview and upload to iHealth
- B. Verify the TMOS version and review the release notes
- C. Create a UCS archive and upload to iHealth
- D. Create a UCS archive and open an F5 Support request
Answer: A
NEW QUESTION # 54
The BIG-IP Administrator is investigating disk utilization on the BIG-IP device. (Exhibit shows /dev/md4 mounted on / at 100% utilization). What should the BIG-IP Administrator check next?
- A. Results from the platform diagnostics test
- B. Large files on the / file system
- C. Large files on /usr file system
- D. Results from the EUD test
Answer: B
Explanation:
Monitoring resource utilization is essential for maintaining system stability. If the root (/) file system reaches 100% capacity, the BIG-IP may become unresponsive, fail to save configuration changes, or experience daemon crashes83. When the / partition is full, the immediate troubleshooting step is to identify large or unnecessary files-such as old log files, core dumps, or temporary installer files-located specifically within that file system84. In the provided exhibit, /dev/md4 is explicitly listed at 100% usage for the / mount point85. Checking other partitions like /usr (which is at 82% in the exhibit) would not resolve the immediate "Full" status of the root directory86. Administrators often use the du (disk usage) command via the CLI to find the problematic files. Managing disk space is a proactive task; however, when utilization hits 100%, it becomes a reactive troubleshooting emergency that must be resolved to restore the management plane's functionality.
NEW QUESTION # 55
A BIG-IP Administrator adds new Pool Members into an existing, highly utilized pool. Soon after, there are reports that the application is failing to load for some users. What pool level setting should the BIG-IP Administrator check?
- A. Action On Service Down
- B. Allow SNAT
- C. Slow Ramp Time
- D. Availability Requirement
Answer: C
Explanation:
When troubleshooting a pool that is not working correctly after adding new members, the "Slow Ramp Time" setting is a primary suspect. In a pool that is already under high load and using a "Least Connections" load balancing method, a newly added server has zero connections. Without a slow ramp time, the BIG-IP will immediately direct a massive flood of new connections to the new server to "balance" it with the others. This "thundering herd" effect can crash a newly initialized application server before it has time to warm up its caches or establish its own database connections. By setting a "Slow Ramp Time" (typically in seconds), the administrator ensures the BIG-IP gradually increases the connection ratio to the new member. This allows the server to stabilize and scale up its performance over time. If users report intermittent failures specifically coinciding with the expansion of a pool, checking this setting is a vital troubleshooting step to maintain pool health during maintenance.
NEW QUESTION # 56
......
Latest 100% Passing Guarantee - Brilliant F5CAB5 Exam Questions PDF: https://www.briandumpsprep.com/F5CAB5-prep-exam-braindumps.html
Practice Examples and Dumps & Tips for 2026 Latest F5CAB5 Valid Tests Dumps: https://drive.google.com/open?id=1BoWqNRJGKOhEM70o54yss6SaeG8sxf-Y
