F5CAB3 Exam dumps PDF | Exam-Dumps.net (Page: 1)

QUESTION: 1

Refer to the exhibit.

DNS queries from two internal DNS servers are being load-balanced to external DNS servers via a virtual server on a BIG-IP device. The DNS queries originate from:

192.168.10.100
192.168.10.200

and target:

192.168.2.150

All DNS queries destined for the external DNS servers fail.

Which property change should the BIG-IP Administrator make in the Virtual Server to resolve this issue? (Choose one answer)

Protocol profile (Client) to DNS_OPTIMIZED
Type to Performance (HTTP)
Source Address to 192.168.10.0/24
Protocol to UDP

Answer(s): D

Explanation:

DNS traffic is primarily transported using UDP port 53. In the exhibit, the Virtual Server is configured with the Protocol set to TCP, which prevents standard DNS queries from being processed correctly. BIG-IP Virtual Servers must be configured with the correct Layer 4 protocol to match the application traffic they are handling.

According to the BIG-IP Administration: Data Plane Configuration documentation:

The Protocol setting on a Virtual Server defines whether traffic is processed as TCP, UDP, or another supported transport protocol.

Standard DNS queries and responses use UDP, while TCP is only required for DNS zone transfers (AXFR) or exceptionally large responses.

When a DNS Virtual Server is incorrectly configured with TCP, UDP-based DNS queries are dropped, causing all requests to fail.

Why the other options are incorrect:

A . Protocol profile (Client) to DNS_OPTIMIZED
A DNS profile enhances DNS functionality but does not correct an incorrect transport protocol configuration.

B . Type to Performance (HTTP)
Performance (HTTP) Virtual Servers are designed for HTTP traffic and are not suitable for DNS services.

C . Source Address to 192.168.10.0/24
The existing source IPs already fall within the allowed range, so this setting does not address the failure.

Correct Resolution:
Changing the Protocol to UDP aligns the Virtual Server with standard DNS transport requirements, allowing DNS queries to be successfully processed and load-balanced.

Reveal Solution Next Question

QUESTION: 2

A BIG-IP Administrator finds the following log entry after a report of user issues connecting to a virtual server:

01010201: Intercept exhaustion on 10.70.110.112 to 192.28.123.250:80 (proto 6)

How should the BIG-IP Administrator modify the SNAT pool that is associated with the virtual server? (Choose one answer)

Increase the timeout of the SNAT addresses
Remove the SNAT pool and apply SNAT Automap
Remove an IP address from the SNAT pool
Add an IP address to the SNAT pool

Answer(s): D

Explanation:

The log message "Intercept exhaustion" indicates that the BIG-IP system has exhausted the available source port translations for one or more SNAT addresses. This occurs when too many concurrent client connections are being translated through a limited number of SNAT IP addresses, and all ephemeral source ports (typically ~64,000 per SNAT IP) are in use.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Each SNAT IP address provides a finite number of available source ports.

When the number of concurrent connections exceeds the available port space, the BIG-IP logs an Intercept exhaustion error and new connections fail.

The recommended resolution is to increase the available SNAT resources by adding additional IP addresses to the SNAT pool.

Why the other options are incorrect:

A . Increase the timeout of the SNAT addresses

Increasing timeouts may actually worsen the problem by keeping ports allocated longer, accelerating port exhaustion.

B . Remove the SNAT pool and apply SNAT Automap

SNAT Automap uses the Self IP addresses on the egress VLAN, which may not provide additional capacity and can introduce routing or design issues. This is not a direct or recommended fix for SNAT exhaustion.

C . Remove an IP address from the SNAT pool

This would reduce the number of available source ports and further exacerbate the intercept exhaustion condition.

Correct Resolution:

By adding an IP address to the SNAT pool, the BIG-IP increases the total number of available source ports, alleviating intercept exhaustion and restoring successful client connections.

Reveal Solution Next Question

QUESTION: 3

A BIG-IP Administrator uses backend servers to host multiple services per server. There are multiple virtual servers and pools defined, referencing the same backend servers.

Which load balancing algorithm is most appropriate to have an equal number of connections on each backend server? (Choose one answer)

Least Connections (node)
Predictive (member)
Least Connections (member)
Predictive (node)

Answer(s): A

Explanation:

In this scenario, each backend node (server) hosts multiple services and is referenced by multiple pools and virtual servers. The goal is to ensure an equal number of total connections per backend server, regardless of how many pool members (services/ports) exist on that server.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Least Connections (node) tracks the total number of active connections to a node across all pool members and services.

This algorithm ensures load distribution is balanced at the server level, not just at the individual service (member) level.

It is specifically recommended when:

Multiple pool members exist on the same backend server

Multiple virtual servers reference the same backend servers

Why the other options are incorrect:

B . Predictive (member)

Predictive algorithms are advanced and traffic-pattern based, but they operate at the member level and do not guarantee equal connections per server.

C . Least Connections (member)

This balances connections per pool member, which can overload a server hosting multiple members while still appearing "balanced" per member.

D . Predictive (node)

Although node-aware, predictive algorithms are less deterministic and not the best choice when strict equality of connections is required.

Correct Resolution:

Using Least Connections (node) ensures that each backend server carries an equal connection load across all services and pools.

Reveal Solution Next Question

QUESTION: 4

The BIG-IP Administrator is investigating whether better TCP performance is possible for a virtual server.

Which built-in profile should be tried first? (Choose one answer)

f5-tcp-legacy
f5-tcp-progressive
f5-tcp-mobile
No option

Answer(s): B

Explanation:

BIG-IP provides several built-in TCP profiles optimized for different traffic patterns and network conditions.
When attempting to improve general TCP performance, the recommended starting point is f5-tcp-progressive.

According to the BIG-IP Administration: Data Plane Configuration documentation:

f5-tcp-progressive is designed as a balanced, general-purpose TCP optimization profile.

It dynamically adjusts TCP behavior to improve throughput and latency for most enterprise applications.

It is the recommended first-choice profile when tuning TCP performance before moving to more specialized profiles.

Why the other options are incorrect:

A . f5-tcp-legacy

This profile exists for backward compatibility and does not include modern TCP optimizations.

C . f5-tcp-mobile

This profile is optimized specifically for high-latency, lossy mobile networks and is not suitable for general-purpose environments.

D . No option

BIG-IP explicitly provides built-in TCP profiles for performance tuning; using none would forgo optimization opportunities.

Correct Resolution:

The administrator should first apply f5-tcp-progressive to evaluate potential TCP performance improvements before considering more specialized profiles.

Reveal Solution Next Question

QUESTION: 5

Refer to the exhibit.

A BIG-IP Administrator creates a new Virtual Server to load balance SSH traffic. Users are unable to log on to the servers.

What should the BIG-IP Administrator do to resolve the issue? (Choose one answer)

Set Protocol to UDP
Set Source Address to 10.1.1.2
Set Destination Address/Mask to 0.0.0.0/0
Set HTTP Profile to None

Answer(s): D

Explanation:

SSH is a Layer 4 TCP-based protocol that operates on TCP port 22 and does not use HTTP in any capacity. In the exhibit, the Virtual Server is configured with an HTTP Profile applied, which is inappropriate for SSH traffic and causes connection failures.

According to the BIG-IP Administration: Data Plane Configuration documentation:

An HTTP profile must only be applied to Virtual Servers handling HTTP or HTTPS traffic.

When an HTTP profile is attached, BIG-IP expects HTTP headers and attempts to parse application- layer data.

Non-HTTP protocols such as SSH, FTP (control), SMTP, and other raw TCP services will fail if an HTTP profile is enabled.

Why the other options are incorrect:

A . Set Protocol to UDP
SSH uses TCP, not UDP. Changing the protocol would break SSH entirely.

B . Set Source Address to 10.1.1.2
The source address setting controls client access restrictions and is unrelated to protocol parsing issues.

C . Set Destination Address/Mask to 0.0.0.0/0
The destination address is already valid for a specific SSH service and does not impact protocol handling.

Correct Resolution:
The BIG-IP Administrator should remove the HTTP Profile (set it to None) so the Virtual Server functions as a pure Layer 4 TCP service, allowing SSH connections to pass through successfully.

Reveal Solution Next Question

QUESTION: 6

The BIG-IP Administrator needs to load balance a pool of web servers. Load balancing should consider the number of connections that are active on that pool member.

Which load balancing method meets this requirement? (Choose one answer)

Least Connections (member)
Round Robin
Ratio (member)
Ratio (node)

Answer(s): A

Explanation:

The requirement states that load balancing decisions must be based on the number of active connections on each pool member. This directly maps to the Least Connections (member) load balancing method.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Least Connections (member) selects the pool member with the fewest active connections at the time of the request.

This method dynamically adapts to real-time traffic patterns and ensures that more heavily loaded pool members receive fewer new connections.

It is especially effective for web servers where connection duration may vary and equal distribution of active sessions is desired.

Why the other options are incorrect:

B . Round Robin
Distributes connections sequentially without considering current load or active connections.

C . Ratio (member)
Distributes traffic based on static ratios, not real-time connection counts.

D . Ratio (node)
Uses predefined ratios at the node level and does not account for active connection counts.

Correct Resolution:
Using Least Connections (member) ensures that new connections are directed to the pool member currently handling the fewest active connections, meeting the stated requirement.

Reveal Solution Next Question

QUESTION: 7

Refer to the exhibit.

A BIG-IP Administrator needs to configure health monitors for a newly configured server pool named Pool_B.

Which health monitor settings will ensure that all pool members will be accurately marked as available or unavailable? (Choose one answer)

HTTPS, HTTP, FTP, and SSH with the Availability Requirement of all health monitors
HTTP, HTTPS, FTP, and ICMP with the Availability Requirement of at least one health monitor
HTTPS, HTTP, FTP, and SSH with the Availability Requirement of at least one health monitor
HTTPS, HTTP, FTP, and SSH with the Availability Requirement of all health monitors

Answer(s): C

Explanation:

From the exhibit, the pool contains different applications on different service ports (for example, HTTP/80, FTP/21, HTTPS/443, SSH/22). To mark pool members correctly, BIG-IP must be able to verify the actual service running on each member's port.

In BIG-IP Administration: Data Plane Configuration, monitor behavior is described as follows:

When multiple monitors are assigned to a pool, the Availability Requirement controls how monitor results are evaluated:

At least one = the pool member is marked up if any one of the assigned monitors succeeds.

All = the pool member is marked up only if every assigned monitor succeeds.

For pools containing members with different services/ports, using All can incorrectly mark members down because monitors intended for other services will fail on the wrong port.

Why C is correct:

Assigning HTTPS, HTTP, FTP, and SSH covers the actual services shown in the pool.

Setting the Availability Requirement to at least one ensures that each pool member is considered available when its appropriate service monitor succeeds, without being forced to pass unrelated service monitors.

Why the other options are incorrect:

A / D (Availability Requirement = all): would cause members to be marked down when unrelated monitors fail (e.g., SSH monitor against an HTTP member).

B (includes ICMP): ICMP can indicate the host is reachable even if the application service is down, which does not "accurately" reflect service availability.

Therefore, the best choice is HTTPS, HTTP, FTP, and SSH with Availability Requirement of at least one health monitor.

Reveal Solution Next Question

QUESTION: 8

All pool members are online. All other virtual server settings are at default.

What might alter the load balancing behavior? (Choose one answer)

Adding a OneConnect profile
Enabling SNAT automap
Enabling a fallback host in the HTTP profile
Adding a persistence profile

Answer(s): D

Explanation:

By default, BIG-IP load balancing algorithms (such as Round Robin) distribute connections evenly across all available pool members. However, persistence profiles override normal load balancing decisions by forcing subsequent connections from a client to be sent to the same pool member.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Persistence creates a client-to-server mapping that is honored before load balancing algorithms are applied.

When persistence is enabled, BIG-IP may repeatedly select the same pool member even if others are available.

This directly alters load balancing behavior.

Why the other options are incorrect:

A . Adding a OneConnect profile

OneConnect optimizes server-side TCP connections but does not change which pool member is selected.

B . Enabling SNAT automap

SNAT affects source address translation, not pool member selection.

C . Enabling a fallback host in the HTTP profile

A fallback host is only used when no pool members are available.

Correct Resolution:

Adding a persistence profile alters load balancing behavior by maintaining client affinity to a specific pool member.

Reveal Solution Next Question

F5 F5CAB3 Exam (page: 1)
F5 BIG-IP Administration Data Plane Configuration
Updated on: 19-Feb-2026

Access free F5CAB3 actual exam questions, answers, explanations and user discussions.

QUESTION: 1

Explanation:

QUESTION: 2

Explanation:

QUESTION: 3

Explanation:

QUESTION: 4

Explanation:

QUESTION: 5

Explanation:

QUESTION: 6

Explanation:

QUESTION: 7

Explanation:

QUESTION: 8

Explanation:

F5 F5CAB3 Exam (page: 1) F5 BIG-IP Administration Data Plane Configuration Updated on: 19-Feb-2026

Access free F5CAB3 actual exam questions, answers, explanations and user discussions.

QUESTION: 1

Explanation:

QUESTION: 2

Explanation:

QUESTION: 3

Explanation:

QUESTION: 4

Explanation:

QUESTION: 5

Explanation:

QUESTION: 6

Explanation:

QUESTION: 7

Explanation:

QUESTION: 8

Explanation:

F5 F5CAB3 Exam (page: 1)
F5 BIG-IP Administration Data Plane Configuration
Updated on: 19-Feb-2026