F5 F5CAB3 BIG-IP Administration Data Plane Configuration (F5CAB3) exam Exam Practice Test

Performance (Layer 4) virtual servers rely on FastL4 profiles to provide high-speed L4 processing without full proxy overhead.

Below isBATCH 2 (next 10 questions)extractedonlyfrom your uploaded document that areclearly related toBIG-IP Administration: Data Plane Configurationtopics.

❗As requested, I havestrictly excludedquestions related to:

Licensing

HA / Device Trust / Sync-only

Logging destinations

User roles

Hardware, EUD, support processes

System-only administration

Source: Your uploadedTMOS Administration v2.0document

The log message“Intercept exhaustion”indicates that the BIG-IP system has exhausted the available source port translations for one or more SNAT addresses. This occurs when too many concurrent client connections are being translated through a limited number of SNAT IP addresses, and all ephemeral source ports (typically ~64,000 per SNAT IP) are in use.

According to theBIG-IP Administration: Data Plane Configurationdocumentation:

Each SNAT IP address provides a finite number of available source ports.

When the number of concurrent connections exceeds the available port space, the BIG-IP logs anIntercept exhaustionerror and new connections fail.

The recommended resolution is toincrease the available SNAT resourcesby adding additional IP addresses to the SNAT pool.

Why the other options are incorrect:

A. Increase the timeout of the SNAT addressesIncreasing timeouts may actually worsen the problem by keeping ports allocated longer, accelerating port exhaustion.

B. Remove the SNAT pool and apply SNAT AutomapSNAT Automap uses the Self IP addresses on the egress VLAN, which may not provide additional capacity and can introduce routing or design issues. This is not a direct or recommended fix for SNAT exhaustion.

C. Remove an IP address from the SNAT poolThis would reduce the number of available source ports and further exacerbate the intercept exhaustion condition.

Correct Resolution:

Byadding an IP address to the SNAT pool, the BIG-IP increases the total number of available source ports, alleviating intercept exhaustion and restoring successful client connections.

In BIG-IP systems,iRules influence traffic only when they are attached to a Virtual Server. If application traffic is being sent tonodes or pool members that are not defined in the pool, this typically indicates that an iRule is overriding the default load-balancing behavior by explicitly selecting a pool or node.

According toBIG-IP Administration: Data Plane Configurationand official F5 guidance:

iRules areassociated with Virtual Servers, not directly with pools or nodes.

To determine whether an iRule is actively affecting traffic, the administrator must inspect theVirtual Server configuration.

Explanation of the correct answers:

B. Via the GUI at the Resources tab for the virtual serverTheResourcestab in the Configuration Utility displays all traffic-handling objects applied to the Virtual Server, includingassigned iRules. This is the primary GUI location to verify whether an iRule is influencing data plane traffic.

C. Via TMSH with the list /ltm virtual <virtual_server> commandThis TMSH command displays the full Virtual Server configuration, including anyiRules listed under the rules section. It is the authoritative CLI method to confirm iRule usage.

Why the other options are incorrect:

A. Via TMSH with the list /ltm rule <irule> commandThis command only shows the contents of an iRule and does not indicate whether the iRule is attached to or used by any Virtual Server.

D. Via the GUI at the iRule tab for the virtual serverBIG-IP does not provide a dedicated “iRule” tab on Virtual Servers. iRules are viewed and managed under theResourcestab.

Correct Conclusion:

To verify whether an iRule is responsible for unexpected node selection, the BIG-IP Administrator must examine theVirtual Server configuration, either through theResources tab in the GUIor by usingTMSH to list the Virtual Server configuration.

Standard DNS queries use UDP. Configuring the Virtual Server for TCP causes DNS traffic to fail.

Using “at least one” ensures each member is marked up based on its relevant service monitor.

The X-Forwarded-For header preserves the original client IP when SNAT is enabled.

A red diamond indicates the Virtual Server is enabled but unavailable due to all pool members being down.

SSH is a TCP Layer 4 protocol. Applying an HTTP profile causes BIG-IP to expect HTTP headers, breaking SSH sessions. Removing the HTTP profile allows raw TCP forwarding.

The requirement states that load balancing decisions must be based on thenumber of active connections on each pool member. This directly maps to theLeast Connections (member)load balancing method.

According to theBIG-IP Administration: Data Plane Configurationdocumentation:

Least Connections (member)selects the pool member with thefewest active connectionsat the time of the request.

This method dynamically adapts to real-time traffic patterns and ensures that more heavily loaded pool members receive fewer new connections.

It is especially effective for web servers where connection duration may vary and equal distribution of active sessions is desired.

Why the other options are incorrect:

B. Round RobinDistributes connections sequentially without considering current load or active connections.

C. Ratio (member)Distributes traffic based on static ratios, not real-time connection counts.

D. Ratio (node)Uses predefined ratios at the node level and does not account for active connection counts.

Correct Resolution:

UsingLeast Connections (member)ensures that new connections are directed to the pool member currently handling the fewest active connections, meeting the stated requirement.

For HTTP-based applications,cookie persistenceis the most appropriate and commonly recommended persistence method.

According to theBIG-IP Administration: Data Plane Configurationdocumentation:

Cookie persistenceinserts or uses an HTTP cookie to maintain session affinity.

It operates atLayer 7 (HTTP)and is application-aware.

It allows persistence to be maintained even when multiple clients are behind a NAT device.

Why the other options are incorrect:

A. Destination addressDestination address persistence is generally used for inbound traffic patterns such as firewall or proxy scenarios.

B. Hash persistenceHash persistence is less granular and not HTTP-specific.

C. SSL persistenceSSL persistence is typically used when SSL session IDs are reused and is less reliable than cookies for HTTP applications.

Correct Resolution:

Usingcookie persistenceensures that HTTP web requests are consistently directed to the same pool member.

Connection rate limiting controls how many new connections per second are accepted, protecting backend resources.

URI-based traffic steering requires inspection of the HTTP request. BIG-IP processes HTTP headers and URIs in theHTTP_REQUESTevent. Pool member selection based on URI must occur before the request is sent to the server, making HTTP_REQUEST the correct event.