Practice Free F5CAB5 BIG-IP Administration Support and Troubleshooting (F5CAB5) exam Exam Questions Answers With Explanation

Troubleshooting failed SSL handshakes involves interpreting the resource limits defined by the system's license8888. The log message SSL transaction (TPS) rate limit reached indicates the BIG-IP is dropping SSL connections because it has exceeded its licensed "Transactions Per Second" capacity. When analyzing stats to determine the correct license level, the administrator must focus on "Client-side" SSL TPS. This represents the initial encrypted handshakes between users and the BIG-IP virtual servers91. In this scenario, the peak client-side demand is 1200 TPS. While the 800 server-side transactions represent re-encryption toward the backend, F5's primary SSL TPS license limits typically apply to the client-facing side of the traffic flow. Therefore, to resolve the intermittent connectivity issues and ensure the virtual server works reliably during peaks, the license must be upgraded to at least 1200 TPS949596969696.9798Confirming this peak via statistics andcomparing it to the current license is a standard troubleshooting step for SSL performance issues.

Monitoring granular resource utilization is essential when troubleshooting performance degradation for specific applications. While global system stats show overall hardware health, they do not pinpoint which virtual server is overconsuming resources during traffic spikes. To identify the specific application causing a high CPU load, the administrator should navigate to Statistics > Module Statistics > Local Traffic > Virtual Servers7474. This section provides detailed metrics for each virtual server, including CPU cycles used for traffic processing and iRule execution75. Identifying a "top-talker" or a problematic virtual server allows the administrator to take targeted action, such as optimizing an inefficient iRule, adjusting compression levels, or offloading the virtual server to a different device group76. This targeted troubleshooting ensures that one high-demand virtual server does not negatively impact the performance of other services running on the same BIG-IP hardware, maintaining overall system stability and resource availability

In an HTTPS session, the application-layer payload—including HTTP request headers, response headers, cookies, and body content—is encrypted using SSL/TLS. Without decrypting the traffic (for example, without SSL offloading on BIG-IP or access to the private keys), a packet capture cannot reveal any HTTP-level details.

However,network-layer and transport-layer information remains visible, even when encryption is used. This includes source and destination IP addresses, source and destination ports, TCP flags, sequence numbers, and TLS handshake metadata. Therefore, thesource IP address (Option B)is visible in a packet capture of HTTPS traffic without decryption.

Options A, C, and D are incorrect because HTTP headers and cookies are part of the encrypted payload once HTTPS is established. BIG-IP troubleshooting documentation emphasizes this distinction when analyzing encrypted traffic flows using tcpdump, as administrators must rely on IP, port, and timing information unless SSL inspection or decryption is configured.

F5 recommends using the iHealth diagnostic tool to identify security vulnerabilities and receive specific remediation guidance.

QKView and iHealth: A QKView file is a comprehensive diagnostic snapshot of the BIG-IP system. When this file is uploaded to the F5 iHealth portal, it is automatically parsed against a database of known issues and security advisories.

Vulnerability Diagnosis: The iHealth platform includes automated checks specifically designed to surface security gaps and "Heuristics" that match the system's current configuration and software version to known CVEs (Common Vulnerabilities and Exposures).

Remediation Guidance: For every identified vulnerability, iHealth provides direct links to the relevant F5 Security Advisory (K-article), which contains detailed remediation steps, such as specific software versions that contain a fix or temporary mitigation commands.

UCS vs. QKView: While a UCS (User Configuration Set) file is a backup of the system configuration, it is not the format used by the iHealth diagnostic engine for automated vulnerability scanning; the QKView is the required format for this process.

When load balancing is not working as expected across hardware hosting multiple services, the administrator must distinguish between "member" and "node" level algorithms102102102102. A "member" is a specific IP and port (e.g., 10.1.1.1:80), while a "node" is the physical server's IP (10.1.1.1) regardless of the port103. If servers host both FTP and HTTP services in separate pools, using "Least Connections (Member)" only balances connections within each individual pool. This can lead to a skewed distribution where one server is selected for a new HTTP connection because it has the fewest HTTP connections, even if it is currently overloaded with hundreds of FTP connections. By applying "Least Connections (Node)," the BIG-IP tracks the total number of connections to the physical hardware across all ports and pools106106106106. This ensures that the administrator can maintain an even distribution of the total workload across the server fleet, resolving the reports of uneven traffic distribution reported by the server support team

Comprehensive and Detailed Explanation From BIG-IP Administration S73upport and Troubleshooting documents: Persistence is critical for ensuring that a client's session remains with the same pool member throughout its duration. If primary persistence (like Cookie Persistence) fails—for instance, because the client has disabled cookies—load balancing will not work as expected, and the session may be broken. A "Fallback Persistence Profile" provides a backup method75. The most common and reliable fallback method is "Source Address Affinity"76. This method tracks the client's IP address in the BIG-IP's persistence table and ensures that any subsequent requests from that IP are routed to the same pool member, even if the primary persistence token is missing. Troubleshooting session drops often involves checking if a fallback method is configured to handle scenarios where the primary method is unsupported by the client's browser or environment. Without a fallback, the BIG-IP would revert to standard load balancing, potentially sending the client to a different server that lacks their session data.

The BIG-IP architecture is divided into two distinct planes: the Control Plane (Management) and the Data Plane (Traffic Management Microkernel - TMM).

Data Plane (TMM): This plane is responsible for the actual processing of application traffic, including load balancing, SSL offloading, and session management for modules like APM (Access Policy Manager). If data plane resources (CPU/Memory allocated to TMM) are exhausted, active user sessions and traffic throughput are directly degraded.

APM Sessions: Because APM sessions are managed within the TMM process to ensure high-speed access control and tunneling, they are a primary "Data Plane" function.

Control Plane Functions: Options A, B, and D (MCPD, Configuration Utility/GUI, and iControl) all reside in the Control Plane (running on the Linux host OS). While a total system hang affects both, a specific "data plane resource issue" is designed to isolate and impact the traffic-handling services like APM while the management GUI might remain responsive.

The BIG-IP system uses the audit log to track administrative actions and configuration changes.

Audit Logging Functionality: When a user modifies the configuration via the Configuration Utility (GUI), the Traffic Management Shell (tmsh), or iControl, the system records the event in the audit log. This includes the name of the user who made the change, the timestamp, and the specific command or object that was modified.

Log Location: The audit log is stored at /var/log/audit.

Evaluation of Other Options:

/var/log/messages (Option A) contains general system and kernel messages but is not the primary source for configuration change details.

/var/log/secure (Option B) primarily logs authentication and authorization attempts (logins and logouts).

/var/log/user.log (Option D) is a generic Linux log file for user-level applications and does not track BIG-IP LTM configuration changes.

When troubleshooting intermittent connection resets on a "busy" Virtual Server, the administrator must examine the configured thresholds62. A "Connection Limit" is a hard cap on the number of concurrent connections a Virtual Server or pool member can handle63. If this limit is set too low, the BIG-IP will reset any new connection attempts once the threshold is reached64. The key indicator in this scenario is that the problem only affects "some users" and happens when the server is "busy," suggesting that the system is hitting a capacity ceiling rather than suffering from a persistent configuration error65. Unlike a missing SSL profile, which would likely cause all connections to fail, or a "Connection Rate Limit," which throttles how fast connections arrive, a "Connection Limit" focuses on the total volume66. Identifying this as the cause requires reviewing the Virtual Server's statistics to see if the "Current Connections" count is consistently peaking at the configured limit value.

To collect application-layer details such asHTTP status codes(200, 404, 500, etc.) andHTTP methods(GET, POST, PUT, DELETE), the BIG-IP system must use a profile designed for traffic visibility and reporting rather than basic traffic handling. TheAnalytics profile (Option C)is the correct choice because it is specifically designed to collect, store, and present detailed statistics about HTTP and TCP traffic passing through a virtual server.

When an Analytics profile is attached to a virtual server, BIG-IP can record metrics such as HTTP response codes, request methods, URI paths, latency, throughput, and client-side/server-side performance data. These statistics are then accessible through the BIG-IP GUI underStatistics ? Analytics, allowing administrators to validate application behavior and troubleshoot performance or functional issues.

TheHTTP profile (Option B)enables HTTP protocol awareness and features like header insertion and compression, but it does not provide historical or statistical reporting of HTTP methods and response codes.Request Adapt (Option A)is used for ICAP-based content adaptation, not visibility.Statistics (Option D)is not a standalone profile and does not provide HTTP-level insight.

Therefore, the Analytics profile is the only default profile that fulfills this requirement.

When load balancing is not working as 23expected and connections appear skewed across physical hardware, the administrator must distinguish between "member"24 and "node" level balancing. A "member" refers to a specific IP and Port combination (e.g., 10.1.1.1:80), whereas a "node" refers to the underlying IP address (10.1.1.1) regardless of the port25. If a single server hosts multiple services (Web, FTP, API) across different pools, using "Least Connections (member)" would only balance connections within each individual pool26. This could lead to a scenario where one server is overwhelmed because it is winning the "least connections" count in three different pools simultaneously. By selecting "Least Connections (node)," the BIG-IP tracks the total number of concurrent connections to the physical IP address across all pools it belongs to27. This ensures that the administrator can maintain an equal distribution of work across the hardware, preventing performance degradation on backend servers that host multiple application services.

According toofficial F5 documentation (K52015891 – Troubleshooting BIG-IP power supply issues),hardware-related alerts for power supplies, fans, and chassis components are logged in /var/log/ltm.

When a BIG-IP device experiences a power supply issue—such as failure, intermittent outages, or fan-related faults—the system generates alerts through internal platform monitoring services. These alerts are written to the/var/log/ltmfile and often appear with messages similar to:

Chassis power supply 2 has experienced an issue. Status is as follows: FAN=bad; STATUS=bad.

This makes /var/log/ltm theauthoritative log filefor identifying and verifying power supply and chassis-related problems on BIG-IP systems.

The other log files are not appropriate for this purpose:

/var/log/daemon.logcontains general daemon messages but isnot the primary sourcefor chassis hardware alerts.

/var/log/kern.loglogs kernel-level events, not platform power status.

/var/log/auditrecords administrative actions and configuration changes.

Conclusion:

Per F5-supported guidance, when suspecting power supply outages or chassis hardware issues, the BIG-IP Administrator shouldalways check /var/log/ltm first.

The "Manual Resume" feature is a safety mechanism used when a pool is not working as expected due to flapping services or unstable backend applications. Normally, when a health monitor fails, the pool member is marked "Offline" (Red), and when the monitor passes, it automatically returns to "Available" (Green)47. However, if "Manual Resume" is enabled, the BIG-IP will not automatically put the member back into rotation after a failure48. Even if the health check begins to pass again, the member remains in an "Offline (Disabled)" state49. This requires an administrator to manually intervene and re-enable the member. This is a common point of confusion when troubleshooting; a member may show passing health checks but still not receive traffic because it is waiting for a manual administrative "resume" command. This feature is intended to prevent "unhealthy" servers from receiving traffic until an engineer has confirmed the root cause of the initial failure was resolved.

The failure of the Forwarding (IP) virtual server is caused by an incorrect Network Mask configuration for a wildcard destination.

Wildcard Destination: The administrator intends to create a "Wildcard" Virtual Server that listens for any destination IP address (0.0.0.0).

The Mask Conflict: A mask of 255.255.255.255 (or /32) tells the BIG-IP to look for a specific, single host address. When combined with 0.0.0.0, the system is literally looking for traffic destined for the IP 0.0.0.0, which is not a valid routable destination for standard traffic.

Correct Configuration: To allow the virtual server to catch traffic for any IP address, the mask must be changed to 0.0.0.0 (or /0). This signifies that the system should ignore all bits of the destination address and match everything.

Forwarding Logic: The rest of the configuration—including ip-forward (Forwarding IP type), translate-address disabled, and translate-port disabled—is correct for a BIG-IP acting as a router/gateway.