F5 BIG-IP Administration Data Plane Concepts (F5CAB2) exam F5CAB2 Exam Dumps: Updated Questions & Answers (October 2026)

By default, when a pool member is marked " down " by a monitor, the BIG-IP system stops sending new connections to that member, but it typically allows existing connections to time out naturally (or resets them depending on profile settings).

Action on Service Down: This setting is configured at the Pool level.

Reselect: When set to Reselect , if a pool member is marked down, the BIG-IP system will immediately attempt to pick a different available pool member for any existing, active connections associated with the failed member.

Client Experience: This is used to maintain the user session by transparently moving the traffic to a healthy server without the client needing to re-establish the connection to the Virtual Server.

In BIG-IP high availability (HA) deployments, one of the primary causes of traffic disruption during failover is Layer 2 and Layer 3 relearning by upstream network devices (switches and routers). When traffic groups move from the Active device to the Standby device, the network must quickly associate the IP addresses with the new device.

Why MAC Masquerading Minimizes Failover Impact:

MAC masquerading allows a traffic group to use a floating, shared MAC address for its Self IPs. This MAC address moves with the traffic group during failover.

Key benefits:

The MAC address does not change when failover occurs

Upstream switches do not need to relearn ARP entries

Traffic resumes almost immediately after failover

Dramatically reduces packet loss and connection interruption

From BIG-IP Administration Data Plane Concepts:

MAC masquerade is specifically designed to provide fast failover

It is a best practice for HA pairs, especially in environments sensitive to latency and connection loss

Why the Other Options Are Incorrect:

A. External monitors

Used to check the availability of external resources

Do not reduce network convergence or failover disruption

B. Clone pool

Used for traffic mirroring or security analysis

Has no impact on failover behavior

C. OneConnect profile

Optimizes server-side TCP connections

Does not address ARP or MAC relearning during failover

Key HA Concept Reinforced:

To minimize failover impact on live traffic, BIG-IP administrators should ensure Layer 2 continuity . MAC masquerading is the primary mechanism that enables near-instant failover by preventing ARP and MAC table reconvergence delays.

===========

On BIG-IP systems, physical interface bandwidth is fixed by the link speed (for example, 1GbE or 10GbE). When traffic demand exceeds the capacity of a single interface, BIG-IP provides link aggregation through trunks .

Key concepts involved:

Interfaces A single physical interface (such as 1.1) is limited to its negotiated link speed. You cannot exceed this capacity through software tuning alone.

Trunks (Link Aggregation) A trunk combines multiple physical interfaces into a single logical interface.

BIG-IP supports LACP and static trunks.

Traffic is distributed across member interfaces, increasing aggregate bandwidth and providing redundancy .

VLANs are then assigned to the trunk , not directly to individual interfaces.

Why option B is correct:

Creating a trunk with two interfaces allows BIG-IP to use both physical links simultaneously.

This increases total available bandwidth (for example, two 10Gb interfaces → up to 20Gb aggregate capacity).

This is the documented and supported method for scaling bandwidth on BIG-IP.

Why the other options are incorrect:

A. Increase the MTU MTU changes affect packet size and efficiency, not total bandwidth capacity .

C. Assign two interfaces to the VLAN BIG-IP does not support assigning a VLAN to multiple interfaces directly. VLANs must be associated with one interface or one trunk .

D. Set the media speed manually Media speed can only be set up to the physical capability of the interface and connected switch port. It cannot exceed the hardware limit.

Conclusion:

To increase total available bandwidth on BIG-IP when a single interface is insufficient, the administrator must create a trunk object with multiple interfaces and move the VLAN onto the trunk. This aligns directly with BIG-IP data plane design and best practices.

In the BIG-IP system object hierarchy, health monitors can be applied at three levels: Node , Pool , and Pool Member .

Pool Level (Properties): Applying a monitor at the Pool > Properties level is the most common and efficient administrative practice. When applied here, the monitor is inherited by all members of that pool. If the monitor fails for a specific member, that member is marked " down " specifically for that pool.

Node Level: If a monitor is applied at the Node level ( Local Traffic > Nodes ), it checks the health of the physical IP address itself. If it fails, that node (and all pool members associated with it) is marked down globally across the entire system.

Member Level: Applying a monitor at the Pool > Members level allows for specific " per-member " monitoring, which is usually only done if different members in the same pool require different health checks.

The Specific Case: For a standard database pool like DB_Pool, the administrator should navigate to Local Traffic > Pools > DB_Pool > Properties and select the appropriate monitor (e.g., a custom TCP or Oracle monitor) from the " Health Monitors " configuration section.

When managing a large environment with hundreds of Virtual Servers, the most efficient way to identify the relationship between an iRule and the objects it manages is to view the properties of the iRule itself.

iRule Properties: Within the BIG-IP Configuration Utility, navigating to Local Traffic > iRules and selecting a specific iRule provides a " Statistics " or " Usage " tab (depending on the version). This view explicitly lists all Virtual Servers currently associated with that specific iRule.

Centralized Management: Instead of manually checking 235 individual Virtual Servers under the " Virtual Servers " menu, the iRules menu acts as a central point of reference for that specific logic.

Data Plane Impact: Because iRules can modify traffic flow, headers, and load balancing decisions, seeing the full list of affected Virtual Servers is critical before making adjustments to avoid unintended side effects across the application portfolio.

The configuration shown matches a Performance Layer 4 virtual server because it is explicitly using a FastL4 profile:

The screenshot shows Protocol: TCP and Protocol Profile (Client): fastL4 . In BIG-IP data plane terms, FastL4 is the hallmark of a Performance (Layer 4) virtual server, designed to process connections at Layer 4 with minimal overhead (high throughput/low latency) compared to full proxy L7 processing.

The screenshot also shows HTTP Profile (Client): None (and HTTP server profile effectively not in use). A Standard virtual server commonly uses full-proxy features and frequently includes L7 profiles (like HTTP) when doing HTTP-aware load balancing, header manipulation, cookie persistence, etc. In contrast, a Performance L4 virtual server typically does not use an HTTP profile because it is not doing HTTP-aware (Layer 7) processing.

It is not a Forwarding IP virtual server: A Forwarding (IP) virtual server is used to route/forward packets (often without load balancing to pool members in the same way as Standard/Performance VS) and is selected by choosing a forwarding type. The presence of a TCP protocol with a FastL4 client profile aligns with a Layer 4 load-balancing style virtual server, not a packet-forwarding virtual server type.

Conclusion: Because the configuration is TCP-based and explicitly uses fastL4 with no HTTP profile, the expected BIG-IP virtual server type is Performance Layer 4 (Option C) .

The BIG-IP processing flow follows a specific sequence of events as a packet moves through the system.

TCP Handshake: Before any application-layer data (like HTTP) can be processed, a TCP connection must be established.

The First Event: The very first event triggered when a client completes the 3-way handshake with the virtual server is CLIENT_ACCEPTED .

Profile Influence: Even if an HTTP profile is attached, the system must first " accept " the connection at the protocol level. HTTP_REQUEST only triggers after the client sends data that the BIG-IP recognizes as a valid HTTP request. If a client connects but never sends a request, CLIENT_ACCEPTED will have fired, but HTTP_REQUEST will not.

The behavior of a health monitor is determined by its Send String and Receive String .

Default HTTP Monitor: The pre-configured default HTTP monitor on a BIG-IP system has an empty Receive String .

Success Criteria: When the Receive String is blank, the BIG-IP system considers the health check successful if it receives any valid HTTP response from the server.

Status Code Interpretation: Because a 404 Not Found is a valid HTTP status code (it is a properly formatted response from a running web server process), the BIG-IP interprets this as the application being " alive " .

Result: All three members (including the two returning 404s and the one returning 200) will be marked as UP/Available (Green).

In a BIG-IP device service cluster , configuration objects such as virtual servers, pools, profiles, and iRules are maintained through configuration synchronization (config-sync) .

Key BIG-IP concepts involved:

Device Service Cluster (DSC) A cluster is a group of BIG-IP devices that share configuration data. One device is typically used to make changes, which are then synchronized to the rest of the group.

Config-Sync Direction Matters

Changes are made on a local device

Those changes must be pushed to the group

The correct operation is “Sync Device to Group”

Why C is correct:

The virtual server was created only on device 1

Other devices in the cluster do not yet have this object

To propagate the new virtual server to all cluster members, the administrator must synchronize device 1 to the group

Why the other options are incorrect:

A. Synchronize the settings of the group to device 1 This would overwrite device 1’s configuration with the group’s existing configuration and may remove the newly created virtual server .

B. Create a new cluster on device 1 The cluster already exists. Creating a new cluster is unnecessary and disruptive.

D. Create a new virtual server on device 2 This defeats the purpose of centralized configuration management and risks configuration drift.

Conclusion:

After creating a new virtual server on a BIG-IP device that is part of a cluster, the administrator must synchronize the configuration from that device to the group so all devices share the same ADC application objects.

With Least Connections (member) , BIG-IP attempts to send new connections to the pool member with the fewest current connections. In a perfectly “stateless” scenario (no affinity), this often trends toward a fairly even distribution over time.

However, persistence overrides load balancing :

When a persistence profile is applied, BIG-IP will continue sending a client (or client group) to the same pool member based on the persistence record (cookie / source address / SSL session ID, etc.).

This means even if another pool member has fewer connections, BIG-IP may still select the persisted member to honor session affinity.

The result can be uneven active connection counts , even though the configured load balancing method is Least Connections.

Why the other options are not the best cause:

A. Priority Group Activation is disabled Priority Group Activation only affects selection when priority groups are configured; disabling it does not inherently create uneven distribution under Least Connections.

B. SSL Profile Server is applied A server-side SSL profile affects encryption to pool members, but it does not by itself cause skewed selection across pool members. (Skew could happen indirectly if members have different performance/latency, but that’s not the primary, expected exam answer.)

D. Incorrect load balancing method Least Connections is a valid method and does not itself explain unevenness unless something is overriding it (like persistence) or pool members are not all eligible.

Conclusion:

A persistence profile is the most common and expected reason that active connections become unevenly distributed , because persistence takes precedence over the Least Connections load-balancing decision.