Important F5 Networks F5CAB5 Exam Questions

Answer: D

Explanation:

Monitoring granular resource utilization is essential when troubleshooting performance degradation for specific applications. While global system stats show overall hardware health, they do not pinpoint which virtual server is overconsuming resources during traffic spikes. To identify the specific application causing a high CPU load, the administrator should navigate to Statistics > Module Statistics > Local Traffic > Virtual Servers7474. This section provides detailed metrics for each virtual server, including CPU cycles used for traffic processing and iRule execution75. Identifying a 'top-talker' or a problematic virtual server allows the administrator to take targeted action, such as optimizing an inefficient iRule, adjusting compression levels, or offloading the virtual server to a different device group76. This targeted troubleshooting ensures that one high-demand virtual server does not negatively impact the performance of other services running on the same BIG-IP hardware, maintaining overall system stability and resource availability

Answer: A, C

Explanation:

These log messages indicate that the BIG-IP system is under significant resource pressure and has activated its Adaptive Connection Management.

Global Eviction Policy: The message Aggressive mode ... activated (global memory) confirms that the system has reached a memory utilization threshold that triggers the eviction policy. This happens because TMM (the data plane) is running low on available memory pages.

Sweeper/Reaping: Once in 'Aggressive mode,' the BIG-IP 'sweeper' starts reaping (terminating) connections to free up memory. The log Connections killed confirms this is occurring.

Impact: The system does not drop all connections; it targets connections based on the eviction policy (e.g., oldest connections or those exceeding limits) to bring memory usage back to safe levels. Thus, some connections will be dropped (Option A), and the cause is TMM memory exhaustion (Option C).

Answer: C

Explanation:

To understand which device becomes active, we must look at how the BIG-IP system handles HA Order and Auto Fallback within a traffic group.

HA Order Mechanism: When a traffic group is configured with an 'HA Order' list, the system prefers to host the traffic group on the highest-ranking available device in that list (1 being the highest).

The Impact of 'Forced to Standby': BIGIP-D is the first choice in the order, but it has been 'Forced to Standby.' This state is persistent and manual; until an administrator releases the 'Force to Standby' state, the device is ineligible to host the traffic group, effectively removing it from the top of the preference list.

Auto Fallback: When 'Auto Fallback' is enabled, the traffic group will automatically migrate back to a higher-priority device in the HA order as soon as that device becomes available and is in a healthy 'Standby' state.

The Scenario Logic: 1. BIGIP-D is ineligible (Forced Offline/Standby).

2. BIGIP-B is the next highest device in the HA Order (Rank 2).

3. While BIGIP-B was rebooting, the traffic group would have failed over to BIGIP-C (Rank 3).

4. Once BIGIP-B finishes booting and joins the cluster in a 'Standby' state, the Auto Fallback setting triggers.

5. Because BIGIP-B is higher in the HA Order than the current active device (BIGIP-C) and the only device above it (BIGIP-D) is ineligible, the traffic group fails back to BIGIP-B.

Answer: B, D

Explanation:

Before upgrading a BIG-IP system to a newer TMOS version, it is critical to review known issues to avoid introducing instability or regressions.F5 Bug Tracker (Option B)is a primary resource for this purpose. It allows administrators to search for documented software defects by TMOS version, module, symptom, or bug ID. Using Bug Tracker, an administrator can identify unresolvedissues, fixed bugs, and behavioral changes that may affect their specific deployment, such as traffic handling, high availability, or module-specific functionality. This directly supports proactive troubleshooting and informed upgrade planning.

F5 iHealth (Option D)is another essential tool used during upgrade preparation. iHealth analyzes uploaded UCS or QKView files and correlates the device configuration and software version with F5's known issues database. It provides actionable reports highlighting critical defects, upgrade risks, interoperability concerns, and recommended target versions. iHealth is especially valuable because it contextualizes known issues based on the actual configuration running on the device.

The other options are not appropriate for verifying known software issues.F5 End User Diagnostics (Option A)is a client-side troubleshooting tool,F5 University (Option C)is a training platform, andF5 Downloads (Option E)is primarily used to obtain software images and release notes, not to analyze known defects in depth.

Answer: B

Explanation:

When analyzing HTTPS traffic using tools like tcpdump without access to the SSL private keys for decryption, only the Layer 2 through Layer 4 information remains visible.

Visible Information: You can see the Source and Destination IP addresses, TCP ports, and the TLS handshake headers (such as the Server Name Indication/SNI in the Client Hello).

Encrypted Information: Once the encrypted tunnel is established, all Layer 7 data is masked. This includes HTTP Request/Response Headers (Option A and D) and Cookies (Option C).

Troubleshooting Note: To see the headers or cookies, an administrator must either perform the packet capture on the 'server-side' of the BIG-IP (if it is performing SSL Offload) or use a tool like Wireshark with the appropriate SSL keys loaded.