Pass the F5-CA F5CAB3 Questions and answers with Dumpstech

URI-based traffic steering requires inspection of the HTTP request. BIG-IP processes HTTP headers and URIs in the HTTP_REQUEST event. Pool member selection based on URI must occur before the request is sent to the server, making HTTP_REQUEST the correct event.

The X-Forwarded-For header preserves the original client IP when SNAT is enabled.

For HTTP-based applications, cookie persistence is the most appropriate and commonly recommended persistence method.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Cookie persistence inserts or uses an HTTP cookie to maintain session affinity.

It operates at Layer 7 (HTTP) and is application-aware.

It allows persistence to be maintained even when multiple clients are behind a NAT device.

Why the other options are incorrect:

A. Destination addressDestination address persistence is generally used for inbound traffic patterns such as firewall or proxy scenarios.

B. Hash persistenceHash persistence is less granular and not HTTP-specific.

C. SSL persistenceSSL persistence is typically used when SSL session IDs are reused and is less reliable than cookies for HTTP applications.

Correct Resolution:

Using cookie persistence ensures that HTTP web requests are consistently directed to the same pool member.

X-Forwarded-For inserts the original client IP into HTTP headers while SNAT is enabled.

DNS traffic is primarily transported using UDP port 53. In the exhibit, the Virtual Server is configured with the Protocol set to TCP, which prevents standard DNS queries from being processed correctly. BIG-IP Virtual Servers must be configured with the correct Layer 4 protocol to match the application traffic they are handling.

According to the BIG-IP Administration: Data Plane Configuration documentation:

The Protocol setting on a Virtual Server defines whether traffic is processed as TCP, UDP, or another supported transport protocol.

Standard DNS queries and responses use UDP, while TCP is only required for DNS zone transfers (AXFR) or exceptionally large responses.

When a DNS Virtual Server is incorrectly configured with TCP, UDP-based DNS queries are dropped, causing all requests to fail.

Why the other options are incorrect:

A. Protocol profile (Client) to DNS_OPTIMIZEDA DNS profile enhances DNS functionality but does not correct an incorrect transport protocol configuration.

B. Type to Performance (HTTP)Performance (HTTP) Virtual Servers are designed for HTTP traffic and are not suitable for DNS services.

C. Source Address to 192.168.10.0/24The existing source IPs already fall within the allowed range, so this setting does not address the failure.

Correct Resolution:

Changing the Protocol to UDP aligns the Virtual Server with standard DNS transport requirements, allowing DNS queries to be successfully processed and load-balanced.

When dealing with heterogeneous server hardware where some servers are more powerful than others, a dynamic load balancing method that accounts for both current load and server capacity is required. The Weighted Least Connections (member) method is the most appropriate choice. This method works by tracking the number of active connections to each pool member and then "weighting" that number based on a user-defined Ratio value assigned to the member. For example, the administrator can assign a higher Ratio to the three newer, more powerful servers and a lower Ratio to the two older servers. The BIG-IP then uses a formula to calculate which server should receive the next connection, ensuring that the newer servers handle a proportionately larger share of the total concurrent connections.

Standard Round Robin (Option C) would be ineffective because it distributes connections strictly sequentially (1, 2, 3, 4, 5) without regard for the servers' capacity or current load, which would eventually overwhelm the older servers. Least Connections (member) (Option D) is better than Round Robin because it picks the server with the fewest active connections, but it still assumes all servers are equal; it would try to keep the connection counts identical across all 5 servers, which would still stress the older hardware more than the new. Global Availability (Option B) is a GSLB (DNS-based) method used for multi-site redundancy, not for local pool member load balancing. By using Weighted Least Connections, the administrator achieves a balance where the more capable servers take the brunt of the work while the older servers are utilized only to their specific safe capacity.

Forwarding (IP) virtual servers forward traffic based on routing decisions and do not use pools or pool members.

Slow Ramp Time prevents new members from being overwhelmed immediately after activation.

To provide encrypted communication between users and a virtual server, the BIG-IP system acts as a transparent SSL/TLS proxy. The administrative configuration required for this is a Client SSL profile.

When multiple hostnames (FQDNs) are associated with a single IP address, the system must determine which SSL certificate to present to the client during the initial TLS handshake. This is achieved using an extension of the TLS protocol called Server Name Indication (SNI).

The configuration logic is as follows:

Profile Type: The Client SSL profile is responsible for terminating the SSL connection from the client (the user) to the BIG-IP system.

The Setting: Within the Client SSL profile (under the "Advanced" view), there is a field specifically called Server Name. By entering the specific hostname (e.g., www.example.com) in this field, the BIG-IP system can match the hostname requested by the client in the ClientHello message to the correct profile.

Implementation: The administrator typically creates multiple Client SSL profiles—one for each hostname—and assigns them all to the same virtual server. One of these profiles must be designated as the Default SSL Profile for SNI to handle requests where the client does not provide a hostname or provides one that does not match any specific profile.

By using the Client SSL profile and the Server Name setting, the BIG-IP system ensures that each user receives the correct certificate for the specific site they are trying to reach, even though all sites share a single virtual server IP.

When many users share one source IP, source-address persistence fails. Cookie persistence uniquely identifies clients at Layer 7.