F5 BIG-IP Administration Support and Troubleshooting (F5CAB5) Certification Sample Questions

01. The control plane CPU usage on a BIG-IP system is high while the data plane CPU usage stays low. Which task is the system likely performing?
a) Generating a large qkview archive from the stored log files.
b) Processing a high volume of SSL handshakes and session renegotiations.
c) Running a complex iRule on every request to a virtual server.
d) Forwarding packets between VLANs or across a trunk at line rate.

02. A standard BIG-IP physical appliance has 4 CPU cores available for data plane processing. How many tmm instances are typically visible in the system process list?
a) 1
b) 4
c) 2
d) 3

03. Why would an administrator choose a Gateway ICMP monitor instead of a standard ICMP monitor for a node?
a) It probes on a shorter interval, so a failed node is detected sooner.
b) It encrypts its probe traffic between the BIG-IP and the node.
c) It completes a connection to the service port and inspects the content of the reply the application returns.
d) It can check a node that sits behind an intermediate device by sending its probe through that path.

04. A pool member has several monitors assigned, and the Availability Requirement for those monitors is set to At Least 1. How does the system decide the member's availability status?
a) The member is marked up when any one of the assigned monitors passes.
b) The member is marked up only when every assigned monitor passes.
c) The member is marked down as soon as any one of the assigned monitors fails.
d) The monitors conflict with one another and the member's status stays unknown.

05. An interface is running at 100 Mbps and half duplex even though it is cabled to a 1 Gbps switch port. The BIG-IP interface is configured for auto-negotiation. What is the most likely cause?
a) The BIG-IP license restricts the platform to a lower throughput rate.
b) The interface belongs to a trunk whose remaining members are down.
c) The switch port is hard-coded to a fixed speed and duplex at the far end of the link.
d) An HTTP profile on the virtual server is throttling throughput.

06. A pool contains servers of very different capacity, some with 4 CPU cores and some with 32. Which load balancing method distributes new connections in proportion to that known capacity?
a) Round Robin
b) Ratio (Member)
c) Observed
d) Fastest

07. A standard virtual server handles a client request using the BIG-IP full proxy architecture. How many distinct TCP connections exist for that single end-to-end request?
a) 4
b) 1
c) 3
d) 2

08. A client reports that connections to a web application drop intermittently. The administrator wants to capture traffic for that client's address, 1.1.1.1, across every VLAN and interface the data plane handles. Which command does that?
a) tcpdump -i eth0 host 1.1.1.1
b) cap-trace -ip 1.1.1.1
c) tcpdump -i 0.0 host 1.1.1.1
d) tmsh run /util tcpdump host 1.1.1.1

09. Which area of the Configuration Utility gives a real-time visual representation of CPU, memory and network throughput?
a) Local Traffic > Virtual Servers
b) Statistics > Dashboard
c) System > Resource Provisioning
d) Device Management > Overview

10. An administrator runs top from the bash shell and sees a process named tmm.0 holding 100% of a CPU core. How should this reading be interpreted?
a) Continuous polling by TMM makes this reading expected.
b) The system is absorbing a denial-of-service attack, which is saturating a data plane core.
c) The data plane process has hung on that CPU core and needs restarting.
d) The management interface is saturated with administrative traffic.