Quiz 301a: F5 Networks BIG-IP LTM Specialist: Architect, Set up, Deploy

The correct answer is B. the AVR module.
The question asks for a feature that can gather website statistics such as latency and throughput on an existing virtual server that is load balancing backend web servers.
On F5 BIG-IP, the AVR module, which stands for Application Visibility and Reporting, is specifically designed to provide detailed application-layer monitoring and reporting. It can collect and display statistics such as:
- Latency
- Throughput
- Request rates
- Response codes
- Client and server-side performance metrics
This makes AVR the best choice when you need visibility into how an application or virtual server is performing from an end-user and traffic perspective.
Why the other options are not correct:
A. the Performance panel
This may show some general performance information, but it is not the dedicated feature for detailed application statistics like latency and throughput on a virtual server.
C. the Dashboard
The dashboard is a general overview area in the BIG-IP GUI. It can summarize system status and performance, but it does not provide the detailed application visibility and reporting that AVR does.
D. the Statistics panel
The statistics panel can show counters and basic traffic information, but it is not the best match for detailed website statistics such as latency and throughput for a virtual server load balancing web servers.
Summary:
If you need detailed visibility into application performance metrics for a virtual server, F5 AVR is the correct feature.

The correct answer is B: both address and port translation enabled.
In an F5 BIG-IP LTM environment, a Standard Virtual Server is typically used to provide load balancing for traffic destined to a virtual IP. When the BIG-IP is positioned between clients and multiple servers, and especially when traffic must traverse routed paths across different ISPs, address translation and port translation are commonly enabled to ensure return traffic flows correctly through the device.
Why B is correct:
- Address translation enabled means the BIG-IP changes the source IP address of the client traffic to a self IP or SNAT address as it leaves toward the servers.
- This is important when the servers’ return route would otherwise bypass the BIG-IP, which can happen in routed environments involving different ISPs.
- Port translation enabled means the BIG-IP can also translate source ports, allowing many client connections to share the same translated IP address without conflicts.
- Together, these settings support proper source NAT behavior and help maintain symmetric traffic flow through the load balancer.
Why the other options are incorrect:
A. address translation enabled and port translation disabled
- This may work in some cases, but it is not the best answer here.
- Disabling port translation can limit connection scalability and is not the standard choice for general routed load balancing across separate ISP paths.
C. both address and port translation disabled
- This would leave original client IP and port unchanged.
- In routed topologies, return traffic may not pass back through the BIG-IP, which can break session handling and load balancing behavior.
D. address translation disabled and port translation enabled
- Port translation alone is not enough if the servers still need the BIG-IP to remain in the traffic path.
- Without address translation, the servers may respond directly to the client or via a different route, causing asymmetric routing problems.
Key idea:
For a Standard Virtual Server to successfully load balance traffic across routed paths, especially when two different ISPs are involved, the BIG-IP usually needs to perform source translation. Enabling both address translation and port translation provides the most complete and reliable configuration.
Final answer: B. both address and port translation enabled

The correct answer is D. HTTP, Client SSL, Cookie Persistence Profile.
To terminate client SSL traffic, the LTM Specialist needs a Client SSL profile. This allows the BIG-IP LTM device to decrypt incoming HTTPS traffic from the client.
Because the decision is based on a cookie presented by the client, a Cookie Persistence profile is required. This type of persistence uses a cookie to keep a client consistently directed to the same backend server.
Why D is correct:
- HTTP profile: Needed for layer 7 processing so the BIG-IP can inspect HTTP traffic and work with cookies.
- Client SSL profile: Terminates SSL from the client side.
- Cookie Persistence profile: Provides persistence based on the cookie sent by the client.
Why the other options are incorrect:
- A. HTTPS, Client SSL, Cookie Persistence Profile
- HTTPS is not the usual profile used here; HTTP is required for layer 7 cookie handling.
- B. HTTP, Server SSL, SSL Cookie Profile
- Server SSL is for encrypting traffic from BIG-IP to the server, not client-side termination.
- "SSL Cookie Profile" is not the correct persistence profile name in this context.
- C. HTTPS, Server SSL, SSL Cookie Profile
- Does not terminate client SSL traffic properly because it lacks Client SSL.
- D. HTTP, Client SSL, Cookie Persistence Profile
- Correct combination for client-side SSL termination and cookie-based persistence.
In short, the BIG-IP must decrypt the client connection with Client SSL, inspect HTTP traffic, and then use Cookie Persistence to maintain session stickiness based on the client cookie.

The correct answer is D. Use a shorter idle timeout on the TCP profile.
The issue described is decreased performance and intermittent connection reaps on an LTM system. In BIG-IP LTM, a connection "reap" typically happens when the system closes idle connections after they have been inactive longer than the configured timeout.
If the TCP profile idle timeout is too long, stale or idle connections may remain open longer than necessary. This can contribute to poor performance, resource consumption, and connection management issues. Reducing the idle timeout helps the system clean up unused connections more quickly, which can resolve intermittent reaping behavior and improve overall performance.
Why the other options are not correct:
A. Use an optimized TCP profile.
An optimized TCP profile can improve throughput and network efficiency, but it does not directly address intermittent connection reaps caused by idle connection timeout behavior.
B. Use a FastL4 profile on the virtual server.
FastL4 is typically used for high-performance, Layer 4 processing, but switching to FastL4 would change the traffic handling model and is not the specific fix for idle timeout-related reaping.
C. Use a default caching profile on the virtual server.
A caching profile is unrelated to TCP connection reaping and would not solve the observed performance or connection timeout problem.
In summary, since the symptoms point to connections being reaped due to inactivity or timeout handling, shortening the TCP idle timeout is the appropriate action.

The correct answer is C. create VLANs for each subnet and set the name accordingly
The requirement is to show department names next to IP addresses in analytics reports. In BIG-IP LTM analytics, the system can present traffic information in a more meaningful way when network segments are organized and labeled. By creating VLANs for each subnet and assigning them appropriate names, the LTM Specialist can make the reporting output reflect the associated department names more clearly.
Why C is correct:
- VLANs can be used to logically separate traffic by subnet.
- Naming each VLAN after the corresponding department provides a clear association between subnet traffic and department identity.
- This allows the analytics reports to show meaningful labels instead of only raw IP addresses.
Why the other options are incorrect:
- A. use an iRule to change the output of the report
- iRules are used to manipulate traffic handling, not to directly alter analytics report labels in this way.
- B. export the report and add the department names manually
- This is not a system-based solution and would be inefficient and error-prone.
- D. define active subnets and assign a name to certain subnets
- This sounds related, but it is not the standard or correct BIG-IP method for associating traffic with readable departmental names in reports. VLAN naming is the proper administrative approach.
In short, the best way to meet the reporting requirement is to organize the subnets into VLANs and name them according to the department.

The correct answer is C. custom analytics profile
In Application Visibility and Reporting (AVR), email notifications for analytics events require an SMTP profile so the system knows how to send the messages. This SMTP profile is not configured in the default or virtual server profiles. Instead, it must be defined in a custom analytics profile.
Why C is correct:
- A custom analytics profile lets you define specific reporting and notification settings for an application or virtual server.
- SMTP settings are part of the notification configuration used for sending email alerts.
- If you want to configure email notifications, the custom analytics profile is the place where the SMTP profile is referenced or defined.
Why the other options are incorrect:
- A. App analytics profile: This is not the standard profile type used for configuring SMTP-based notifications in AVR.
- B. Virtual server profile: A virtual server profile is used for traffic handling and server-specific settings, not for email notification setup.
- D. Default analytics profile: The default profile provides general baseline settings, but SMTP-based notification configuration requires a custom analytics profile.
In short, to configure email notifications in AVR, you must use a custom analytics profile, which is why option C is the correct answer.

The correct answers are B and E.
Here is why.
This LTM configuration is using session persistence with a timeout and a mirroring-related setting that affects how long a client’s session affinity remains valid.
The key point is to interpret the persistence timeout:
- If a client returns before the persistence record expires, the traffic is sent to the same pool member.
- If the persistence record has expired, the next connection can be load balanced to a different pool member.
Based on the configuration shown, the effective persistence timeout allows the session to remain on the same pool member for 12 minutes, but not for 14 minutes or longer in the way described by the other options.
Now evaluate each choice:
A. A client session that has been idle for 16 minutes will be sent to the same pool member
- Incorrect. The persistence record would no longer be valid by then.
B. A client session that has been idle for 20 minutes will be balanced to a new pool member
- Correct. After the persistence timeout has expired, the next request is no longer guaranteed to go to the same member.
C. A client session that has been idle for 14 minutes will be balanced to a new pool member
- This is not one of the expected outcomes from the configuration as given.
D. A client session that has been idle for 48 minutes will be sent to the same pool members
- Incorrect. This is far beyond the persistence duration.
E. A client session that has been idle for 12 minutes will be sent to the same pool member
- Correct. This is still within the persistence timeout, so the client remains tied to the same pool member.
Summary:
- Within the persistence timeout: the client stays on the same pool member.
- After the timeout expires: the client may be sent to a new pool member.
Therefore, the correct choices are B and E.

The correct answer is E: a standard virtual server with a SNAT, HTTP profile, Client SSL profile, and cookie persistence.
Why this is correct:
The requirements are:
1. The application servers do not support SSL, but client access must be secured.
2. Multiple requests from the same client should go to the same pool member.
3. Traffic should be distributed evenly because all pool members have similar capacity.
4. The LTM device is not the pool members’ default gateway.
Let’s break down what is needed.
1. Secure client access, but no SSL on the servers
Since the servers do not support SSL, the BIG-IP must terminate SSL from the client side. That means the virtual server needs a Client SSL profile.
Important point: client-side SSL is required, but server-side SSL is not, because the back-end servers cannot handle SSL.
2. Same client should return to the same pool member
This is a persistence requirement. Among the given options, cookie persistence is appropriate because it keeps a client bound to the same pool member for repeated requests. It is commonly used for HTTP applications and works well when requests are load balanced at the application layer.
3. Even traffic distribution among similar servers
Since all pool members have about the same processing power, a standard load balancing method is fine. The question does not ask for a special load balancing algorithm, and persistence will handle session affinity. The standard virtual server is the correct type for SSL offload and HTTP-aware balancing.
4. LTM is not the pool members’ default gateway
Because the BIG-IP is not the default gateway, return traffic from the servers would not automatically pass back through it. A SNAT is needed so the pool members send responses back to the BIG-IP.
Why the other options are wrong:
A. a performance 14 virtual server with a SNAT and cookie persistence
This is wrong because it does not include SSL termination for client access. Also, a performance L4 virtual server is not the best choice when HTTP cookie persistence and client-side SSL are required.
B. a performance L4 virtual server with a Client SSL profile and Source Address persistence
This is not correct because a performance L4 virtual server does not support the full HTTP features needed for cookie persistence in the way a standard HTTP virtual server does. Also, source address persistence is not ideal here compared to cookie persistence.
C. a performance L4 virtual server with a SNAT, HTTP profile, Server SSL profile, and cookie persistence
This is wrong because a Server SSL profile is for encrypting traffic from BIG-IP to the servers, but the servers do not support SSL. The requirement is client-side SSL, not server-side SSL.
D. a standard virtual server with a SNAT, HTTP profile, Server SSL profile, and cookie persistence
This is also wrong for the same reason: Server SSL is unnecessary and incompatible with the stated server limitations. It should be Client SSL, not Server SSL.
Why E is the best match:
A standard virtual server is used for HTTP applications with features like SSL termination and cookie persistence. With Client SSL, the BIG-IP secures client connections. With SNAT, return traffic can flow correctly even when BIG-IP is not the default gateway. Cookie persistence ensures the same client keeps going to the same pool member.
Note: The option text says “Client profile,” but in F5 terminology the intended profile for securing client access is Client SSL. Based on the answer key, E is clearly the intended correct choice.
Final answer: E

The correct answer is A. Remote User role.
When remote users authenticate to an F5 LTM device through RADIUS, the authentication server can also supply role information through RADIUS attributes. Since the default remote user role is Guest, users who need higher privileges, such as Administrator, must be mapped to a specific remote role on the F5 device.
A Remote User role is the configuration item used to define what privilege level a remote authenticated user receives. In this case, the F5 device must have a Remote User role created or configured so that the RADIUS-supplied attributes can assign the Administrator role appropriately.
Why the other options are incorrect:
B. Admin account
This would imply creating a local administrator account on the F5 device, but the users are authenticated remotely via RADIUS, not by local accounts.
C. User role
This is too generic. The specific configuration needed for remote authentication and authorization is the Remote User role.
D. User account
A user account would again suggest a local account on the device, which is not what is required when using RADIUS for remote authentication.
In short, because authorization for remote RADIUS users depends on mapping to an F5 remote role, the needed configuration item is the Remote User role.

The correct answer is A. Unavailable (Enabled)
Here is why:
An HTTP monitor determines pool member or pool status by sending an HTTP request and evaluating the response against the configured receive string.
Key settings in the question:
- Interval: 7 seconds
- Timeout: 22 seconds
- Reverse: Yes
- Send String: GET /status.html HTTP/1.1 with Host: test.example.com
- Receive String: Up
What matters most is the Reverse setting.
How the monitor works
Normally, if the server response contains the receive string "Up", the monitor considers the destination healthy.
But when Reverse is enabled, the logic is inverted:
- If the response contains "Up", the monitor marks the pool as down/unavailable.
- If the response does not contain "Up", the monitor marks it as up/available.
This is often used to mark a server as unhealthy when it returns a known failure page or specific text.
Applying that to this question
The server response shown in the image contains the string "Up".
Because Reverse is set to Yes, that match causes the monitor to fail the check.
Resulting status
- The pool is considered unavailable
- Since the monitor is enabled, the status is Unavailable (Enabled)
Why the other options are wrong
- B. Available (Enabled): Incorrect because Reverse inverts the match result, so a matching "Up" response does not mean healthy.
- C. Offline (Enabled): "Offline" usually means the member or pool is administratively disabled or taken out of service, not just failed by a monitor.
- D. Unknown (Disabled): Incorrect because the monitor is enabled and the result is not unknown; it is a failed health check.
Final answer: A. Unavailable (Enabled)