Quiz 303: F5 Networks BIG-IP ASM Specialist

The correct answer is B. the AVR module.
The question asks for a feature that can gather website statistics such as latency and throughput on an existing virtual server that is load balancing backend web servers.
On F5 BIG-IP, the AVR module, which stands for Application Visibility and Reporting, is specifically designed to provide detailed application-layer monitoring and reporting. It can collect and display statistics such as:
- Latency
- Throughput
- Request rates
- Response codes
- Client and server-side performance metrics
This makes AVR the best choice when you need visibility into how an application or virtual server is performing from an end-user and traffic perspective.
Why the other options are not correct:
A. the Performance panel
This may show some general performance information, but it is not the dedicated feature for detailed application statistics like latency and throughput on a virtual server.
C. the Dashboard
The dashboard is a general overview area in the BIG-IP GUI. It can summarize system status and performance, but it does not provide the detailed application visibility and reporting that AVR does.
D. the Statistics panel
The statistics panel can show counters and basic traffic information, but it is not the best match for detailed website statistics such as latency and throughput for a virtual server load balancing web servers.
Summary:
If you need detailed visibility into application performance metrics for a virtual server, F5 AVR is the correct feature.

The correct answer is B: both address and port translation enabled.
In an F5 BIG-IP LTM environment, a Standard Virtual Server is typically used to provide load balancing for traffic destined to a virtual IP. When the BIG-IP is positioned between clients and multiple servers, and especially when traffic must traverse routed paths across different ISPs, address translation and port translation are commonly enabled to ensure return traffic flows correctly through the device.
Why B is correct:
- Address translation enabled means the BIG-IP changes the source IP address of the client traffic to a self IP or SNAT address as it leaves toward the servers.
- This is important when the servers’ return route would otherwise bypass the BIG-IP, which can happen in routed environments involving different ISPs.
- Port translation enabled means the BIG-IP can also translate source ports, allowing many client connections to share the same translated IP address without conflicts.
- Together, these settings support proper source NAT behavior and help maintain symmetric traffic flow through the load balancer.
Why the other options are incorrect:
A. address translation enabled and port translation disabled
- This may work in some cases, but it is not the best answer here.
- Disabling port translation can limit connection scalability and is not the standard choice for general routed load balancing across separate ISP paths.
C. both address and port translation disabled
- This would leave original client IP and port unchanged.
- In routed topologies, return traffic may not pass back through the BIG-IP, which can break session handling and load balancing behavior.
D. address translation disabled and port translation enabled
- Port translation alone is not enough if the servers still need the BIG-IP to remain in the traffic path.
- Without address translation, the servers may respond directly to the client or via a different route, causing asymmetric routing problems.
Key idea:
For a Standard Virtual Server to successfully load balance traffic across routed paths, especially when two different ISPs are involved, the BIG-IP usually needs to perform source translation. Enabling both address translation and port translation provides the most complete and reliable configuration.
Final answer: B. both address and port translation enabled

The correct answer is D. HTTP, Client SSL, Cookie Persistence Profile.
To terminate client SSL traffic, the LTM Specialist needs a Client SSL profile. This allows the BIG-IP LTM device to decrypt incoming HTTPS traffic from the client.
Because the decision is based on a cookie presented by the client, a Cookie Persistence profile is required. This type of persistence uses a cookie to keep a client consistently directed to the same backend server.
Why D is correct:
- HTTP profile: Needed for layer 7 processing so the BIG-IP can inspect HTTP traffic and work with cookies.
- Client SSL profile: Terminates SSL from the client side.
- Cookie Persistence profile: Provides persistence based on the cookie sent by the client.
Why the other options are incorrect:
- A. HTTPS, Client SSL, Cookie Persistence Profile
- HTTPS is not the usual profile used here; HTTP is required for layer 7 cookie handling.
- B. HTTP, Server SSL, SSL Cookie Profile
- Server SSL is for encrypting traffic from BIG-IP to the server, not client-side termination.
- "SSL Cookie Profile" is not the correct persistence profile name in this context.
- C. HTTPS, Server SSL, SSL Cookie Profile
- Does not terminate client SSL traffic properly because it lacks Client SSL.
- D. HTTP, Client SSL, Cookie Persistence Profile
- Correct combination for client-side SSL termination and cookie-based persistence.
In short, the BIG-IP must decrypt the client connection with Client SSL, inspect HTTP traffic, and then use Cookie Persistence to maintain session stickiness based on the client cookie.

The correct answer is D. Use a shorter idle timeout on the TCP profile.
The issue described is decreased performance and intermittent connection drops on the LTM system. In BIG-IP LTM, a TCP profile controls how the device manages TCP connections, including how long idle connections are kept open.
If the idle timeout is too long, stale or half-open connections can remain in the connection table. Over time, this can consume resources and cause performance degradation, especially when many idle or abandoned connections accumulate. This can also lead to intermittent connection problems because new sessions may be affected by resource exhaustion or connection handling delays.
Why D is correct:
- A shorter idle timeout removes inactive TCP connections sooner.
- This helps reduce unnecessary session buildup.
- It improves resource utilization and can stabilize connection handling.
- It is a common fix when performance degrades due to idle connection accumulation.
Why the other options are not correct:
- A. Use an optimized TCP profile.
- An optimized profile may improve TCP behavior in general, but it is not the most direct fix for idle connection buildup or intermittent connection issues caused by long timeouts.
- B. Use a FastL4 profile on the virtual server.
- FastL4 can improve performance in some cases, but switching to it is a broader design change and not specifically the best answer for the problem described.
- C. Use a default caching profile on the virtual server.
- Caching profiles are related to content caching, not TCP connection cleanup or connection stability.
In summary, reducing the TCP idle timeout is the best action because it prevents idle connections from lingering too long and helps restore stable performance.

The correct answer is C. create VLANs for each subnet and set the name accordingly
The requirement is to show department names next to IP addresses in analytics reports. In BIG-IP LTM analytics, the system can present traffic information in a more meaningful way when network segments are organized and labeled. By creating VLANs for each subnet and assigning them appropriate names, the LTM Specialist can make the reporting output reflect the associated department names more clearly.
Why C is correct:
- VLANs can be used to logically separate traffic by subnet.
- Naming each VLAN after the corresponding department provides a clear association between subnet traffic and department identity.
- This allows the analytics reports to show meaningful labels instead of only raw IP addresses.
Why the other options are incorrect:
- A. use an iRule to change the output of the report
- iRules are used to manipulate traffic handling, not to directly alter analytics report labels in this way.
- B. export the report and add the department names manually
- This is not a system-based solution and would be inefficient and error-prone.
- D. define active subnets and assign a name to certain subnets
- This sounds related, but it is not the standard or correct BIG-IP method for associating traffic with readable departmental names in reports. VLAN naming is the proper administrative approach.
In short, the best way to meet the reporting requirement is to organize the subnets into VLANs and name them according to the department.

The correct answer is C. custom analytics profile
In Application Visibility and Reporting (AVR), email notifications for analytics events require an SMTP profile so the system knows how to send the messages. This SMTP profile is not configured in the default or virtual server profiles. Instead, it must be defined in a custom analytics profile.
Why C is correct:
- A custom analytics profile lets you define specific reporting and notification settings for an application or virtual server.
- SMTP settings are part of the notification configuration used for sending email alerts.
- If you want to configure email notifications, the custom analytics profile is the place where the SMTP profile is referenced or defined.
Why the other options are incorrect:
- A. App analytics profile: This is not the standard profile type used for configuring SMTP-based notifications in AVR.
- B. Virtual server profile: A virtual server profile is used for traffic handling and server-specific settings, not for email notification setup.
- D. Default analytics profile: The default profile provides general baseline settings, but SMTP-based notification configuration requires a custom analytics profile.
In short, to configure email notifications in AVR, you must use a custom analytics profile, which is why option C is the correct answer.

The correct answers are B and E.
Explanation
This question is about persistence behavior on an F5 LTM device. Persistence makes the load balancer keep sending a client’s requests to the same pool member for a certain amount of time, as long as the persistence record is still valid.
From the configuration, the important point is the persistence timeout value. The timeout defines how long an idle client session will continue to be mapped to the same pool member before that persistence record expires.
How to interpret the options
- If a client session has been idle for less than the persistence timeout, it will still be sent to the same pool member.
- If a client session has been idle for longer than the persistence timeout, the persistence record expires and the request can be load balanced to a different pool member.
Applying that to the choices
- B. A client session that has been idle for 20 minutes will be balanced to a new pool member
This is correct because 20 minutes exceeds the configured persistence timeout, so the existing persistence entry has expired.
- E. A client session that has been idle for 12 minutes will be sent to the same pool member
This is correct because 12 minutes is still within the persistence timeout, so the session remains pinned to the same member.
Why the other options are incorrect
- A. 16 minutes will be sent to the same pool member
Incorrect, because 16 minutes is beyond the timeout shown in the configuration.
- C. 14 minutes will be balanced to a new pool member
Incorrect, because 14 minutes is still within the persistence timeout.
- D. 48 minutes will be sent to the same pool members
Incorrect, because 48 minutes is far beyond the timeout, so persistence would no longer apply.
Final answer: B and E

The correct answer is E: a standard virtual server with a SNAT, HTTP profile, Client SSL profile, and cookie persistence.
Why this is correct:
The requirements are:
1. The application servers do not support SSL, but client access must be secured.
2. Multiple requests from the same client should go to the same pool member.
3. Traffic should be distributed evenly because all pool members have similar capacity.
4. The LTM device is not the pool members’ default gateway.
Let’s break down what is needed.
1. Secure client access, but no SSL on the servers
Since the servers do not support SSL, the BIG-IP must terminate SSL from the client side. That means the virtual server needs a Client SSL profile.
Important point: client-side SSL is required, but server-side SSL is not, because the back-end servers cannot handle SSL.
2. Same client should return to the same pool member
This is a persistence requirement. Among the given options, cookie persistence is appropriate because it keeps a client bound to the same pool member for repeated requests. It is commonly used for HTTP applications and works well when requests are load balanced at the application layer.
3. Even traffic distribution among similar servers
Since all pool members have about the same processing power, a standard load balancing method is fine. The question does not ask for a special load balancing algorithm, and persistence will handle session affinity. The standard virtual server is the correct type for SSL offload and HTTP-aware balancing.
4. LTM is not the pool members’ default gateway
Because the BIG-IP is not the default gateway, return traffic from the servers would not automatically pass back through it. A SNAT is needed so the pool members send responses back to the BIG-IP.
Why the other options are wrong:
A. a performance 14 virtual server with a SNAT and cookie persistence
This is wrong because it does not include SSL termination for client access. Also, a performance L4 virtual server is not the best choice when HTTP cookie persistence and client-side SSL are required.
B. a performance L4 virtual server with a Client SSL profile and Source Address persistence
This is not correct because a performance L4 virtual server does not support the full HTTP features needed for cookie persistence in the way a standard HTTP virtual server does. Also, source address persistence is not ideal here compared to cookie persistence.
C. a performance L4 virtual server with a SNAT, HTTP profile, Server SSL profile, and cookie persistence
This is wrong because a Server SSL profile is for encrypting traffic from BIG-IP to the servers, but the servers do not support SSL. The requirement is client-side SSL, not server-side SSL.
D. a standard virtual server with a SNAT, HTTP profile, Server SSL profile, and cookie persistence
This is also wrong for the same reason: Server SSL is unnecessary and incompatible with the stated server limitations. It should be Client SSL, not Server SSL.
Why E is the best match:
A standard virtual server is used for HTTP applications with features like SSL termination and cookie persistence. With Client SSL, the BIG-IP secures client connections. With SNAT, return traffic can flow correctly even when BIG-IP is not the default gateway. Cookie persistence ensures the same client keeps going to the same pool member.
Note: The option text says “Client profile,” but in F5 terminology the intended profile for securing client access is Client SSL. Based on the answer key, E is clearly the intended correct choice.
Final answer: E

The correct answer is A. Remote User role.
When remote users authenticate to an F5 LTM device through RADIUS, the authentication server can also supply role information through RADIUS attributes. Since the default remote user role is Guest, users who need higher privileges, such as Administrator, must be mapped to a specific remote role on the F5 device.
A Remote User role is the configuration item used to define what privilege level a remote authenticated user receives. In this case, the F5 device must have a Remote User role created or configured so that the RADIUS-supplied attributes can assign the Administrator role appropriately.
Why the other options are incorrect:
B. Admin account
This would imply creating a local administrator account on the F5 device, but the users are authenticated remotely via RADIUS, not by local accounts.
C. User role
This is too generic. The specific configuration needed for remote authentication and authorization is the Remote User role.
D. User account
A user account would again suggest a local account on the device, which is not what is required when using RADIUS for remote authentication.
In short, because authorization for remote RADIUS users depends on mapping to an F5 remote role, the needed configuration item is the Remote User role.

The correct answer is A. Unavailable (Enabled)
This is an HTTP health monitor question. The monitor sends an HTTP request to the server and compares the response against the configured Receive String. Because Reverse is set to Yes, the logic is inverted:
- If the response contains the Receive String, the monitor considers the pool member down.
- If the response does not contain the Receive String, the monitor considers the pool member up.
Given configuration:
- Interval: 7 seconds
- Timeout: 22 seconds
- Reverse: Yes
- Send String: GET /status.html HTTP/1.1
Host: test.example.com
Connection: Close
- Receive String: Up
The HTTP server response shown in the image includes the string "Up" in the response body.
Because Reverse is enabled, finding "Up" means the monitor marks the pool as unavailable.
Why the status is "Unavailable (Enabled)":
- Unavailable means the monitor has determined the server is down.
- Enabled means the pool member is still active in configuration; it is not administratively disabled.
- So the member is monitored, but currently judged unhealthy.
Why the other options are wrong:
- B. Available (Enabled): This would be correct only if Reverse were No, or if the response did not contain "Up".
- C. Offline (Enabled): Offline usually means manually disabled or forced offline, not just failed health monitoring.
- D. Unknown (Disabled): Unknown is not the expected state here because the monitor received a response and could evaluate it.
Final result:
The response matches the Receive String, and because Reverse is Yes, the pool member is marked Unavailable (Enabled).