Without decrypting, what portion of an HTTPS session is visible with a packet capture? (Choose one answer)
Answer(s): B
In an HTTPS session, the application-layer payload--including HTTP request headers, response headers, cookies, and body content--is encrypted using SSL/TLS. Without decrypting the traffic (for example, without SSL offloading on BIG-IP or access to the private keys), a packet capture cannot reveal any HTTP-level details.However, network-layer and transport-layer information remains visible, even when encryption is used. This includes source and destination IP addresses, source and destination ports, TCP flags, sequence numbers, and TLS handshake metadata. Therefore, the source IP address (Option B) is visible in a packet capture of HTTPS traffic without decryption.Options A, C, and D are incorrect because HTTP headers and cookies are part of the encrypted payload once HTTPS is established. BIG-IP troubleshooting documentation emphasizes this distinction when analyzing encrypted traffic flows using tcpdump, as administrators must rely on IP, port, and timing information unless SSL inspection or decryption is configured.
A gateway_icmp health monitor is configured on a pool. The BIG-IP Administrator is investigating why the pool is reported as down while the server is online. Other pools with servers in the same subnet are correctly monitored.What can cause this behavior? (Choose one answer)
Answer(s): C
A gateway_icmp monitor checks basic network reachability by sending ICMP echo requests (pings) to the pool member or its gateway. If the pool is marked DOWN while the server is confirmed to be online, the most likely cause is that ICMP traffic is being blocked.A host-based firewall active on the server (Option C) can block ICMP echo requests or replies, preventing BIG-IP from receiving a successful response to the health check. This results in the monitor failing and the pool member being marked down, even though the server and application are otherwise functioning normally. This explanation is consistent with the scenario where other servers in the same subnet work correctly, indicating that routing and BIG-IP configuration are not the issue.The other options are unrelated to ICMP monitoring. Logged-in users (Option A), missing patches (Option B), and stopped HTTP services (Option D) do not affect a gateway_icmp monitor. BIG-IP troubleshooting best practices recommend verifying ICMP reachability and firewall policies when diagnosing ICMP-based monitor failures.
A BIG-IP Administrator configured the following virtual server to pass traffic on all addresses and ports. After configuration is completed, the BIG-IP Administrator notices that the virtual server is unable to pass traffic.ltm virtual forwarding_any_vs {destination 0.0.0.0:any ip-forward mask 255.255.255.255profiles {fastL4 { }}serverssl-use-sni disabled source 0.0.0.0/0translate-address disabled translate-port disabled}Which part of the configuration is the cause of the issue? (Choose one answer)
This virtual server is intended to function as a forwarding (IP-forwarding) virtual server, which is commonly used for routing or firewall-style deployments where BIG-IP forwards traffic transparently without load balancing or address translation. For a forwarding virtual server to match and pass all traffic, the destination must be configured as 0.0.0.0:any with a mask of 0.0.0.0, not 255.255.255.255.The configured mask 255.255.255.255 represents a /32 host mask, which restricts the virtual server to matching traffic destined only for the exact IP address 0.0.0.0. Since 0.0.0.0 is not a valid routable destination for normal traffic, no packets will ever match the virtual server, causing it to pass no traffic at all.This is a well-documented BIG-IP behavior:destination 0.0.0.0:any mask 0.0.0.0together define a catch-all forwarding virtual server.The destination itself (Option A) is correct for a forwarding VS, and disabling address translation (Option C) is expected and required for IP-forwarding mode. Therefore, the incorrect subnet mask is the sole reason the virtual server is not functioning as expected.
Refer to the exhibit.A BIG-IP Administrator needs to deploy an application on the BIG-IP system to perform SSL offload and re-encrypt the traffic to pool members. During testing, users are unable to connect to the application.What must the BIG-IP Administrator do to resolve the issue? (Choose one answer)
Answer(s): D
To successfully perform SSL offload and re-encryption on a BIG-IP system, the virtual server must be configured with both a Client SSL profile and a Server SSL profile. The Client SSL profile enables BIG-IP to decrypt inbound HTTPS traffic from clients, while the Server SSL profile is required to re-encrypt traffic before forwarding it to the pool members.From the exhibit, the virtual server has a Client SSL profile configured, which allows BIG-IP to accept HTTPS connections from clients. However, there is no Server SSL profile attached, meaning BIG-IP attempts to send unencrypted HTTP traffic to pool members listening on HTTPS (port 443). This protocol mismatch causes the server-side SSL handshake to fail, resulting in users being unable to connect to the application.This behavior is well documented in BIG-IP SSL troubleshooting guides: when backend servers expect HTTPS, a Server SSL profile is mandatory to establish a secure connection from BIG-IP to the pool members.The other options are incorrect:Removing the Client SSL profile (Option A) would break client-side HTTPS.The server-side TCP profile (Option B) is unrelated to SSL encryption.Forward Proxy (Option C) is only used for outbound SSL inspection scenarios.Therefore, configuring an SSL Profile (Server) is the correct and required solution.
A BIG-IP Administrator notices that one of the servers that runs an application is NOT receiving any traffic. The BIG-IP Administrator examines the configuration status of the application and observes the displayed monitor configuration and affected pool member status.What is the possible cause of this issue? (Choose one answer)
Answer(s): A
The key clue in the exhibit is the pool member's availability showing "Offline (Enabled) Parent down". In BIG-IP terminology, a pool member inherits the status of its parent node. If the node is marked down (for example, by a node-level monitor or a default "node is down" condition), then all pool members using that node IP will also be marked down and will not receive any traffic, even if the application service on the member port might be healthy.While the HTTPS monitor configuration (send/receive strings) is displayed, the status specifically indicates a node (parent) failure, not a service-level failure. If the problem were the application not matching the receive string, you would typically see the member down due to the member's monitor failing (and the status would reflect monitor failure details), rather than "parent down."Option D is too broad; BIG-IP can generally reach the subnet (other servers work), and this symptom points to a specific node condition. Option C is incorrect because HTTP/1.1 is commonly used for monitoring and is valid when properly formatted (especially with a Host header). Therefore, the most likely cause is that the node health monitor is not responding, causing the node--and consequently the member--to be marked down.
Post your Comments and Discuss F5 F5CAB5 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the F5CAB5 content, but please register or login to continue.