F5 Updated F5CAB3 Exam Questions and Answers by alisa

When clients connect through a single source IP (NAT) — such as a corporate proxy or carrier-grade NAT — Source Address Affinity persistence becomes entirely ineffective because all clients share an identical source IP address. This would force every client session to the same pool member, completely eliminating even distribution and defeating the purpose of load balancing.

Cookie Persistence is the optimal solution in this scenario because it operates at Layer 7 , inserting a unique cookie into each client ' s HTTP/HTTPS response. Each individual browser session carries its own distinct cookie value, allowing the BIG-IP to identify and persist individual clients to specific pool members — regardless of whether they share a common source IP address. This guarantees both session persistence and even load distribution across pool members.

The remaining options are unsuitable because:

Destination Address Affinity persists based on destination IP, irrelevant for client-to-server session stickiness.

SSL Persistence uses the SSL Session ID for persistence, but SSL session IDs are frequently renegotiated and are unreliable for long-term persistence across modern TLS implementations.

Source Address Affinity fails entirely under NAT conditions as described.

Cookie persistence is the industry-standard method for HTTPS application load balancing requiring per-client session affinity.

When a single IP address (Virtual Server) must host multiple hostnames (e.g., site1.com, site2.com) over HTTPS, the BIG-IP must be able to present the correct SSL certificate for each site during the initial handshake. This requirement is handled by a technology called Server Name Indication (SNI).

To implement this on the BIG-IP, the administrator must use a Client SSL profile because the encryption is occurring between the user (Client) and the Virtual Server. Within the Client SSL profile settings, there is a field called Server Name. By creating multiple Client SSL profiles—each with a different " Server Name " (the hostname) and its corresponding certificate—and attaching them all to the same Virtual Server, the BIG-IP can inspect the SNI extension in the client ' s " Client Hello " packet. It then selects the specific profile that matches the requested hostname.

Option A is incorrect because " Client Name " is not the standard field name used for SNI hostname matching in the profile. Options B and C refer to Server SSL profiles, which manage the connection between the BIG-IP and the backend servers. While Server SSL profiles also have a " Server Name " field (used to send SNI to a backend server), the requirement here is to provide encrypted communication for " users " accessing the virtual server, which definitively requires a Client-side SSL configuration.

SSH is a TCP-based service. A TCP monitor validates service availability without requiring application-layer inspection.

The configuration error is the HTTP Profile = http setting. The virtual server is intended to load balance SSH , which operates over TCP port 22 and is not an HTTP application protocol. The configured TCP protocol and TCP profile are therefore appropriate, but an HTTP profile should not be attached to this SSH virtual server.

F5 documentation states that an HTTP profile defines how BIG-IP manages HTTP traffic . The standard http profile operates in Reverse proxy mode by default and invokes BIG-IP ' s HTTP protocol processing. F5 separately documents Transparent HTTP proxy mode as the mode that can forward invalid HTTP traffic instead of dropping it. This distinction is important because an SSH protocol exchange is not syntactically valid HTTP traffic.

Setting HTTP Profile to None removes unnecessary Layer 7 HTTP parsing and leaves the virtual server handling the SSH connection through its TCP profile. The other changes are inappropriate: SSH requires TCP rather than UDP; the source address does not need to equal the virtual server ' s destination IP; and changing the destination to 0.0.0.0/0 is unrelated to the application-protocol mismatch.

Reference Topics: Local Traffic Profiles → HTTP Profiles , Proxy Mode , TCP profiles , Virtual Server profile assignment .