F5 Updated F5CAB2 Exam Questions and Answers by johnny

This scenario combines session continuity , multiple protocols (HTTP and FTP) , and HA failover behavior , which directly implicates persistence handling across devices and services .

Key Requirements Breakdown

Same pool member for entire session

Session must survive failover

Session must span multiple services (HTTP and FTP)

Why Persistence Mirroring + Match Across Services Is Required

Persistence Mirroring

Ensures persistence records are synchronized from the active BIG-IP to the standby BIG-IP.

Without mirroring:

After failover, the standby device has no persistence table

Clients are load-balanced again

Sessions break, forcing users to restart

Persistence mirroring is essential for session continuity during failover

Match Across Services

Allows a single persistence record to be shared across multiple virtual servers / protocols

Required when:

HTTP and FTP must use the same pool member

Multiple services are part of a single application session

Together, these settings ensure:

Persistence survives device failover

Persistence is honored across HTTP and FTP

Why the Other Options Are Incorrect

A. Cookie persistence and session timeout Cookie persistence only applies to HTTP and does not address FTP or failover synchronization.

B. Stateful failover and Network Failover detection Stateful failover applies to connection state , not persistence records , and does not link HTTP and FTP sessions.

D. SYN-cookie insertion threshold and connection low-water mark These are DoS / SYN flood protection settings, unrelated to persistence or HA behavior.

12

In the BIG-IP system, pool selection must occur on the client-side of the connection, before the system attempts to connect to a pool 3 member. The events listed 4 are the primary entry points for making these decisions:

CLIENT_ACCEPTED (E): This is a Layer 4 event triggered when the BIG-IP accepts a TCP connection. It is the earliest point where a pool can be assigned based on the client ' s source IP address or the destination port.

CLIENT_DATA (A): This event is triggered when the system receives a " chunk " of data on the client-side. It is often used for non-HTTP protocols (like custom TCP protocols) to inspect the payload and select a pool based on its contents.

HTTP_REQUEST (C): This is a Layer 7 event. It occurs once the BIG-IP has fully parsed the HTTP headers. This is the most common event for pool selection, allowing the administrator to route traffic based on the URI, Host header, or cookies.

Events like SERVER_SELECTED or SERVER_CONNECTED occur after the load balancing decision has already been made, and HTTP_RESPONSE or SERVER_DATA occur after the server has already started communicating back, making them too late for initial pool selection.

In BIG-IP terminology, a Trunk is the object used to implement Link Aggregation (IEEE 802.3ad/802.1AX). When a network engineer refers to " interface binding " or " EtherChannel " with LACP, the BIG-IP equivalent is a Trunk.

LACP (Link Aggregation Control Protocol): This is a protocol that allows the BIG-IP system to communicate with the upstream switches to negotiate the bundling of multiple physical links into a single logical link.

Resilience and Redundancy: By creating a trunk that includes interfaces connected to two different switches (typically configured as a VPC, VSS, or MLAG cluster on the switch side), the administrator ensures that the BIG-IP remains reachable even if one physical interface or one switch fails.

Data Plane Logic: The BIG-IP treats the trunk as a single Layer 2 interface. VLANs are then associated with the trunk rather than individual physical ports.

Why the other options are incorrect:

Option B: Trunks aggregate physical interfaces. While VLANs are associated with trunks, the trunk configuration itself does not " list " MAC addresses of the switches; it uses LACP to negotiate the connection.

Options C & D: Virtual Servers are Layer 4-7 objects used for traffic processing and load balancing. They do not possess " LACP profiles, " nor are physical interfaces or management IPs treated as pool members for the purpose of link aggregation.

In BIG-IP LTM, health monitors are used to determine the availability of pool members and directly influence traffic flow decisions in the data plane.

Key characteristics of the default HTTP monitor according to BIG-IP Administration Data Plane Concepts:

Sends an HTTP request (typically GET /)

Expects an HTTP response code of 200 OK

Any response other than 200 is treated as a monitor failure

A failed monitor causes the pool member to be marked offline (down)

In this scenario:

Two pool members return 404 Not Found

A 404 response indicates that the requested object was not found

This does not meet the success criteria of the default HTTP monitor

These two members are therefore marked offline

One pool member returns 200 OK

This matches the expected response

The member is marked online

Resulting Pool Member Availability:

2 members: Offline

1 member: Online

Why the Other Options Are Incorrect:

B – 404 responses are not considered healthy by the default HTTP monitor

C – At least one member responds with the expected 200 OK

D – Members returning 404 responses fail the monitor and cannot be marked online

Key Data Plane Concept Reinforced:

BIG-IP health monitors make binary availability decisions based strictly on configured success criteria. For HTTP monitors, response codes matter— 404 is a failure , even if the service is technically reachable.

===========