10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
These 10 free F5-CA questions are organized by exam domain, so you can see how each part of the F5 Certified BIG-IP Administrator (F5-CA) blueprint is tested. Reveal the answer and explanation under each question.
A change window permits staging target.iso, but no reboot. HD1.1 is running, HD1.2 holds a rollback release that must be preserved, and HD1.3 does not exist. The image has been imported, and storage is sufficient for another volume. Select the installation command that respects the change window.
Correct answer: B - tmsh install sys software image target.iso volume HD1.3 create-volume
On a BIG-IP with AFM licensed and provisioned, an internet-facing UDP service is under an active flood. Its assigned UDP Flood vector is set to Detect Only, with manual detection and mitigation thresholds of 10,000 and 20,000 packets/s. An attack is reported at 90,000 packets/s. The response plan requires enforcing the configured limit while leaving the service enabled. What should the administrator do now?
Correct answer: C - Set the vector to Mitigate to enforce its configured rate limit.
Client 10.20.30.50/24 connects to virtual server 10.20.30.100:443. BIG-IP translates the destination to member 10.20.30.11:443 and preserves the client source address. The client and member both use /24 masks on the same Layer 2 segment. A capture shows the member sending its SYN-ACK directly to the client's MAC address, bypassing BIG-IP. Address 10.20.30.250 is available for BIG-IP on that VLAN, and the application does not need the original client IP at the transport layer. How can the administrator correct this application's return path?
Correct answer: C - Assign this virtual server a SNAT pool containing 10.20.30.250.
A pool member is being drained for maintenance. It is Disabled and remains monitor-Up. Its connection count is falling, but clients with valid persistence entries still open new TCP connections to it. New clients use the other members. The owner now wants existing connections to finish with no further connections admitted to that member; other applications on the pair must stay available. The appropriate change is to:
Correct answer: A - Set the pool member to Forced Offline and retain its established connections.
An HTTP health check receives prompt responses with these complete bodies: Ready to serve: HTTP 200, {"state":"ready"} Unable to serve: HTTP 200, {"state":"not-ready"} Neither response header contains the word ready. The monitor's Receive string is ready, Reverse is Disabled, and Receive Disable is unset. Both application states pass. Which receive criterion separates the healthy response from the unhealthy one?
Correct answer: D - Match the complete field text "state":"ready" within the body.
A pool uses Weighted Least Connections (member). All four members are healthy, enabled, fully ramped, and in the same active priority group. A new connection has no persistence match. At the selection instant: app-a: 240 concurrent connections; limit 400 app-b: 210 concurrent connections; limit 700 app-c: 48 concurrent connections; limit 120 app-d: 105 concurrent connections; limit 300 The next connection should be assigned to:
Correct answer: C - app-b
Dana successfully authenticates through the corporate directory and matches two enabled remote-role mappings on BIG-IP: FinanceReview: line-order 30, role Guest, partition Finance FinanceOperations: line-order 80, role Manager, partition Finance These are the only mappings that apply to Dana. What access should Dana receive to traffic objects in Finance?
Correct answer: A - View configuration and statistics, without modifying traffic objects.
An API's Client SSL profile reports a missing private key after a UCS restore onto replacement hardware. The archive was created with no-private-key. Clients are configured to accept only the public key in the API's existing, valid certificate, and their configuration cannot be changed during this recovery window. Which recovery path preserves compatibility?
Correct answer: D - Recover and import the private key matching the existing API certificate.
A large upload repeatedly stalls. During each pause, the pool member sends BIG-IP acknowledgments advertising a zero receive window. Transmission resumes after the member advertises available window space. What does this packet pattern most directly identify?
Correct answer: B - Receive-side flow control at the backend.
For one failed transaction, BIG-IP's connection table shows: Client-side leg: 198.51.100.25:52144 to 192.0.2.50:443 Server-side leg: 10.20.30.5:52144 to 10.20.30.11:8443 A capture across the TMM interfaces uses 'tcp and host 192.0.2.50 and port 443' and records only the client-side exchange. Which replacement filter captures both legs?
Correct answer: D - tcp and (host 192.0.2.50 or host 10.20.30.11)
The full bank has 1,020 more F5-CA questions with explanations.
Continue in the free practice test →
View plans