f5 101 Latest

101.prepaway.premium.exam.
460q
Number: 101
Passing Score: 800
Time Limit: 120 min
File Version: 5.0
101
Application Delivery Fundamentals
Version 5.0
Exam A
QUESTION 1
To make complex access policies easier to manage, an administrator can create a _______ containing several
policy actions, and then add instances of it within the policy? (Fill in)
A. Visual Policy Editor

B. Policy Editor
C. Visual Editor
D. Policy creator
Correct Answer: A
Section: (none)
Explanation
Explanation/Reference:
Explanation:
QUESTION 2
To make complex access policies easier to manage, an administrator can create a policy containing several
policy actions, and then add instances of it within the policy using the ________. (Fill in)
A. Deployment Wizard
B. Setup Wizard
C. Policy Wizard
D. Visual Wizard
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 3
The Policy Builder benefits include:
A. Doesn't require in depth web application knowledge

B. Only requires limited ASM knowledge
C. All of the above
D. Very low administrative impact
Correct Answer: C
Section: (none)
Explanation
Explanation:
QUESTION 4
APM administrators can configure access policies granting users which two types of access?
A. CIFS access
B. Client/server access
C. Web application access
D. Proxy access
E. RDC access
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 5
Which of the following is a benefit of using iRules?
A. They provide a secure connection between a client and LTM

B. They enable granular control of traffic
C. They can be used as templates for creating new applications
D. They can use Active Directory to authenticate and authorize users
E. They provide an automated way to create LTM objects
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 6
APM provides access control lists at which two OSI layers? (Choose two.)
A. Layer 5
B. Layer 4
C. Layer 7
D. Layer 6
E. Layer 2
Correct Answer: BC
Section: (none)
Explanation
Explanation:
QUESTION 7
TMOS is an F5 software module that runs on the BIG-IP platform.
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
TMOS is multi-module OS on Big-IP platform
QUESTION 8
Which four F5 products are on the TMOS platform? (Choose four.)
A. ARX
B. GTM
C. WOM
D. APM
E. ASM
F. Firepass
Correct Answer: BCDE

Section: (none)
Explanation
Explanation:
QUESTION 9
Which of the following is NOT a profile type on the BIG-IP?
A. Protocol
B. Application
C. Persistence
D. Authentication
E. SSL
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 10
The BIG-IP determines the lowest connection speed between the client and the server and then uses that for
both connections.
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 11
Another name for the F5 OneConnect feature is TCP multiplexing.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 12
LTM runs on______F5's proprietary product platform. (Fill in the correct answer)
A. ARX
B. Firepass
C. Acopia
D. TMOS
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 13
Which programming language is the basis for F5 iRules?
A. Lisp
B. C++
C. Java
D. TCL
E. AWK
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 14
What are the two most common methods of placing a BIG-IP device into a network environment? (Choose
two.)
A. Channeled configuration
B. VLAN configuration
C. NAT configuration
D. SNAT configuration
E. Asymmetric configuration
F. Routed configuration
Correct Answer: DF
Section: (none)
Explanation
Explanation:
QUESTION 15
Which of the following is NOT a benefit of using SSL offload?
A. It increases the bandwidth between the client and LTM.

B. It enables LTM to decrypt traffic, examine the payload, and then re-encrypt before sending it to a pool
member.
C. The organization requires far less SSL certificates.
D. The CPU processing load on backend servers is reduced.
E. It enables iRules to be used on traffic arriving to LTM that is encrypted.
Correct Answer: A
Section: (none)
Explanation
Explanation:
SSL offload:
It enables LTM to decrypt traffic, examine the payload, and then re-encrypt before sending it to a pool member.
The organization requires far less SSL certificates.
The CPU processing load on backend servers is reduced.
It enables iRules to be used on traffic arriving to LTM that is encrypted.
QUESTION 16
When using a routed configuration, the real server must point to the LTM as the ________.
A. NTP Server
B. DNS Server
C. Virtual IP
D. WINS server
E. Default gateway
Correct Answer: E
Section: (none)
Explanation
Explanation:
QUESTION 17
TCP Express is licensed separately from LTM
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
TCP Express is licensed including in LTM
QUESTION 18
LTM can only load balance outbound traffic by using iRules
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 19
Which two of these statements about OneConnect are true? (Choose two.)
A. It decreases the CPU load on LTM

B. It aggregates multiple client connections into a single server connection
C. It decreases the amount of traffic between multiple clients and LTM
D. It requires SNAT to be configured
E. It decreases the CPU load on pool members
Correct Answer: BE
Section: (none)
Explanation
Explanation:
QUESTION 20
GTM solves which three of these standard DNS limitations? (Choose three.)
A. It can verify that a host is available before resolving a host name for a client.
B. It can use HTTPS for the connection between itself and the client.
C. It can ensure that clients remain at the same data center for stateful applications.
D. It can verify that a client does not have any viruses before sending the IP address.
E. It has more complex load balancing methods.
Correct Answer: ACE

Section: (none)
Explanation
Explanation:
GTM solves three of these standard DNS limitations

It can verify that a host is available before resolving a hostname for a client
It can ensure that clients remain at the same data center for stateful applications
It has more complex load balancing methods
QUESTION 21
Using IP Geolocation, an organization can always direct a client request from France to a datacenter in Dublin.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 22
Which three of these software modules can you layer on top of LTM on a BIG-IP device? (Choose three.)
A. Web Accelerator
B. APM
C. ARX
D. GTM
E. Firepass
F. Enterprise Manager
Correct Answer: ABD

Section: (none)
Explanation
Explanation:
These software modules can you layer on top of LTM on a BIG-IP device are AAM, APM and GTM.
QUESTION 23
Customers can purchase LTM as a stand-alone product, or layer it with additional software modules to increase
the functionality of the BIG-IP device.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 24
Which two of the following options can LTM use when all of the pool members are not available or if the pool is
overloaded?
A. Floating IPs
B. Fallback host
C. Auto last hop
D. SNAT automap
E. Pool offload
F. Priority group activation
Correct Answer: D
Section: (none)
Explanation
Explanation:
http://support.f5.com/kb/en-us/products/bigip_ltm/manuals/product/ltm_configuration_guide_10_0_0/
ltm_pools.html
QUESTION 25
The least connections load balancing method functions best when all pool members share similar
characteristics.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 26
FILL BLANK
The layer 3 security feature _______ Cookies that protects against SYN floods, DoS, and DDoS attacks. (Fill
in)
Correct Answer: contain -or- include

Section: (none)
Explanation
QUESTION 27
A top-level DNS zone uses a CNAME record to point to a sub-zone. Which of the following is an example of a
sub-zone?
A. www.F5.com/sub
B. www.F5.com
C. www.gslb.F5.com
D. .com
E. f5.com
Correct Answer: C
Section: (none)
Explanation
Explanation:
QUESTION 28
FILL BLANK
A _______ object maps a FQDN to virtual servers. (Fill in)
Correct Answer: Wide IP

Section: (none)
Explanation
QUESTION 29
Which three of the following must be done in order for GTM to properly communicate LTM? (Choose three.)
A. Connect the GTM and LTM with a network crossover cable.

B. Synchronize the big3d versions between GTM and LTM.
C. Add the LTM object to the GTM configuration.
D. Configure the GTM and LTM to we MAC masquerading.
E. Ensure that GTM and LTM use the same floating IP address.
F. Exchange SSL certificates between the two devices.
Correct Answer: BCF

Section: (none)
Explanation
Explanation:
Integrating LTM systems with GTM systems on a network

Running the bigip_add utility
Determine the self IP addresses of the BIG-IP LTM systems that you want to communicate with BIG-IP GTM.
Run the bigip_add utility on BIG-IP GTM. This utility exchanges SSL certificates so that each system is
authorized to communicate with the other.
When the LTM and GTM systems use the same version of the big3d agent, you run the bigip_add utility to
authorize communications between the systems.
http://support.f5.com/kb/en-us/products/big-ip_gtm/manuals/product/gtm-implementations11-3-0/7.html
Note:
The BIG-IP GTM and BIG-IP LTM systems must have TCP port 4353 open through the firewall between the
systems. The BIG-IP systems connect and communicate through this port.
QUESTION 30
DNSSEC is a GTM add-on licensing feature.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 31
FILL BLANK
GTM uses the F5 ___________ protocol to synchronize performance metrics between GTM devices. (Fill in)
Correct Answer: iQuery

Section: (none)
Explanation
QUESTION 32
Which four of the monitoring methods listed below can GTM use to determine the status and performance of
BIG-IP and servers? (Choose four.)
A. ping
B. Application monitors
C. Inband monitors
D. SSH
E. iQuery
F. SNMP
Correct Answer: ABEF

Section: (none)
Explanation
Explanation:
http://support.f5.com/kb/en-us/products/big-ip_gtm/manuals/product/gtm-concepts-11-30/1.html
Configuring
GTM to determine packet gateway health and availability
http://support.f5.com/kb/en-us/products/big-ip_gtm/manuals/product/gtm-implementations11-5-0/9.html
sol13690:
Troubleshooting BIG-IP GTM synchronization and iQuery connections (11.x)
http://support.f5.com/kb/en-us/solutions/public/13000/600/sol13690.html
QUESTION 33
What happens when the data center that GTM recommends for a client is unavailable?
A. GTM uses cached information to determine an alternate route.

B. GTM queries the local DNS server.
C. GTM sends subsequent queries to the next preferred data center.
D. GTM directs the client to use its DNS cache to select an alternate location.
E. The client continues to attempt to access the preferred data center.
Correct Answer: C
Section: (none)
Explanation
Explanation:
QUESTION 34
GTM can load balance to LTM in addition to non-BIG-IP hosts.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
QUESTION 35
Which of the following is NOT included on the F5 DevCentral site?
A. Subscription purchasing options

B. Actual iRules written by other customers
C. iRules reference materials
D. Forums
E. The F5 iRule editor
Correct Answer: A
Section: (none)
Explanation
Explanation:
Subscription purchasing options is in Partner Resource Center
QUESTION 36
If LTM uses the least connections load balancing method, which pool member in the following diagram receives
the next request?
A. A
B. B
C. C
D. D
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 37
Why does deploying LTM into an existing network immediately improve security?
A. Only requests for specific ports are allowed through LTM.

B. All traffic through LTM is checked for DDoS attacks.
C. No traffic A allowed through LTM until it has been specified.
D. All users must authenticate before accessing applications through LTM.
E. Only LAN administrators can access resources through LTM.
Correct Answer: C
Section: (none)
Explanation
Explanation:
QUESTION 38
You can use an HTTP class profile to forward traffic that matches which three of these types of criteria?
(Choose three.)
A. Port
B. HTTP header
C. URI path
D. User name
E. Protocol
F. Host name
Correct Answer: BCF

Section: (none)
Explanation
Explanation:
QUESTION 39
When an optimized TCP connection exists between LTM and the pool member, LTM can accept server
responses faster than the client. What is the name of this feature?
A. HTTP caching
B. OneConnect
C. TCP connection queuing
D. Content spooling
E. Priority activation
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 40
As a full TCP proxy, LTM acts as the termination point for both requests from the client and responses from the
server.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 41
FastCache will NOT work with compressed objects.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 42
Which of the following can be accomplished using iRules?
A. Track inbound and outbound traffic

B. Perform deep packet inspection
C. Inspect traffic and drop it
D. All of the above
E. Intercept traffic and redirect it
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 43
GTM uses Auto Discovery to add virtual servers from both LTM and non-BIG-IP load balancers.
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 44
Which four of the following statements about LDNS probes are true? (Choose four.)
A. Only GTM devices can act as a prober.

B. They check each requesting LDNS that has made a request of the GTM.
C. They can determine available cache size on the client.
D. They are used to develop path metrics.
E. They verify the link between a data center and an LDNS.
F. Probing only takes place if GTM is configured to use dynamic load balancing.
Correct Answer: BDEF

Section: (none)
Explanation
Explanation:
QUESTION 45
Similar to LTM monitors, GTM monitors use both an Interval and a Timeout value.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 46
Since F5 built GTM on the TMOS platform it can exist on the same BIGIP device as LTM:
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 47
An administrator is adding GTM to the network infrastructure. Which of the following requirements would lead
them to select an Authoritative Screening architecture rather than Delegation?
A. They want GTM to examine all DNS queries.

B. They want GTM to make load balancing decisions based on metrics.
C. They have data centers in several countries.
D. They are using several operating systems for the local DNS servers.
Correct Answer: C
Section: (none)
Explanation
Explanation:
QUESTION 48
The BIG-IP full proxy architecture has full visibility from the client to the server and from the server to the client.
What security benefit does this provide to customers?
A. Offloads security functionality from other devices such as network firewalls and Intrusion Prevention
Systems (IPS), which may experience performance degradation when inspecting DNS queries and
responses.
B. provides enhanced support for DNS servers.
C. Establishes highly detailed policies based on your customer's business in requirements, performs multiple
factors of authentication, detects corporate versus non-corporate devices, checks OS patch levels, and
determines antivirus patch levels.
D. Provides industry-leading knowledge of application behavior as it travels through a network, and it applies
that knowledge to security because it knows how an application behaves at any point in the reply request
process
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 49
Select the key reasons F5 is able to handle DNS DDoS attacks so effectively? Select two.
A. F5 can ensure a DNS DDoS attack is not successful.

B. F5 has high performance DNS services.
C. F5 can answer the DNS queries directly.
D. With Global Traffic Manager (GTM), F5 completely stops all DNS DDoS attacks.
E. F5 can ensure a customer never faces a DNS DDoS attack.
Correct Answer: CE
Section: (none)
Explanation
Explanation:
QUESTION 50
Which of the following are the three main business drivers for placing LTM into a network? (Choose three.)
A. Secure the connection between WAN sites.

B. Improve application availability and scalability.
C. Authenticate and authorize users.
D. Boost application performance.
E. Include application security.
F. Act as a Web application firewall
Correct Answer: BDE

Section: (none)
Explanation
Explanation:
QUESTION 51
If a customer has an application that uses a customized protocol, what LTM feature can help optimize the traffic
from the application?
A. iRules
B. Network virtual servers
C. HTTP classes
D. Packet filtering
E. Transparent virtual servers
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 52
An LTM object represents a downstream server that hosts a secure Web site and contains the IP address and
port combination 192.168.9.250:443. What is this object?
A. Self IP
B. Virtual Server
C. Pool
D. Node
E. Pool Member
Correct Answer: E
Section: (none)
Explanation
Explanation:
QUESTION 53
Adding more RAM to a GTM device drastically improves query performance.
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 54
Which of the following are four of the security benefits of TMOS? (Choose four.)
A. It verifies traffic based on antivirus signatures.

B. It provides protection against DDoS.
C. It uses SYN cookies and dynamic connection reapers.
D. It supplies guidance for poorly developed applications.
E. It denies all traffic that hasn't been defined.
F. It can hide confidential information from outbound traffic.
Correct Answer: BCEF

Section: (none)
Explanation
Explanation:
QUESTION 55
The LTM "Manager" authentication role can create iRules.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 56
Which of the following statements about cookie persistence is NOT true?
A. The cookie's timeout value can be customized.

B. They are F5'spreferred persistence method.
C. No persistence information is placed on LTM.
D. Web servers must be configured to send cookies to clients.
E. They do not add a performance impact on LTM.
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 57
An LTM object that represents a downstream server contains the IP address 192.168.9.250 and no port. What
is this object?
A. Pool member
B. Virtual server
C. Pool
D. Self IP
E. Node
Correct Answer: E
Section: (none)
Explanation
Explanation:
QUESTION 58
Which three of the metrics listed below can GTM use when making load balancing decisions for a client?
(Choose three.)
A. TCP payload
B. IP geolocation
C. Hop count
D. Round trip time
E. Browser user agent
Correct Answer: BCD

Section: (none)
Explanation
Explanation:
QUESTION 59
In order to improve GTM performance, administrators should use multiple complex monitors to ensure
resources are functioning properly:
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 60
Which three of the following are unique differentiators for F5 in the marketplace? (Choose three.)
A. VLANs
B. Load-balancing pools
C. Secure remote access
D. TMOS
E. OneConnect
F. iRules
Correct Answer: DEF

Section: (none)
Explanation
Explanation:
QUESTION 61
Which three of these file types work well with HTTP compression? (Choose three.)
A. MP4 videos
B. Digital photos
C. Text files
D. Static HTML Web pages
E. CD quality songs
F. Microsoft Word documents
Correct Answer: CDF

Section: (none)
Explanation
Explanation:
QUESTION 62
Match each persistence method with the correct statement describing it:
A. Cookie persistence
B. Source address persistence
C. SSL persistence
D. Universal persistence
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 63
Which two of the following LTM load balancing methods require the least amount of resources? (Choose two.)
A. Round robin
B. Ratio
C. Observed
D. Fastest
E. Predictive
F. Least connections
Correct Answer: AB
Section: (none)
Explanation
Explanation:
QUESTION 64
When using a redundant pair of LTMs, it is most advantageous to use them in an Active/Active scenario
because this provides additional load balancing capabilities.
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 65
An LTM object contains both IP address and port combinations 20.18.9.250:80 and 20.18.9.251:80 and host
the same Web application. What is this object?
A. Pool
B. Self-IP
C. Node
D. Pool member
E. Virtual Server
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 66
Which of the following are four of the benefits of the TMOS architecture? (Choose four.)
A. User authentication
B. Server-side optimization
C. Dynamic DDoS protection
D. Web application security
E. Client-side optimization
F. Antivirus checking

Section: (none)
Explanation
Explanation:
QUESTION 67
In order to further accelerate applications, the external router can direct subsequent client traffic to bypass LTM
and communicate directly with the server.
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
QUESTION 68
FILL BLANK
LTM runs on________F5's proprietary product platform. (Fill in the correct answer)
Correct Answer: TMOS

Section: (none)
Explanation
QUESTION 69
When using only LTM in redundant pairs, a customer can load balance to multiple data centers.
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 70
Application templates save the time it typically takes to create nodes, pools, pool members, virtual servers, and
monitors.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 71
Which of the following TMOS feature enables BIG-IP to scale performance based to the available CPU cores?
A. Clustered multi-processing
B. OneConnect
C. HTTP class
D. Session persistence
E. Auto Last Hop
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 72
In a routed configuration, what does LTM do with the packet before sending it to the pool member?
A. Change the source IP and the destination IP address
B. Leave it unchanged and forward it
C. Change the source IP address
D. Change the destination IP address
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 73
If the BIG-IP device is NOT always located between the client and the server, it will NOT provide full
optimization and security.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 74
TCP Express enables LTM to use different TCP settings for the connection between the client and LTM, and
the connection between LTM and the pool member.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 75
Where do you configure GTM client persistence?
Case Study Title (Case Study):
A. On a DNS listener object

B. On a wide IP object
C. Within a load balancing method
D. On a DNS pool object
E. On a virtual server object
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 76
Administrators can configure which three of the following load balancing options in GTM? (Choose three.)
A. Alternate
B. Fallback
C. Required
D. Preferred
E. Backup
F. Optional
Correct Answer: ABD

Section: (none)
Explanation
Explanation:
QUESTION 77
Over the years, F5 has led the industry in which of the four following areas? (Choose three.)
A. Security
B. Acceleration
C. Application availability
D. Application scalability
E. Application design
F. Remote access
Correct Answer: ABD

Section: (none)
Explanation
Explanation:
QUESTION 78
Which of the following is NOT a method that TMOS uses to improve the performance of applications?
A. Caching HTTP data

B. Optimizing the TCP connection between the client and the BIG-IP device
C. Offloading SSL decryption from downstream servers
D. Discarding unnecessary data from server responses before sending to the client
E. Compressing HTTP data
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 79
The drawback to having BIG-IP act as a full application proxy is the decrease in application performance.
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 80
The Policy Builder benefits include:
A. Doesn't require in depth web application knowledge

B. Only requires limited ASM knowledge
C. All of the above
D. Very low administrative impact
Correct Answer: C
Section: (none)
Explanation
Explanation:
QUESTION 81
CSRF is difficult to detect because:
A. The attacks are requests a user should be allowed to make

B. The attacks always utilize obfuscation
C. The attacks are always encrypted
D. All of the above
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 82
Information leakage is a major obstacle to achieving PCI DSS compliance.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 83
Requests that do not meet the ASM security policies can:
A. Generate learning suggestions
B. Be blocked
C. All of the above
D. Be logged
Correct Answer: C
Section: (none)
Explanation
Explanation:
QUESTION 84
What is NOT a benefit of using a SNAT?
A. ASM can be deployed easily

B. No changes are needed on the servers
C. Fail open is easy to add
D. Higher performance than other configuration
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 85
ASM's Web Scraping protection:
A. Is simple to configure
B. Cannot accommodate good scrapers
C. Will protect the site by blocking all requests
D. Is difficult to configure
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 86
The PCI compliance report is proof that a company is secure.
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 87
ASM offers the most extensive, effective, and simplest to configure CSRF protection in the WAF market.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 88
The APM Dashboard enables administrators to monitor which two of these metrics? (Choose two.)
A. Number of active sessions

B. Number of new sessions
C. Number of denied users
D. Number of users from each country
Correct Answer: AB
Section: (none)
Explanation
Explanation:
QUESTION 89
Although APM can interoperate with LTM, it is unable to use iRules for advanced processing.
A. True
B. false
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 90
APM provides access control lists at which two 051 layers
A. Layer 6
B. Layer 5
C. Layer 7
D. Layer 4
E. Layer 3
F. Layer 2
Correct Answer: CD
Section: (none)
Explanation
Explanation:
QUESTION 91
Which of the following statements about Web server offload is NOT true?
A. It performs rate shaping to reduce overflow.

B. It forces the client browser to use multiple connections streams.
C. It uses OneConnect to reduce multiple TCP connections.
D. It utilizes cached content to prevent unnecessary trips for the same content.
E. It uses specialized hardware for SSL offload.
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 92
A network administrator tells you that they do NOT need WebAccelerator because their Web application is fine.
What is your best response?
A. Challenge them to run performance testing on their Web site.

B. Access their Web site with them to display its response.
C. Request a follow up meeting within the next three months.
D. Ask for an opportunity to speak with the CIO or a member of their Web application team.
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 93
When sizing a WebAccelerator deployment, you should base the WA capacity on the LTMcapacity.
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 94
Which three of the following are benefits of adding WebAccelerator to the network infrastructure? (Choose
three.)
A. It adds a layer, security to a Web site

B. It speeds up a secure Web site
C. It reduces the need to purchase additional bandwidth
D. It analyzes Web content, and caches and compresses it accordingly
E. It improves the performance, large object file transfers
Correct Answer: BCD

Section: (none)
Explanation
Explanation:
QUESTION 95
IP Enforcer blocks IP addresses that have repeatedly and regularly attacked the site.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 96
One reason APM beats the competition is its ability to perform both user authentication and authorization on a
single device.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 97
Which three of these scenarios should you identify as being an APM opportunity? (Choose three.)
A. An organization using Novell Netware for authentication.

B. An organization that has been recently fined for failing security compliance.
C. An organization with a traveling sales force.
D. An organization with a single location and no remote employees.
E. An organization that needs to ensure users are using Symantec antivirus software.
F. An organization sharing a public Web site for all Internet users.
Correct Answer: BCE

Section: (none)
Explanation
Explanation:
QUESTION 98
When an administrator creates a new access policy in the Visual Policy Editor, which three options are included
by default? (Choose three.)
A. A fallback option
B. An Allow Ad box
C. A Deny End box
D. An empty Resource Assign item
E. A Start box
F. A Block All option
Correct Answer: ACE

Section: (none)
Explanation
Explanation:
QUESTION 99
Poor Web application performance contributes to which four of these issues for businesses? (Choose four.)
A. A Web site that goes unused

B. Increased support calls
C. Loss of users
D. Loss of revenue
E. DDoS attacks
F. Identity theft
Correct Answer: ABCD

Section: (none)
Explanation
Explanation:
QUESTION 100
Organizations are moving towards a cloud solution are good candidates for F5 WOM solutions.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 101
Using WOM for vMotion transfers across the WAN prevents VMware users from experiencing interruptions.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 102
The administrator must specify APM access control entries as either L4 or L7.
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 103
Administrators can customize APM to resemble other internal Web applications in the organization.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 104
Which of the following is a client-side action in the Visual Policy Editor that prevents external access and
deletes any files created during a secure access session?
A. Windows Group Policy

B. Resource Assign
C. Protected Workspace
D. Virtual Keyboard
E. Browser Cache and Session Control
Correct Answer: C
Section: (none)
Explanation
Explanation:
QUESTION 105
The main drawback to using an APM Deployment Wizard is that it is not possible to edit the resulting objects,
including the access policy.
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 106
Mobile device browsers typically display Web pages more slowly than PC browsers.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 107
Which two of the following factors are often responsible for poor Web application performance? (Choose two.)
A. The time it takes to generate an HTTP request.

B. The time it takes to deliver the HTTP response over the network.
C. The time it takes to display the HTTP response in the browser.
D. The time it takes to generate the HTTP response.
Correct Answer: BD
Section: (none)
Explanation
Explanation:
QUESTION 108
WebAccelerator uses three tiers to improve performance. What are the three tiers? (Choose three.)
A. Bandwidth offload
B. Client offload
C. Application offload
D. Protocol offload
E. Web server offload
F. Network offload
Correct Answer: CEF

Section: (none)
Explanation
Explanation:
QUESTION 109
ASM can detect Layer 7 DoS attacks by which four ways of monitoring: (Choose four.)
A. Monitoring for a threshold of increased number of transactions per second per URL.
B. Monitoring for a % change in transactions per second per URL.
C. Monitoring for a % change in server latency or TPS.
D. Monitoring for a threshold of increased server latency or TPS.
E. Monitoring ASM policy builder performance.
F. Monitoring BIG-IP CPU utilization.
G. Deep Packet inspection.
Correct Answer: ABCD

Section: (none)
Explanation
Explanation:
QUESTION 110
Application trends and drivers that increase the need for application security are:
A. Intelligent Browsers
B. Webification
C. Targeted attacks
D. All the above
Correct Answer: D
Section: (none)
Explanation
QUESTION 111
The Rapid Deployment Policy is used to:
A. Improve website performance

B. Quickly protect web sites for most common attacks
C. Improve ASM performance
D. Provide wizard functionality for quick policy creation
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 112
ASM combined with LTM provides protection against:
A. Layer 7 DoS attacks

B. All of the above
C. Layer 4 DoS attacks
D. DDoS attacks
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 113
When using a single BIG-IP with APM, an organization can support up to 60,000 concurrent remote access
users.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 114
An F5 customer must install WebAccelerator on top of LTM:
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 115
The Protected Workspace client-side action provides more client-side security than the Cache and Session
Control action.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 116
Which WOM feature replaces a long byte pattern, such as "100000111000110101", with a shorter reference to
the pattern?
A. Symmetric adaptive compression

B. Symmetric data deduplication
C. Bandwidth allocation
D. Application protocol acceleration
E. TCP optimization
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 117
In order to ensure that a specific file type is never moved down to a secondary file tier, the administrator should:
A. Set up an automated bot that accesses that file once a week.

B. This is not possible on the ARX.
C. Set a policy that the file type remains on primary storage.
D. Instruct the end users to put the file in a non-tiered directory.
Correct Answer: C
Section: (none)
Explanation
Explanation:
QUESTION 118
How does the ARX eliminate the disruption caused by re-provisioning storage?
A. By identifying data that has not been modified and moving it to a secondary tier.
B. By reducing the time necessary to run a complete backup.
C. By allowing system administrators to apply policy to specific types data.
D. By automating capacity balancing and allowing seamless introduction of file systems into the environment
after the ARX is installed.
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 119
Which of the following statements is true about ARX's capacity balancing ability?
A. When new files are created, the ARX can determine in real time where to place each file based on the
available space on each storage device
B. When configuring the ARX, customers can choose to implement either an age-based policy or a capacity
based policy, but are not able to run both policies at the same time
C. All files created at approximately the same time (within 10 minutes) will be stored on the same tier of
storage to minimize latency and improve the user experience
D. The ARX balances capacity within tiers A storage, but cannot balance capacity across tiers of storage
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 120
The Device Inventory option in Enterprise Manager can replace an organization's static Excel spreadsheet
containing similar data.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 121
Which of the following statements best describes the ARX architecture?
A. The ARX's split path architecture has a data path that handles the most common operations, and a control
path that handles other operations requiring deeper inspection and updating of the index.
B. The ARX's architecture has redundancy built in, allowing a single ARX to be deployed in most use cases
which provides a huge cost savings to customers.
C. All of the above.
D. It is a software agent that installs on the storage device.
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 122
The ARX is like a mini network manager. It is able to check the health of the environment and can raise alerts
when thresholds are reached.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 123
Which two of the following are costs businesses may face in dealing with unstructured data? (Choose two.)
A. Lost productivity due to server downtime

B. Buying backup media
C. Buying additional storage capacity
D. Paying to convert unstructured data into structured data
Correct Answer: BC
Section: (none)
Explanation
Explanation:
QUESTION 124
DRAG DROP
Place the following items in the order that the BIG-IP device uses when processing a packet.
Select and Place:
Correct Answer:
Section: (none)
Explanation
QUESTION 125
In the current version of BIG-IP, what happens if the GTM does not find a wide IP that matches the DNS
request?
A. It sends a broadcast request to all GTM devices.

B. It uses iQuery to request the information from LTM.
C. It sends a request to its configured backup GTM device.
D. It sends an un-resolvable error to the client.
E. It sends the request to an external DNS.
Correct Answer: E
Section: (none)
Explanation
Explanation:
QUESTION 126
Using IP Geolocation, an organization can always direct a client request from France to a data enter in Dublin.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 127
In most cases, F5 recommends using round robin load balancing.
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
Using round robin load balancing is recommended when Server is not so strong and using easy
WebApplication.
QUESTION 128
Which three of the following statements describe a data center object?
A. It attempts to match a DNS request with a configured wide IP.

B. It is attached to multiple Internet links.
C. It becomes available for use when an assigned server is up.
D. It retains statistics for each data center.
E. It is a logical representation of a physical location.
F. It specifies how users access the Internet.
Correct Answer: BC
Section: (none)
Explanation
Explanation:
QUESTION 129
Which four of the following items are physical objects used by GTM?
A. Virtual servers
B. Links
C. Servers
D. Wide IPs
E. Data centers
F. Pools
Correct Answer: ABCE

Section: (none)
Explanation
Explanation:
These components include:

Data centers, Servers, Links, Virtual servers
http://support.f5.com/kb/en-us/products/bigip_gtm/manuals/product/gtm_config_10_2/
gtm_components_overview.html
Links
+ Wide IPs + Data centers + Pools
Links
+ Wide IPs + Data centers + Virtual servers
Links
+ Servers + Virtual servers + Pools the physical network, such as data centers, servers, and links, and the
components that comprise the logical network, such as wide IPs, pools, and global settings. Most of the
configuration components you build using the Configuration utility are saved to the wideip.conf file.
Logical objects/components include: Listeners - Pools - Wide IPs - Distributed applications
QUESTION 130
Which three are GTM server dynamic load balancing modes? (Choose three.)
A. Packet Rate
B. Virtual Server Score
C. CPU
D. Fallback IP
E. Ratio
Correct Answer: ABC

Section: (none)
Explanation
Explanation:
The Global Traffic Manager supports the following dynamic load balancing modes:
Completion Rate
CPU
Hops
Kilobytes/Second
Least Connections
Packet Rate
Quality of Service (QoS)
Round Trip Times (RTT)
Virtual Server Score
VS Capacity
QUESTION 131
Which four are GTM server static load balancing modes? (Choose four.)
A. Return to DNS
B. CPU
C. Packet Rate
D. Drop Packet
E. Round Robin
F. Static Persist
Correct Answer: ADEF

Section: (none)
Explanation
Explanation:
Global Traffic Manager supports the following static load balancing modes:
Drop Packet
Fallback IP
Global Availability
None
Ratio
Return to DNS
Round Robin
Static Persist
Topology
QUESTION 132
The F5 Application Delivery Firewall has the ability to outperform traditional and next generation firewalls during
DDoS attacks by leveraging the performance and scalability of BIG-IP to hand extremely high loads, including
high throughput, high connection count, and high number of connections per second.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 133
What is the main cause of high latency in a Web application?
A. The version, the client's browser

B. The distance between the client and Web server
C. The number of CPUs on the Web server
D. The size of the objects on the page
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 134
DRAG DROP
Match these terms with their description.
Select and Place:

Correct Answer:
Section: (none)
Explanation
Explanation:
QUESTION 135
Network Security personnel are entirely responsible for web application security.
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 136
ASM Geolocation reporting provides information regarding:
A. The number of attacks from a specific state

B. The types of attacks from a city
C. All of the above
D. The countries from which the attacks originated
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 137
An inline ASM configuration requires:
A. Two network connections

B. None of the above
C. Two disk drives
D. Two power supplies
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 138
Which three of these are the potential ending options for branches in the Visual Policy Editor? (Choose three.)
A. Reject
B. Fallback
C. Allow
D. Deny
E. Limit
F. Redirect
Correct Answer: CDF

Section: (none)
Explanation
Explanation:
QUESTION 139
The Protected Workspace client-side action provides more client-side security than the Cache and Session
Control action.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 140
Which of the following is NOT a logging option within an APM access control entry?
A. Packet
B. Verbose
C. Nominal
D. Summary
E. None
Correct Answer: C
Section: (none)
Explanation
Explanation:
QUESTION 141
Administrators can specify an APM access profile when defining a virtual server in LTM.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 142
Using Fast Cache with ASM will:
A. Improve user experience

B. Improve server performance
C. All of the above
D. Improve BIG-IP ASM performance
Correct Answer: C
Section: (none)
Explanation
Explanation:
QUESTION 143
ASM provides antivirus protection by:
A. Extracting files being uploaded and sending them to an AV system via ICAP
B. Running a local antivirus program on the BIG-IP
C. None of the above
D. Using IP Penalty enforcement to block requests from hackers IPs
Correct Answer: A
Section: (none)
Explanation
Explanation:
Supported ICAP Servers in TMOS 11.5:
QUESTION 144
APM can verify which four of the following details before granting a user access to a resource? (Choose four.)
A. The user's Web browser

B. The user's computer
C. User's hard drive encryption software
D. Groups the user is a member of
E. The network speed
F. The user's username
Correct Answer: ABDF

Section: (none)
Explanation
Explanation:
QUESTION 145
Which four of these benefits does APM provide? (Choose four.)
A. Enables remote access by several thousand simultaneous users.

B. Basic Web application firewall capabilities.
C. User authentication based on identity.
D. Acceleration of Web content to the client.
E. Granular authorization to resources.
F. Client workstation security checking.
Correct Answer: ACEF

Section: (none)
Explanation
Explanation:
QUESTION 146
Which four of these statements regarding object size and WebAccelerator performance are true? (Choose
four.)
A. Large objects such as video cache well

B. Large objects allow fewer requests per second
C. Large objects result in higher throughput
D. Small objects result in higher throughput
E. Small objects such as images cache well
F. Small objects allow more requests per second
Correct Answer: BCEF

Section: (none)
Explanation
Explanation:
QUESTION 147
Which four of these scenarios will benefit from F5's WAN Optimization Module? (Choose four.)
A. An international organization with data centers in different countries.

B. An organization that does not want to rely on using tape backup.
C. An organization with one site but hundreds of Web servers.
D. An organization whose users create extremely large files.
E. An organization that expects their Web site usage to double in the next year.
F. An organization attempting to lower costs by reducing the number of data centers.

Section: (none)
Explanation
Explanation:
QUESTION 148
An administrator is planning on solving latency issues by placing the backup data center in a neighboring city to
the primary data center. Why isn't this effective solution?
A. It does not provide an acceptable disaster recovery solution.

B. It won't improve latency between the data centers.
C. It won't improve the backup time from the primary data center to the backup data center.
D. Users near the data centers will find their connections going back and forth between the two site
E. It costs more to have the data centers close together than further apart.
Correct Answer: A
Section: (none)
Explanation
Explanation:
It does not provide an acceptable disaster recovery solution, it is too close in proximity
QUESTION 149
Which is NOT an ASM protection method for cross site scripting?
A. Signatures
B. URI character set limiting
C. Token injection
D. Parameter character set limiting
Correct Answer: C
Section: (none)
Explanation
Explanation:
QUESTION 150
Which item is NOT a function of a properly deployed and configured ASM?
A. Detects attacks
B. Stops hackers from attacking
C. Provides protection visibility
D. Provides security agility
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 151
Which is NOT a function of ASM?
A. Attack signature enforcement

B. HTTP protocol enforcement
C. Network security
D. Parameter value enforcement
Correct Answer: C
Section: (none)
Explanation
Explanation:
QUESTION 152
True or False, WOM speeds up large file data transfer across the WAN between a Windows client and a
Windows file Server.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 153
Which item is NOT a function of ASM?
A. Provides authentication and authorization services

B. Logs and reports full HTTP messages
C. Provides comprehensive Web application security
D. Provides application level performance information
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 154
Learning suggestions can be the result of:
A. A false positive
B. A malicious attack
C. A change in the web site content
D. All the above
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 155
Identifying users by their IP address is a sufficient method of performing authentication and authorization.
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 156
A user's access to resources can change based on the computer they connect from.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 157
Replicating a large database between sites could take several hours without WOM, and only several minutes
with WOM.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 158
Brute force protection will:
A. Block a user after a specified number, unsuccessful login attempts

B. Block a user after a specified number of page requests are attempted
C. None of the above
D. Block a user from downloading too much content from the site
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 159
What technology does ARX use to create a logical abstraction of the physical storage environment?
A. Data de-duplication
B. File virtualization
C. Server virtualization
D. SSL encryption
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 160
Using file virtualization, what can the ARX do for customers?
A. Match data to the most appropriate tier of storage (e.g. critical data on tier 1 storage; older data on
secondary storage tier).
B. All of the above.
C. Move individual files or entire file systems in real-time without disruption of down-time.
D. Automate many storage management tasks such as storage tiering, dynamic capacity balancing, and no
disruptive data migration.
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 161
A customer says his business wouldn't benefit from buying ARX because it already has block based storage
virtualization in place. Is he right? Why or why not?
A. Yes. Block based storage virtualization is just another name for file virtualization.
B. No. ARX allows customers to implement storage tiering benefits, but block based storage virtualization does
not.
C. Yes. Block based storage virtualization offers the same functionality as ARX's file virtualization, although it
uses slightly different technology.
D. No. Both technologies attempt to solve similar problems, but only the ARX allows the customer to have
visibility into their data and apply business policy at the file level. Block based virtualization has no visibility
into the type of data.
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 162
Select F5 platforms have which three certifications? (Choose three.)
A. FIPS
B. SECG
C. NEBS
D. IEEE
E. Common Criteria
F. AFSSI
Correct Answer: ACE

Section: (none)
Explanation
Explanation:
QUESTION 163
Which three of the following are some of the methods that F5 uses with its environmental stress screening
chamber? (Choose three.)
A. Varying the voltage from extreme high to extreme low.

B. Running a product 300 to 500 times on each cycle.
C. Repairing failed components until they function properly.
D. Alternate temperature from -5 degrees Celsius to 60 degrees Celsius.
E. Ensuring continual functioning through fire or flooding conditions.
Correct Answer: ABD

Section: (none)
Explanation
Explanation:
QUESTION 164
The ARX can see ________ when a data modification takes place and will cue that file to be migrated back to
the primary tier.
A. In real time
B. Nightly
C. Weekly
D. At the time of a system scan
E. When scheduled by administrator
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 165
DRAG DROP
Match the five elements of the intelligent file virtualization with the appropriate ARX feature:
Select and Place:

Correct Answer:
Section: (none)
Explanation
QUESTION 166
ARX can classify data based on all of the following EXCEPT:
A. Paths
B. File Size
C. Extensions
D. Security Level
E. File Name
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 167
For a typical business, what percentage of data does the ARX usually move to a secondary tier?
A. 20-30%
B. 50-60%
C. 80-90%
D. 0-10%
Correct Answer: C
Section: (none)
Explanation
Explanation:
QUESTION 168
It is common for free storage space to exist somewhere in a business network that is not easy for storage
administrators to utilize. What solution can the ARX provide in this situation?
A. The ARX identifies the exact location of the free storage, which allows network administrators to target
those locations when provisioning additional storage.
B. The ARX extends the capacity of each server by 10-15, through intelligent file virtualization.
C. The ARX uses the extra storage for transaction logs and index files.
D. The ARX allows the customer to pool storage from anywhere within the enterprise and capacity balance the
overflow across devices.
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 169
Which of the following does NOT describe network performance management?
A. Updating software on various devices

B. Seeing graphs in near real-time
C. Visibility into multiple network devices
D. Being alerted to an issue as it happens
E. Viewing virtual server statistics
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 170
What is the main business driver for bringing Enterprise Manager into the network infrastructure?
A. Consolidate management of administrator and user accounts
B. Consolidate management of licenses
C. Consolidate management of SSL certificates
D. Consolidate management of BIG-IP devices
E. Consolidate management of access policies
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 171
To function properly, an Enterprise Manager device is required within each data center.
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 172
Which two F5 platforms include specialized compression hardware? (Choose two.)
A. 4200
B. 3900
C. 1600
D. 11050
E. 6900
F. 8900
Correct Answer: EF
Section: (none)
Explanation
Explanation:
QUESTION 173
ARX will detect any modification to a file on the second tier because all clients are being _______ by the ARX to
get to the storage.
A. Moved
B. Copied
C. Proxied
D. Backed up
E. Deleted
Correct Answer: C
Section: (none)
Explanation
Explanation:
QUESTION 174
In the next few years, 75% of new storage capacity will shift to unstructured data (also known as file data).
Which two of the following are examples of unstructured data? (Choose two.)
A. CAD drawings
B. Location data in a GIS (geographic information system)
C. Customer records and product records in a CRM (customer relationship management) database
D. Microsoft Office and PDF documents
Correct Answer: AD
Section: (none)
Explanation
Explanation:
QUESTION 175
The ARX saves customers time, money and frustration through a stub-based system that makes a slight
modification to each file in order to more efficiently sort and store end user data.
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 176
Which two of the following statements are accurate descriptions of the ARX index? (Choose two.)
A. The ARX index stores the bulk of its data as bit arrays and answers most questions by performing bitwise
logical operations on these bitmaps.
B. The ARX index contains the index keys in sorted order, with the leaf level of the index containing the pointer
to the page and the row number in the data page.
C. The ARX index is the key enabler of transparent data mobility because the ARX tracks where files reside at
all times, from creation through migration and deletion.
D. The ARX index is 100% disposable and can be rebuilt at any point in time without disrupting client or
application access to data.
Correct Answer: BD
Section: (none)
Explanation
Explanation:
QUESTION 177
To share device information with F5 technical support, a customer must either verbally share the information
over the phone or copy and send the information in an Email.
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 178
When installing LTM on different VIPRION performance blades, each instance of LTM needs to be licensed
separately.
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 179
The VIPRION provides hot-pluggable capabilities for which four of these types of hardware? (Choose four.)
A. LCD displays
B. Fan trays
C. Memory
D. Power supplies
E. Performance blades
F. CompactFlash

Section: (none)
Explanation
Explanation:
The VIPRION provides hot-pluggable capabilities for Fan trays, Memory, Power supplies, and Performance
blades
QUESTION 180
A customer wants the best possible throughput but only has a maximum of 3RU rack space. Which F5 platform
should you recommend?
A. BIG-IP 11050
B. VIPRION with only 1 performance blade
C. BIG-IP 8950
D. BIG-IP 8900
E. VIPRION with 4 performance blades
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 181
Which of the following business benefits does storage tiering offer to customers?
A. Reduces time for backups because data on the secondary tier can have a less time intensive backup
policed applied to it.
B. All of the above.
C. Enables customers to apply a more aggressive RTO/RPO for business critical Tier-1 unstructured data.
D. Reduces money spent on storage since the majority of data can be moved to less expensive secondary tier
storage.
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 182
An age-based policy is set up on the ARX that retains only data modified in the last 3 months on tier 1 storage
and moves the rest of the data to secondary storage. What happens when the end user tries to access data
that has not been touched in 6 months?
A. The end user is unaware that the data has been moved to secondary tier storage and is able to access the
data without difficulty.
B. The networking mapping window appears, allowing the end user to re-establish direct access to the data
even though it has been moved to secondary storage.
C. An error message appears saying "File is no longer unavailable."
D. A message appears explaining that the file has been archived, and a link to the new secondary storage tier
location is provided.
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 183
Although not all modules run on all platforms, each F5 hardware platform can run LTM plus at least one
additional software module.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 184
The production version of BIG-IP Virtual Edition is limited to 200 Mbps throughput.
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
The production version of BIG-IP Virtual Edition can be at 25Mbps / 200Mbps / 1Gbps / or 5Gbps throughput
served and maybe higher in the next versions.
QUESTION 185
What percentage of storage in a typical environment is actively used and modified?
A. 5%
B. 50%
C. 25%
D. 10%
E. 90%
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 186
________% of F5 products are sent through thorough software testing before being sold to customers.
A. 100
B. 50
C. 60
D. 80
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 187
Which of these statements about a stream profile is false?
A. It is applied to an HTTP class profile.

B. It is not recommended for telnet traffic.
C. It can replace one data string for another for all traffic going through a virtual server.
D. It applies to both inbound and outbound traffic.
E. It will not inspect HTTP headers when an HTTP profile is present.
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 188
If LTM uses the round robin load balancing method, which pool member in the diagram above will receive the
next request?
A. A
B. C
C. D
D. B
Correct Answer: D
Section: (none)
Explanation
Explanation:
LTM uses the round robin load balancing method so after A will be B.
QUESTION 189
Basic F5 IP Geo location provides which four types of client information? (Choose four.)
A. State
B. Continent
C. Postal code
D. City
E. Carrier
F. Country
Correct Answer: ABEF

Section: (none)
Explanation
Explanation:
State - Country - Continent - City

State - Country - Postal code - City
The BIG-IP system uses geo location software to identify the geographic location of a client or web application
user. The default IP geo location database provides IPv4 addresses at the continent, country, state, ISP, and
organization levels, and IPv6 addresses at the continent and country levels. The database consists of the
following files:
F5GeoIP.dat
F5GeoIPv6.dat
F5GeoIPISP.dat
F5GeoIPOrg.dat
QUESTION 190
All members of a pool must share the same service port?
A. True
B. False
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 191
When using SNAT, which additional IP addresses will the BIG-IP system change? (Choose two.)
A. The source IP address on the client to BIG-IP request packet.

B. The source IP address on the BIG-IP to pool member request packet.
C. The destination IP address on the BIG-IP to pool member request packet.
D. The source IP address on the BIG-IP to client response packet.
E. The destination IP address on the BIG-IP to client response packet.
F. The destination IP address on the pool member to BIG-IP response packet.
Correct Answer: BE
Section: (none)
Explanation
Explanation:
QUESTION 192
Which two of the following statements about how TMOS typically manages traffic between a client and server
are accurate? (Choose two.)
A. It changes the destination address before forwarding a request to the server.

B. It changes the destination address before sending a response to the client.
C. It changes the source address before sending a response to the client.
D. It changes the source address before forwarding a request to the server.
Correct Answer: BD
Section: (none)
Explanation
Explanation:
QUESTION 193
DRAG DROP
Match the security-related term with the correct definition.
1. Demilitarized zone (DMZ)

2. Denial of service (DoS)
3. DNS Express
4. DNS Security Extensions (DNSSEC)
5. Endpoint inspection
Select and Place:

Correct Answer:
Section: (none)
Explanation
QUESTION 194
What feature of the F5 Exchange solution helps administrators to streamline implementation for added security
and granular control?
A. iControl
B. Enterprise Manager
C. iApps
D. WebAccelerator
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 195
Select the key question you would use to ask your customer related to DNS attacks?
A. Do you over-provision your DNS infrastructure?

B. Do you regularly update BIND or some other DNS application to the latest release?
C. Do you rely on your network firewall to protect your DNS server?
D. How do you secure your DNS infrastructure against attacks?
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 196
When a business is hacked, they often lose more than money. What are the other consequences to a business
as a result of being hacked? Select two.
A. Helpful third party reviews of the security needs of the customer's web applications.
B. Valuable free press that occurs as companies address hacking incidents.
C. Penalties related to non-compliance with laws and regulations.
D. Final resolution of all security vulnerabilities of the business' web applications.
E. Loss of customers when slow connections drive customers to competitor's site.
Correct Answer: AD
Section: (none)
Explanation
Explanation:
QUESTION 197
DRAG DROP
Match the security-related term with the correct definition.
1. OWASP Top 10
2. Secure Socket Layer (SSL)
3. Bot
4. Certificate
5. Content scrubbing
Select and Place:

Correct Answer:
Section: (none)
Explanation
QUESTION 198
Complete the statement below by choosing the correct word or phrase to complete the sentence. By identifying
IP addresses and security categories associated with malicious activity, the BIG-IP _______ service can
incorporate dynamic lists of threatening IP addresses into the BIG-IP platform, adding context to policy
decisions.
A. Edge Client
B. iRules
C. LTM
D. IP intelligence
E. iApps
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 199
Even though F5 is an application delivery controller, it can also effectively mitigate attacks directed at the
network layer.
A. True
B. False
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 200
Select the best word or phrase to complete the following sentence.
Using the _______ feature in GTM, F5's Application Delivery Firewall solution can handle a significantly higher
number of queries than traditional DNS servers.
A. DNS Express
B. BIND
C. Site availability request
D. Location-based routing
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 201
If your customer has a policy requirement that cannot be handled in the Visual Policy Editor, what would you
use to supplement the Visual Policy Editor?
A. iApps
B. TMOS
C. iControl
D. iRules
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 202
Which aspect of F5's Intelligent Services Platform helps you extend your security conversation to include
F5professionals and customers?
A. Modular Functionality
B. iApps
C. TMOS
D. DevCentral
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 203
Why is BIG-IP ASM ideally suited to protect against layer 7 attacks, including HTTP and HTTPS/SSL traffic,
when compared to an intrusion prevention system (IPS)?
A. An intrusion prevention system (IPS) is based on Packet Filtering.

B. An IPS doesn't have the visibility into HTTPS traffic. it doesn't understand what applications are in the
network.
C. An IPS only focus on operating system attacks; it doesn't understand what application are in the network.
D. An IPS can only look at overall traffic patterns; it doesn't understand what applications are in the network.
Correct Answer: D
Section: (none)
Explanation
Explanation:
QUESTION 204
The F5 Visual Policy Editor (VPE) is unique to the F5 BIG-IP APM module; no other access management tool
has this capability. Select the features that the VPE provides. Select two.
A. Develop customized reports on user access

B. Customize landing or login pages
C. Establish highly detailed policies based on customer business requirements
D. Configure authentication server objects
E. Perform multiple factors of authentication
Correct Answer: CE
Section: (none)
Explanation
Explanation:
QUESTION 205
The F5 Visual Policy Editor (VPE) is unique to the F5 BIG-IP APM module; no other access management tool
has this capability. Select the features that the VPE provides. Select two.
A. Determines antivirus patch levels

B. Customizes landing or login page
C. Provides vulnerability scanning
D. Checks operating system patch levels
E. Assigns a lease pool address
Correct Answer: AD
Section: (none)
Explanation
Explanation:
QUESTION 206
Select the two best questions you would use to ask your customer about their current web access management
solution. Select two.
A. What impact are slow remote access connections having on productivity?

B. Are you using Google multi-factor authentication?
C. Is user authentication data sitting on partner systems outside your control?
D. Have you standardized on Androids or iPhones?
E. How are you planning to extend Exchange to your mobile users?
F. How do you think a global remote access deployment with integrated acceleration and availability services
might benefit your business?
Correct Answer: AF
Section: (none)
Explanation
Explanation:
QUESTION 207
Data centers often rely on either traditional firewalls or next generation firewalls. Select the core weakness of
the traditional or next generation firewalls when it comes to DDoS attacks.
A. They are limited in amount of connections per second and the amount of sustained connections they can
handle
B. The cost performance ratio of next generation firewalls is too high.
C. The agility of traditional firewalls is too limited when it comes to DDoS attacks.
D. Data center traffic is primarily outbound.
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 208
Select the question you would ask your customer related to DNS attacks. Based on the material, choose the
most appropriate question.
A. How do you secure you DNS infrastructure against attacks?

B. Do you rely on your network firewall to protect you DNS server?
C. Do you over-provision your DNS infrastructure?
D. Do you regularly update BIND or some other DNS application to the latest release?
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 209
Why does the F5 Application Delivery Firewall solution mitigate SSL attacks more effectively than any other
firewalls?
A. Because F5 has unlimited capacity to handle SSL traffic.

B. Because F5 has full visibility and control of SSL traffic.
C. Because F5 has a separate iApp to handle SSL traffic.
D. Because F5 supports large SSL key sizes.
Correct Answer: B
Section: (none)
Explanation
Explanation:
QUESTION 210
Assume a client's traffic is being processed only by a NAT; no SNAT or virtual server processing takes place.
Also assume that the NAT definition specifies a NAT address and an origin address while all other settings are
left at their defaults. If the origin server were to initiate traffic via the BIG-IP, what changes, if any, would take
place when the BIG-IP processes such packets?
A. The BIG-IP would drop the request since the traffic didn’t arrive destined to the NAT address.
B. The source address would not change, but the destination address would be changed to the NAT address.
C. The source address would be changed to the NAT address and destination address would be left
unchanged.
D. The source address would not change, but the destination address would be changed to a self-IP of the
BIG-IP.
Correct Answer: C
Section: (none)
Explanation
QUESTION 211
A site wishes to perform source address translation on packets arriving from the Internet for clients sing some
pools but not others. The determination is not based on the client's IP address, but on the pool they are load
balanced to. What could best accomplish this goal?
A. A SNAT for all addresses could be defined, and then disable the SNAT processing for select pools.
B. The decision to perform source address translation is always based on VLAN. Thus, the goal cannot be
achieved.
C. For each virtual server, regardless their default load balancing pools, association with SNAT pools could
vary dependent upon need.
D. The decision to perform source address translation is always based on a client's address (or network).
Thus, this goal cannot be achieved.
Correct Answer: A
Section: (none)
Explanation
QUESTION 212
Which two statements are true about SNATs? (Choose two.)
A. SNATs are enabled on all VLANs, by default.

B. SNATs can be configured within a Profile definition.
C. SNATs can be configured within a Virtual Server definition.
D. SNAT's are enabled only on the VLAN where origin traffic arrives, by default.
Correct Answer: AC
Section: (none)
Explanation
QUESTION 213
What is the purpose of floating self-IP addresses?
A. to define an address that grants administrative access to either system at any time
B. to define an address that allows either system to initiate communication at any time
C. to define an address that allows network devices to route traffic via a single IP address
D. to define an address that gives network devices greater flexibility in choosing a path to forward traffic
Correct Answer: C
Section: (none)
Explanation
QUESTION 214
Which parameters are set to the same value when a pair of BIG-IP devices are synchronized?
A. host names
B. system clocks
C. profile definitions
D. VLAN failsafe settings
E. MAC masquerade addresses
Correct Answer: C
Section: (none)
Explanation
QUESTION 215
Which two statements are true concerning the default communication between a redundant pair of BIG-IP
systems? (Choose two.)
A. Synchronization occurs via a TCP connection using ports 683 and 684.
B. Connection mirroring data is shared via a TCP connection using port 1028.
C. Persistence mirroring data is shared via a TCP connection using port 1028.
D. Connection mirroring data is shared through the serial failover cable unless network failover is enabled.
Correct Answer: BC
Section: (none)
Explanation
QUESTION 216
Which two methods can be used to determine which BIG-IP is currently active? (Choose two.)
A. The bigtop command displays the status.

B. Only the active system's configuration screens are active.
C. The status (Active/Standby) is embedded in the command prompt.
D. The ifconfig a command displays the floating addresses on the active system.
Correct Answer: AC
Section: (none)
Explanation
QUESTION 217
As a part of the Setup Utility, the administrator sets the host name for the BIG-IP.
What would be the result if the two systems in a redundant pair were set to the same host name?
A. Host names do not matter in redundant pair communication.

B. In a redundant pair, the two systems will always have the same host name. The parameter is synchronized
between the systems.
C. The first time the systems are synchronized the receiving system will be assigned the same self-IP
addresses as the source system.
D. When the administrator attempts to access the configuration utility using the host name, they will always
connect to the active system.
Correct Answer: C
Section: (none)
Explanation
QUESTION 218
When network failover is enabled, which of the following is true?
A. The failover cable status is ignored. Failover is determined by the network status only.
B. Either a network failure or loss of voltage across the failover cable will cause a failover.
C. A network failure will not cause a failover as long as there is a voltage across the failover cable.
D. The presence or absence of voltage over the failover cable takes precedence over network failover.
Correct Answer: C
Section: (none)
Explanation
QUESTION 219
Where is connection mirroring configured?
A. It an option within a TCP profile.

B. It is an optional feature of each pool.
C. It is not configured; it is default behavior.
D. It is an optional feature of each virtual server.
Correct Answer: D
Section: (none)
Explanation
QUESTION 220
Which statement is true regarding failover?
A. Hardware failover is disabled by default.

B. Hardware failover can be used in conjunction with network failover.
C. If the hardware failover cable is disconnected, both BIG-IP devices will always assume the active role.
D. By default, hardware failover detects voltage across the failover cable and monitors traffic across the
internal VLAN.
Correct Answer: B
Section: (none)
Explanation
QUESTION 221
Where is persistence mirroring configured?
A. It is always enabled.
B. It is part of a pool definition.
C. It is part of a profile definition.
D. It is part of a virtual server definition.
Correct Answer: C
Section: (none)
Explanation
QUESTION 222
Assume the bigd daemon fails on the active system. Which three are possible results? (Choose three.)
A. The active system will restart the bigd daemon and continue in active mode.
B. The active system will restart the TMM daemon and continue in active mode.
C. The active system will reboot and the standby system will go into active mode.
D. The active system will failover and the standby system will go into active mode.
E. The active system will continue in active mode but gather member and node state information from the
standby system.
Correct Answer: ACD

Section: (none)
Explanation
QUESTION 223
What is the purpose of MAC masquerading?
A. to prevent ARP cache errors

B. to minimize ARP entries on routers
C. to minimize connection loss due to ARP cache refresh delays
D. to allow both BIG-IP devices to simultaneously use the same MAC address
Correct Answer: C
Section: (none)
Explanation
QUESTION 224
Which process or system can be monitored by the BIG-IP system and used as a failover trigger in a redundant
pair configuration.
A. bandwidth utilization
B. duplicate IP address
C. CPU utilization percentage
D. VLAN communication ability
Correct Answer: D
Section: (none)
Explanation
QUESTION 225
Assuming there are open connections through an active system's NAT and a failover occurs, by default, what
happens to those connections?
A. All open connections will be lost.
B. All open connections will be maintained.
C. The "Mirror" option must be chosen on the NAT and the setting synchronized prior to the connection
establishment.
D. Long-lived connections such as Telnet and FTP will be maintained while short-lived connections such as
HTTP will be lost.
E. All open connections are lost, but new connections are initiated by the newly active BIG-IP, resulting in
minimal client downtime.
Correct Answer: B
Section: (none)
Explanation
QUESTION 226
A virtual server is defined per the charts. The last five client connections were to members C, D, A, B, B. Given
the conditions shown in the above graphic, if a client with IP address 205.12.45.52 opens a connection to the
virtual server, which member will be used for the connection?
A. 172.16.20.1:80
B. 172.16.20.2:80
C. 172.16.20.3:80
D. 172.16.20.4:80
E. 172.16.20.5:80
Correct Answer: D
Section: (none)
Explanation
QUESTION 227
Which statement is correct if a TOP-based monitor is assigned to an LTM System and an HTTP-based monitor
is assigned to one of that LTM System's Virtual Servers?
A. The Virtual Server status is based on the TCP monitor only.

B. The Virtual Server status is based on the HTTP monitor only.
C. GTM Systems do not allow monitors on both an LTM System and one of its Virtual Servers.
D. The Virtual Server status is based on both the TOP and HTTP monitor; if either fails, the Virtual Server is
unavailable.
E. The Virtual Server status is based on both the TOP and HTTP monitor; if either succeeds, the Virtual Server
is available.
Correct Answer: B
Section: (none)
Explanation
QUESTION 228
With standard DNS, assuming no DNS request failures, which process describes the normal resolution process
on a "first time" DNS request?
A. Client requests address from root server, root server returns IP address to Authoritative DNS, Authoritative
DNS returns requested IP address, LDNS returns requested IP address to client.
B. Client requests address from LDNS, LDNS requests from GTM, GTM requests from Authoritative DNS,
Authoritative DNS returns requested IP address, LDNS returns requested IP address to client.
C. Client requests address from LDNS, Authoritative DNS receives request from root server, root server
returns LDNS address, LDNS returns client address, Authoritative DNS returns requested IP address,
LDNS returns requested IP address to client.
D. Client requests address from LDNS, LDNS requests from root server, root server returns Authoritative DNS
address, LDNS requests from Authoritative DNS, Authoritative DNS returns requested IP address, LDNS
returns requested IP address to client.
Correct Answer: D
Section: (none)
Explanation
QUESTION 229
What is the purpose of provisioning?
A. Provisioning allows modules that are not licensed to be fully tested.

B. Provisioning allows modules that are licensed be granted appropriate resource levels.
C. Provisioning allows the administrator to activate modules in nonstandard combinations.
D. Provisioning allows the administrator to see what modules are licensed, but no user action is ever required.
Correct Answer: B
Section: (none)
Explanation
QUESTION 230
Which three properties can be assigned to nodes? (Choose three.)
A. ratio values
B. priority values
C. health monitors
D. connection limits
E. load balancing mode
Correct Answer: ACD

Section: (none)
Explanation
QUESTION 231
Where is the load balancing mode specified?
A. within the pool definition

B. within the node definition
C. within the virtual server definition
D. within the pool member definition
Correct Answer: A
Section: (none)
Explanation
QUESTION 232
Which statement accurately describes the difference between two load balancing modes specified as
"member" and "node"?
A. There is no difference; the two terms are referenced for backward compatibility purposes.
B. When the load balancing choice references "node", priority group activation is unavailable.
C. Load balancing options referencing "nodes" are available only when the pool members are defined for the
"any" port.
D. When the load balancing choice references "node", the addresses' parameters are used to make the load
balancing choice rather than the member's parameters.
Correct Answer: D
Section: (none)
Explanation
QUESTION 233
Which two can be a part of a virtual server's definition? (Choose two.)
A. rule(s)
B. pool(s)
C. monitor(s)
D. node address(es)
E. load balancing method(s)
Correct Answer: AB
Section: (none)
Explanation
QUESTION 234
Assume a BIG-IP has no NATs or SNATs configured. Which two scenarios are possible when client traffic
arrives on a BIG-IP that is NOT destined to a self-IP? (Choose two.)
A. If the destination of the traffic does not match a virtual server, the traffic will be discarded.
B. If the destination of the traffic does not match a virtual server, the traffic will be forwarded based on routing
tables.
C. If the destination of the traffic matches a virtual server, the traffic will be processed per the virtual server
definition. If the destination of the traffic matches a virtual server, the traffic will be processed per the virtual
server. definition.
D. If the destination of the traffic matches a virtual server, the traffic will be forwarded, but it cannot be load
balanced since no SNAT has been configured.
Correct Answer: AC
Section: (none)
Explanation
QUESTION 235
When configuring a pool member's monitor, which three association options are available? (Choose three.)
A. inherit the pool's monitor

B. inherit the node's monitor
C. configure a default monitor
D. assign a monitor to the specific member
E. do not assign any monitor to the specific member
Correct Answer: ADE

Section: (none)
Explanation
QUESTION 236
The current status of a given pool member is unknown. Which condition could explain that state?
A. The member has no monitor assigned to it.

B. The member has a monitor assigned to it and the most recent monitor was successful.
C. The member has a monitor assigned to it and the monitor did not succeed during the most recent timeout
period.
D. The member's node has a monitor assigned to it and the monitor did not succeed during the most recent
timeout period.
Correct Answer: A
Section: (none)
Explanation
QUESTION 237
The default staging-tightening period for attack signatures and wildcard entities is?
A. 5 days
B. 7 days
C. 10 days
D. 30 days
Correct Answer: B
Section: (none)
Explanation
QUESTION 238
Generally speaking, should the monitor templates be used as production monitors or should they be
customized prior to use?
A. Most templates, such as HTTP and TCP, are as effective as customized monitors.
B. Monitor template customization is only a matter of preference, not an issue of effectiveness or performance.
C. Most templates, such as https, should have the receive rule customized to make the monitor more robust.
D. While some templates, such as ftp, must be customized, those that can be used without modification are
not improved by specific changes.
Correct Answer: C
Section: (none)
Explanation
QUESTION 239
You have a pool of servers that need to be tested. All of the servers but one should be tested every 10
seconds, but one is slower and should only be tested every 20 seconds. How do you proceed?
A. It cannot be done. All monitors test every five seconds.

B. It can be done, but will require assigning monitors to each pool member.
C. It cannot be done. All of the members of a pool must be tested at the same frequency.
D. It can be done by assigning one monitor to the pool and a different monitor to the slower pool member.
Correct Answer: D
Section: (none)
Explanation
QUESTION 240
When can a single virtual server be associated with multiple profiles?
A. Never. Each virtual server has a maximum of one profile.

B. Often. Profiles work on different layers and combining profiles is common.
C. Rarely. One combination, using both the TCP and HTTP profile does occur, but it is the exception.
D. Unlimited. Profiles can work together in any combination to ensure that all traffic types are supported in a
given virtual server.
Correct Answer: B
Section: (none)
Explanation
QUESTION 241
A site needs a virtual server that will use an iRule to parse HTTPS traffic based on HTTP header values. Which
two profile types must be associated with such a virtual server?
(Choose two.)
A. TCP
B. HTTP
C. HTTPS
D. ServerSSL
Correct Answer: AB
Section: (none)
Explanation
QUESTION 242
You have created a custom profile named TEST2. The parent profile of TEST2 is named TEST1. If additional
changes are made to TEST1, what is the effect on TEST2?
A. All changes to TEST1 are propagated to TEST2.

B. Some of the changes to TEST1 may propagate to TEST2.
C. Changes to TEST1 cannot affect TEST2 once TEST2 is saved.
D. When TEST1 is changed, the administrator is prompted and can choose whether to propagate changes to
TEST2.
Correct Answer: B
Section: (none)
Explanation
QUESTION 243
If a client's browser does not accept cookies, what occurs when the client connects to a virtual server using
cookie persistence?
A. The connection request is not processed.

B. The connection request is sent to a pology.server. The connection request is sent to a pology.server.
C. The connection request is load balanced to an available pool member.
D. The connection request is refused and the client is sent a "server not available" message.
Correct Answer: C
Section: (none)
Explanation
QUESTION 244
The incoming client IP address is 195.64.45.52 and the last five connections have been sent to members A, C,
E, D and B. Given the virtual server, pool, and persistence definitions and statistics shown in the above graphic,
which member will be used for the next connection?
A. 10.10.20.1:80
B. 10.10.20.2:80
C. 10.10.20.3:80
D. 10.10.20.4:80
E. 10.10.20.5:80
F. It cannot be determined with the information given.
Correct Answer: C
Section: (none)
Explanation
QUESTION 245
Which statement is true concerning cookie persistence.
A. Cookie persistence allows persistence independent of IP addresses.

B. Cookie persistence allows persistence even if the data are encrypted from client to pool member.
C. Cookie persistence uses a cookie that stores the virtual server, pool name, and member IP address in clear
text.
D. If a client's browser accepts cookies, cookie persistence will always cause a cookie to be written to the
client's file system.
Correct Answer: A
Section: (none)
Explanation
QUESTION 246
How is persistence configured?
A. Persistence is an option within each pool's definition.

B. Persistence is a profile type; an appropriate profile is created and associated with virtual server.
C. Persistence is a global setting; once enabled, load balancing choices are superseded by the persistence
method that is specified.
D. Persistence is an option for each pool member. When a pool is defined, each member's definition includes
the option for persistence.
Correct Answer: B
Section: (none)
Explanation
QUESTION 247
Assume a virtual server has a ServerSSL profile. What SSL certificates are required on the BIG-IP?
A. No SSL certificates are required on the BIG-IP.

B. The BIG-IP's SSL certificates must only exist.
C. The BIG-IP's SSL certificates must be issued from a certificate authority.
D. The BIG-IP's SSL certificates must be created within the company hosting the BIG-IPs.
Correct Answer: A
Section: (none)
Explanation
QUESTION 248
Assume a virtual server is configured with a ClientSSL profile. What would the result be if the virtual server's
destination port was not 443?
A. SSL termination could not be performed if the virtual server's port was not port 443.
B. Virtual servers with a ClientSSL profile are always configured with a destination port of 443.
C. As long as client traffic was directed to the alternate port, the virtual server would work as intended.
D. Since the virtual server is associated with a ClientSSL profile, it will always process traffic sent to port 443.
Correct Answer: C
Section: (none)
Explanation
QUESTION 249
Which statement is true concerning SSL termination.
A. A virtual server that has both ClientSSL and ServerSSL profiles can still support cookie persistence.
B. Decrypting traffic at the BIG-IP allows the use of iRules for traffic management, but increases the load on
the pool member.
C. When any virtual server uses a ClientSSL profile, all SSL traffic sent to the BIG-IP is decrypted before it is
forwarded to servers.
D. If a virtual server has both a ClientSSL and ServerSSL profile, the pool members have less SSL processing
than if the virtual server had only a ClientSSL profile.
Correct Answer: A
Section: (none)
Explanation
QUESTION 250
A site wishes to perform source address translation on packets from some clients but not others. The
determination is not based on the client's IP address, but on the virtual servers their packets arrive on. What
could best accomplish this goal?
A. A SNAT for all addresses could be defined, and then disable the SNAT processing for select VLANs.
B. Some virtual servers could be associated with SNAT pools and others not associated with SNAT pools.
C. The decision to perform source address translation is always based on VLAN. Thus, the goal cannot be
achieved.
D. The decision to perform source address translation is always based on a client's address (or network).
Thus, this goal cannot be achieved.
Correct Answer: B
Section: (none)
Explanation
QUESTION 251
Assume a client's traffic is being processed only by a NAT; no SNAT or virtual server processing takes place.
Also assume that the NAT definition specifies a NAT address and an origin address while all other settings are
left at their defaults. If a client were to initiate traffic to the NAT address, what changes, if any, would take place
when the BIG-IP processes such packets?
A. The source address would not change, but the destination address would be translated to the origin
address.
B. The destination address would not change, but the source address would be translated to the origin
address.
C. The source address would not change, but the destination address would be translated to the NAT's
address.
D. The destination address would not change, but the source address would be translated to the NAT's
address.
Correct Answer: A
Section: (none)
Explanation
QUESTION 252
A standard virtual server is defined with a pool and a SNAT using automap. All other settings for the virtual
server are at defaults. When client traffic is processed by the BIG-IP, what will occur to the IP addresses?
A. Traffic initiated by the pool members will have the source address translated to a self-IP address but the
destination address will not be changed.
B. Traffic initiated to the virtual server will have the destination address translated to a pool member address
and the source address. Traffic initiated to the virtual server will have the destination address translated to a
pool member. address and the source address translated to a self-IP address.
C. Traffic initiated by selected clients, based on their IP address, will have the source address translated to a
self-IP address but the destination will only be translated if the traffic is destined to the virtual server.
D. Traffic initiated to the virtual server will have the destination address translated to a pool member address
and the source address. Traffic initiated to the virtual server will have the destination address translated to a
pool member. address and the source address translated to a self-IP address. Traffic arriving destined to
other destinations will have the source translated to a self-IP address only.
Correct Answer: B
Section: (none)
Explanation
QUESTION 253
Which VLANs must be enabled for a SNAT to perform as desired (translating only desired packets)?
A. The SNAT must be enabled for all VLANs.

B. The SNAT must be enabled for the VLANs where desired packets leave the BIG-IP.
C. The SNAT must be enabled for the VLANs where desired packets arrive on the BIG-IP.
D. The SNAT must be enabled for the VLANs where desired packets arrive and leave the BIG-IP.
Correct Answer: C
Section: (none)
Explanation
QUESTION 254
A BIG-IP has a virtual server at 150.150.10.10:80 with SNAT automap configured. This BIG-IP also has a
SNAT at 150.150.10.11 set for a source address range of 200.200.1.0 / 255.255.255.0. All other settings are at
their default states. If a client with the IP address 200.200.1.1 sends a request to the virtual server, what is the
source IP address when the associated packet is sent to the pool member?
A. 200.200.1.1
B. 150.150.10.11
C. Floating self IP address on VLAN where the packet leaves the system
D. Floating self IP address on VLAN where the packet arrives on the system
Correct Answer: C
Section: (none)
Explanation
QUESTION 255
Which IP address will the client address be changed to when SNAT automap is specified within a Virtual Server
configuration?
A. The floating self IP address on the VLAN where the packetleaves the system.
B. The floating self IP address on the VLAN where the packet arrives on the system.
C. It will alternate between the floating and nonfloating self IP address on the VLAN where the packet leaves
the system so that port exhaustion is avoided.
D. It will alternate between the floating and nonfloating self IP address on the VLAN where the packet arrives
on the system so that port exhaustion is avoided.
Correct Answer: A
Section: (none)
Explanation
QUESTION 256
A virtual server at 10.10.1.100:80 has the rule listed below applied. when HTTP_REQUEST { if {[HTTP::uri]
ends_with "htm" } { pool pool1 } elseif {[HTTP::uri] ends_with "xt" } { pool pool2 } If a user connects to
http://10.10.1.100/foo.txt which pool will receive the request.
A. pool1
B. pool2
C. None. The request will be dropped.
D. Unknown. The pool cannot be determined from the information provided.
Correct Answer: B
Section: (none)
Explanation
QUESTION 257
Which statement is true concerning iRule events.
A. All iRule events relate to HTTP processes.

B. All client traffic has data that could be used to trigger iRule events.
C. All iRule events are appropriate at any point in the client-server communication.
D. If an iRule references an event that doesn't occur during the client's communication, the client's connection
will be terminated prematurely.
Correct Answer: B
Section: (none)
Explanation
QUESTION 258
Which three iRule events are likely to be seen in iRules designed to select a pool for load balancing. (Choose
3)
A. CLIENT_DATA
B. SERVER_DATA
C. HTTP_REQUEST
D. HTTP_RESPONSE
E. CLIENT_ACCEPTED
F. SERVER_SELECTED
G. SERVER_CONNECTED
Correct Answer: ACE

Section: (none)
Explanation
QUESTION 259
Which event is always triggered when a client initially connects to a virtual server configured with an HTTP
profile?
A. HTTP_DATA
B. CLIENT_DATA
C. HTTP_REQUEST
D. CLIENT_ACCEPTED
Correct Answer: D
Section: (none)
Explanation
QUESTION 260
A virtual server is listening at 10.10.1.100:80 and has the following iRule associated with it:
If a user connects to http://10.10.1.100/foo.html, which pool will receive the request?
A. pool1
B. pool2
Correct Answer: D
Section: (none)
Explanation
QUESTION 261
A virtual server is listening at 10.10.1.100:any and has the following iRule associated with it:
A. pool1
B. pool2
Correct Answer: D
Section: (none)
Explanation
QUESTION 262
Which statement is true about the synchronization process, as performed by the Configuration Utility or by
typing b config sync all?
A. The process should always be run from the standby system.

B. The process should always be run from the system with the latest configuration.
C. The two /config/BIG-IP.conf configuration files are synchronized (made identical) each time the process is
run.
D. Multiple files, including /config/BIG-IP.conf and /config/BIG-IP_base.conf, are synchronized (made identical)
each time the process is run.
Correct Answer: C
Section: (none)
Explanation
QUESTION 263
Which statement is true concerning the default communication between a redundant pair of BIG-IP devices?
A. Communication between the systems cannot be effected by port lockdown settings.

B. Data for both connection and persistence mirroring are shared through the same TCP connection.
C. Regardless of the configuration, some data is communicated between the systems at regular intervals.
D. Connection mirroring data is shared through the serial failover cable unless network failover is enabled.
Correct Answer: B
Section: (none)
Explanation
QUESTION 264
When upgrading a BIG-IP redundant pair, what happens when one system has been updated but the other has
not?
A. Synching should not be performed.

B. The first system to be updated will assume the Active role.
C. This is not possible since both systems are updated simultaneously.
D. The older system will issue SNMP traps indicating a communication error with the partner.
Correct Answer: A
Section: (none)
Explanation
QUESTION 265
When using the setup utility to configure a redundant pair, you are asked to provide a "Failover Peer IP". Which
address is this?
A. an address of the other system in its management network

B. an address of the other system in a redundant pair configuration
C. an address on the current system used to listen for failover messages from the partner BIG-IP
D. an address on the current system used to initiate mirroring and network failover heartbeat messages
Correct Answer: B
Section: (none)
Explanation
QUESTION 266
Which two statements describe differences between the active and standby systems? (Choose two.)
A. Monitors are performed only by the active system.

B. Failover triggers only cause changes on the active system.
C. Virtual server addresses are hosted only by the active system.
D. Configuration changes can only be made on the active system.
E. Floating self-IP addresses are hosted only by the active system.
Correct Answer: CE
Section: (none)
Explanation
QUESTION 267
Assuming other failover settings are at their default state, what would occur if the failover cable were to be
disconnected for five seconds and then reconnected.
A. As long as network communication is not lost, no change will occur.

B. Nothing. Failover due to loss of voltage will not occur if the voltage is lost for less than ten seconds.
C. When the cable is disconnected, both systems will become active. When the voltage is restored, unit two
will revert to standby mode.
D. When the cable is disconnected, both systems will become active. When the voltage is restored, both
systems will maintain active mode.
Correct Answer: C
Section: (none)
Explanation
QUESTION 268
Given that VLAN failsafe is enabled on the external VLAN and the network that the active BIG-IP's external
VLAN is connected to has failed, which statement is always true about the results?
A. The active system will note the failure in the HA table.

B. The active system will reboot and the standby system will go into active mode.
C. The active system will failover and the standby system will go into active mode.
D. The active system will restart the traffic management module to eliminate the possibility that BIG-IP is the
cause for the network failure.
Correct Answer: A
Section: (none)
Explanation
QUESTION 269
Assuming there are open connections through an active system's virtual servers and a failover occurs, by
default, what happens to the connections?
A. All open connections are lost.

B. All open connections are maintained.
C. When persistence mirroring is enabled, open connections are maintained even if a failover occurs.
D. Long-lived connections such as Telnet and FTP are maintained, but short-lived connections such as HTTP
are lost.
E. All open connections are lost, but new connections are initiated by the newly active BIG-IP, resulting in
minimal client downtime.
Correct Answer: A
Section: (none)
Explanation
QUESTION 270
How is MAC masquerading configured?
A. Specify the desired MAC address for each VLAN for which you want this feature enabled.
B. Specify the desired MAC address for each self-IP address for which you want this feature enabled.
C. Specify the desired MAC address for each VLAN on the active system and synchronize the systems.
D. Specify the desired MAC address for each floating self-IP address for which you want this feature enabled.
Correct Answer: A
Section: (none)
Explanation
QUESTION 271
Which action will take place when a failover trigger is detected by the active system?
A. The active device will take the action specified for the failure.
B. The standby device also detects the failure and assumes the active role.
C. The active device will wait for all connections to terminate and then failover.
D. The standby device will begin processing virtual servers that have failed, but the active device will continue
servicing the functional virtual servers.
Correct Answer: A
Section: (none)
Explanation
QUESTION 272
Assuming that systems are synchronized, which action could take place if the failover cable is connected
correctly and working properly, but the systems cannot communicate over the network due to extern al network
problems.
A. If network failover is enabled, the standby system will assume the active mode.
B. Whether or not network failover is enabled, the standby system will stay in standby mode.
C. Whether or not network failover is enabled, the standby system will assume the active mode.
D. If network failover is enabled, the standby system will go into active mode but only until the network
recovers.
Correct Answer: B
Section: (none)
Explanation
QUESTION 273
Which statement is true concerning iRule context?
A. The iRule event declaration determines the context.

B. The context must be explicitly declared.
C. The rule command determines the context.
D. The results of the iRule's conditional statement determines the context.
Correct Answer: A
Section: (none)
Explanation
QUESTION 274
The following iRule is being used within a persistence profile on a virtual server. Assuming the following HTTP
requests are made within the same timeout window, what is the maximum number of persistence records that
will be created iRule:
A. 4
B. 3
C. 10
D. It cannot be determined from the given data.
E. 5
F. 1
G. 0
Correct Answer: A
Section: (none)
Explanation
QUESTION 275
Which statement is true concerning SNATs using SNAT pools and SNATs using automap?
A. SNAT s using automap preferentially translate source addresses to nonfloating self-IP addresses.
B. SNAT s using a SNAT pool translate source addresses randomly to any of the addresses in the SNAT pool.
C. SNAT s using automap translate source addresses randomly to any of the BIG-IP's floating self-IP
addresses.
D. A SNAT pool can contain virtual server addresses.
Correct Answer: A
Section: (none)
Explanation
QUESTION 276
Why would an administrator capture monitor traffic between a BIG-IP and servers?
A. Viewing monitor traffic could help the administrator to define a more robust monitor.
B. If a client were having difficulty logging into a load balanced SSH server, viewing and analyzing the
connection process would determine the reason.
C. Only client traffic may be captured; monitor traffic may not be captured.
D. If client traffic to servers was failing, viewing and analyzing monitor traffic would determine the reason.
Correct Answer: A
Section: (none)
Explanation
QUESTION 277
When a pool is created and saved to file, where is the default file and location for the pool configuration? When
a pool is created and saved to file, where is the default file and location for the pool configuration?
A. /config/BIG-IP_base.conf
B. lconfig/BIG-IP.conf
C. /etc/BIG-IP_base.conf
D. /config/BigDB.dat
Correct Answer: B
Section: (none)
Explanation
QUESTION 278
Which statement is true concerning packet filters?
A. In addition to administrator-created filters, three always exists a "deny all" filter that processes traffic last.
B. Filters cannot prevent access to the management port.
C. The order of filters does not affect which traffic is accepted or denied.
D. Filters cannot prevent the BIG_IP synching process from taking place.
Correct Answer: B
Section: (none)
Explanation
QUESTION 279
Which action CANNOT be performed by an iRule?
A. Direct a connection request to a specific pool.

B. Substitute a server's response with alternate data.
C. Chang the virtual server's default pool.
D. Direct a client's request to a pool based on the client's browser's language.
E. Limit a given client to a set amount of bandwidth.
F. Discard a client before connecting to a server.
Correct Answer: C
Section: (none)
Explanation
QUESTION 280
Which persistence method will always recognize a client when the client returns to the same virtual server?
A. SSL
B. MSRDP
C. expression [universal]
D. No persistence method work in all situations.
E. source address
Correct Answer: D
Section: (none)
Explanation
QUESTION 281
Which are immediate results of entering the following command:
A. A. Requests sent to this BIG-IP system with a destination port of 80 are load balanced between the
members of PoolA.
B. No changes will take place since the command is missing the monitor component for PoolA.
C. The /config/BIG-IP.cinf file is updated to include a definition for the pool named PoolA.
D. A new pool is available for association with any iRule or virtual server.
Correct Answer: D
Section: (none)
Explanation
QUESTION 282
Which three statements are true about SNATs? (Choose three.)
A. SNAT s provide bidirectional traffic initiation.

B. SNAT s support UDP, TCP, and ICMP traffic.
C. SNAT s provide a many-to-one mapping between IP addresses.
D. SNAT addresses can be identical to virtual server IP addresses.
Correct Answer: BC
Section: (none)
Explanation
QUESTION 283
Given the configuration shown below, if a connection request arrived on the BIG-IP with a source address of
200.10.10.10:1050 and a destination of 150.10.10.75:80, what would the source IP address of the associated
packet be when it arrived on the choosen member of the web_pool self 150.10.10.1 { netmask 255.255.255.0
unit I floating enable vlan external allow tcp https } self 10.10.1.1 { netmask 255.255.255.0 unit I floating enable
vlan internal allow default } pool web_pool { member 10.10.1.11:80 member 10.10.1.12:80 member
10.10.1.13:80 }snatpool client_pool { member 10.10.1.100 member 150.10.10.15 }virtual VS_web { destination
150.10.10.10:80 ip protocol tcp snat automap pool web_pool }virtual VS_network{ destination 150.10.1 0.0:any
mask 255.255.255.0 snatpool client_pool ip protocol tcp pool web_pool } virtual VS_network { destination
150.10.1 0.0:any mask 255.255.255.0 snatpool client_pool ip protocol tcp pool web_pool } virtual VS_network
{ destination 150.10.10.0:any mask 255.255.255.0 snatpool client_pool ip protocol tcp pool web_pool }
A. 10.10.1.IA.10.10.1.1
B. 200.10.10.I0D.200.10.10.10
C. 10.10.1.I00B.10.10.1.100
D. 150.10.10.15C.150.10.10.15
Correct Answer: C
Section: (none)
Explanation
QUESTION 284
When a virtual server has an HTTP profile with compression enabled, which traffic is compressed by the BIG-
IP?
A. selected traffic from the BIG-IP to the client

B. all sever-side traffic for that virtual server
C. selected traffic from the pool member to the BIG-IP
D. all client-side traffic for that virtual server
Correct Answer: A
Section: (none)
Explanation
QUESTION 285
An LTM has the 3 virtual servers, 2 SNATs, four self IP addresses defined, and the networks shown in the
exhibit. Selected options for each object are shown below. Settings not shown are at their defaults. Assume
port exhaustion has not been reached.
A connection attempt is made with a source IP and port of 10.10.100.50:2222 and a destination IP and port of
10.10.2.10:80. When the request is processed, what will be the source and destination IP addresses?
A. The request will be droped.

B. Source IP: 10.10.2.1; Destination IP: 10.10.2.10
C. Source IP: 10.10.2.102; Destination IP 10.10.2.10
D. Source IP: Either 172.16.20.50 or 192.168.10.50; Destination IP: 10.10.2.10
E. Source IP: 10.10.2.1; Destination IP: pool in the 172.16/16 network C
Correct Answer: D
Section: (none)
Explanation
QUESTION 286
Which three parameters could be used to determine whether a connection request will have the source address
translated as the request is processed? (Choose three.)
A. the client's router's IP address
B. the client's browser's preferred language
C. the client's IP netmask
D. the client's TCP port
E. the client's IP address
F. the client IP fragment offset
Correct Answer: BDE

Section: (none)
Explanation
QUESTION 287
A BIG-IP has the following objects configured:
A virtual server at 150.10.30.30:80 that is associated with both the SNAT pool and the load balancing pool. If a
client at IP address 200.10.10.10 initiates a connection to the virtual server, what will the source IP address be
in the packets sent to the chosen pool member?
A. 150.10.33.33
B. 10.10.1.33
C. 10.10.1.10
D. 150.10.30.30
E. 200.10.10.10
F. It could be any of the addresses of the members of the load balancing pool.
Correct Answer: B
Section: (none)
Explanation
QUESTION 288
What does the insert X-Forwarded option in an HTTP profile do?
A. A BIG-IP self-IP is inserted in the source address field on the server-side connection.
B. A BIG-IP self-IP is inserted in the source address field on the client-side connection.
C. The client IP addresses are inserted into messages sent to remote syslog servers.
D. The client IP addresses are inserted into HTTP header.
Correct Answer: D
Section: (none)
Explanation
QUESTION 289
When defining a load balancing pool using the command line, if the load balancing method is not specified,
what is the result?
A. The default load balancing method would be used.

B. The load balancing method of the previous pool would be used.
C. The system would prompt the user for a load balancing method.
D. An error would be displayed since no load balancing method was specified.
Correct Answer: A
Section: (none)
Explanation
QUESTION 290
What occurs when a save-config command is issued?
A. The current configuration files are backed up.

B. The current configuration files are verified for syntax, then the running configuration is installed in memory.
C. The current configuration files are loaded into memory.
D. The current configuration files are saved into an archive format.
Correct Answer: A
Section: (none)
Explanation
QUESTION 291
How many events can be referenced in a given iRule?
A. iRules are limited to one event, but a virtual server could be associated with multiple rules.
B. iRules can have multiple events.
C. Exactly one.
D. iRules can have up to event if one is client-side and one is server-side.
Correct Answer: B
Section: (none)
Explanation
QUESTION 292
Which statement is true regarding OneConnect processing?
A. The virtual server must have UDP profile.

B. Server-side request can utilize existing client-side connections.
C. The number of client connection is reduced.
D. Client-side request can utilize existing server-side connections.
Correct Answer: D
Section: (none)
Explanation
QUESTION 293
Which tool is used on BIG-IP systems to capture data packets?
A. tcpdump
B. snoop
C. ethereal
D. qkview
Correct Answer: A
Section: (none)
Explanation
QUESTION 294
Which statement concerning virtual servers is true?
A. Virtual servers can keep idle server connections open indefinitely.

B. Virtual servers can compress data between the BIG-IP and servers.
C. Virtual servers cannot perform load balancing without performing address translation.
D. Virtual servers can reuse connections between the BIG-IP and server for multiple HTTP GETs.
E. Virtual server processing always translates the virtual server address to the address of the chosen pool
member.
Correct Answer: D
Section: (none)
Explanation
QUESTION 295
Click the Exhibit Button an LTM has the 3 virtual servers, a SNAT defined, four self IP addresses defined and
the networks shown in the exhibit. Selected options for each object are shown below. Settings not shown are at
their defaults.
10.10.2.10:80. When the request is processed, what will be the source and destination IP addresses?
A. The request will be dropped.

B. Source IP: Either 172.16.20.50 or 192.168.10.50; Destination IP: 10.10.2010
C. Source IP: 10.20.100.50; Destination IP: 10.10.2.10
D. Source IP: 10.10.2.1; Destination IP: 10.10.2.10
Correct Answer: B
Section: (none)
Explanation
QUESTION 296
A BIG-IP has the following objects configured: A SNAT pool with 2 members:
A virtual server at 150.10.30.30:80 that is associated with both the SNAT pool and the load balancing pool. If a
client at IP address 200.10.10.10 initiates a connection to the virtual server, what will the source IP address be
in the packets sent to the chosen pool member?
A. 150.10.30.30
B. 150.10.33.33
C. 10.10.1.10
D. It could be any of the addresses of the members of the load balancing pool.
E. 10.10.1.33
F. 200.10.10.10
Correct Answer: E
Section: (none)
Explanation
QUESTION 297
Which is a potential result when a trunk is configured on a BIG-IP?
A. No additional trunks can be configuration since each BIG-IP is limited to one trunk
B. Packets flowing to the VLAN could arrive on any of the interfaces in the trunk
C. Since any VLANs associated with the trunk are necessarily associated with multiple interfaces, the VLAN
using the must use tagged packets.
D. VLAN failsafe is not available for any VLAN associated with any trunks.
Correct Answer: B
Section: (none)
Explanation
QUESTION 298
Which two statements are true concerning capabilities of current BIG-IP platforms? (Choose two.)
A. The 1600 hosts more ports than the 3900.

B. All current BIG-IP platform use both an ASIC. And CPU(s)to process traffic.
C. All current BIG-IP platform can perform hardware compression.
D. Only 2U BIG-IP Platform have an option of a second power supply.
E. All BIG-IP have capacity to perform bulk encryption I decryption of SSL traffic independent of the CPU.
Correct Answer: BE
Section: (none)
Explanation
QUESTION 299
Which is the result when multiple monitors are assigned to a pool member?
A. The member is marked available if sufficient monitors succeed, and as unavailable if insufficient monitors
succeed.
B. The member is marked as available if any of the monitors succeed.
C. The member is marked as unavailable if any of the monitors fails.
D. The member is marked available if all monitors succeed, and as marginal if one or more monitors fail(s).
Correct Answer: A
Section: (none)
Explanation
QUESTION 300
An LTM has the 3 virtual servers, four self IP addresses defined and the networks shown in the exhibit.
Selected options for each object are shown below. Settings not shown are at their defaults.
10.10.2.102:80.
When the request is processed, what will be the destination IP address?
A. Destination IP: 10.10.2.102
B. The request will be dropped.
C. Destination IP: pool member in the 192.168/16 network
D. Destination IP: pool member in the 172.16/16 network
Correct Answer: C
Section: (none)
Explanation
QUESTION 301
An LTM has the 3 virtual servers, a SNAT, four self IP addresses defined and the networks shown in the
exhibit. Selected options for each object are shown below. Settings not shown are at their defaults.
10.10.2.102:80.
When the request is processed, what will be the destination IP address?
A. Destination IP: 10.10.2.10
B. Destination IP: pool member in the 192.168/16 network.
C. Destination IP: pool member in the 172.16/16 network
D. The request will be dropped.
Correct Answer: A
Section: (none)
Explanation
QUESTION 302
A site wishes to use an external monitor. Other than what is coded in the monitor script, what information must
be configured on the BIG-IP for the monitor to be functional? (Choose two.)
A. BIG-IP services that are running on the system to be tested.

B. BIG-IP the IP addresses of the devices that will be tested. Must know which
C. BIG-IP node or member the result are to be applied to. Must know all
D. BIG-IP must know the name of the program.
E. BIG-IP must know which function the program is going to test. Must know
Correct Answer: CD
Section: (none)
Explanation
QUESTION 303
Which statement describes advanced shell access correctly?
A. Users with advanced shell access can always change, add, or delete LTM objects in all partition.
B. Users with advance shell access are limited to changing, adding, or deleting LTM object in any single
partition.
C. Users with advance shell access have the same right as those with mesh access, but right extend to all
partition rather than to a single partition.
D. All Users can be given advanced shell access.
Correct Answer: A
Section: (none)
Explanation
QUESTION 304
Which statement describes advanced shell access correctly? Which statement describes advanced shell
access correctly?
A. The context determines the values of commands that vary between client and server.
B. The context has no impact on events.
C. The context determines which events are available for iRule processing.
D. The context determines which pools are available for load balancing.
Correct Answer: A
Section: (none)
Explanation
QUESTION 305
An LTM has the 3 virtual servers, 2 SNATs, four self IP addresses defined and the networks shown in the
graphic below. Selected options for each object are shown below. Settings not shown are at their defaults.
Assume port exhaustion has not been reached.
10.10.2.102:80.
When the request is processed, what will be the source and destination IP addresses?
A. Source IP: 10.20.10.50; Destination IP: pool member in the 172.16/16 network
B. Source IP: 172316.20.50; Destination IP: pool member in the 182.16/16 network
C. Source IP: 192.168.1.1; Destination IP: pool member in the 192.168/16 network
E. Source IP: 10.20.10.50; Destination IP: pool member in the 192.168/16 network
F. Source IP: 182.16.1.1; Destination IP: pool member in the 172316/16 network
G. Source IP: 192.168.10.50; Destination IP: pool member in the 192.168/16 network
H. Source IP:192.168.10.50; Destination IP: pool member in the 192.168./16 network
Correct Answer: F
Section: (none)
Explanation
QUESTION 306
The partial configuration below includes an iRule, a virtual server, and pools. When traffic from the client at
160.10.10.10:2056 connects to the virtual server Test_VS and sends an HTTP request, what will the client's
source address be translated to as the traffic is sent to the chosen pool member?
A. 160.10.10.IOC.160.10.10.10
B. It could be either 10.10.10.10 or 10.10.10.11.
C. 10.10.10.2
D. 200.10.10.1
E. 10.10.10.1
Correct Answer: E
Section: (none)
Explanation
QUESTION 307
What is the expected difference between two source address persistence profiles if profile A has a mask of
255.255.255.0 and profile B has a mask of 255.255.0.0?
A. Profile A will have more clients matching existing persistence records.

B. There are no detectable differences.
C. Profile B has a greater potential number of persistence records.
D. Profile B will have fewer persistence records for the sane client base.
Correct Answer: D
Section: (none)
Explanation
QUESTION 308
A BIG-IP has two SNATs, a pool of DNS servers and a virtual server configured to load balance UDP traffic to
the DNS servers. One SNAT's address is 64.100.130.10; this SNAT is defined for all addresses. The second
SNAT's address is 64.100.130.20; this SNAT is defined for three specific addresses, 172.16.3.54, 172.16.3.55,
and 172.16.3.56. The virtual server's destination is 64.100.130.30:53. The SNATs and virtual server have
default VLAN associations. If a client with IP address 172.16.3.55 initiates a request to the virtual server, what
is the source IP address of the packet as it reaches the chosen DNS server?
A. 64.100.130.30
B. 172.16.3.55
C. 64.100.130.20
D. 64.100.130.10
Correct Answer: C
Section: (none)
Explanation
QUESTION 309
A, steaming profile will do which of the following?
A. Search and replace all occurrences of a specified string only is responses processed by a virtual server.
B. Search and replace all occurrences of a specified string only in request processed by a virtual server.
C. Search and replace all occurrences of a specified string in requests and responses processed by a virtual
server.
D. Search and replace the first occurrence of a specified of a specified string in either a request or response
processed by a virtual server.
Correct Answer: C
Section: (none)
Explanation
QUESTION 310
A monitor has been defined using the HTTP monitor template. The send and receive strings were customized,
but all other settings were left at their defaults. Which resources can the monitor be assigned to?
A. only specific pool members

B. most virtual severs
C. most nodes
D. most pools
Correct Answer: D
Section: (none)
Explanation
QUESTION 311
When DNS_REV is used as the probe protocol by the GTM System, which information is expected in the
response from the probe?
A. a reverse name lookup of the GTM System

B. the list of root servers known by the local DNS
C. the FQDN of the local DNS being probed for metric information
D. the revision number of BIND running on the requesting DNS server
Correct Answer: C
Section: (none)
Explanation
QUESTION 312
Which three can be a part of a pool's definition? (Choose three.)
A. Link
B. Monitors
C. Wide IPs
D. Persistence
E. Data Centers
F. Virtual Servers
Correct Answer: BDF

Section: (none)
Explanation
QUESTION 313
Which two must be included in a Wide-IP definition for the Wide-IP to resolve a DNS query? (Choose two.)
A. a name
B. a monitor
C. a load balancing method
D. one or more virtual servers
Correct Answer: AC
Section: (none)
Explanation
QUESTION 314
A GTM System would like to ensure that a given LTM System is reachable and iQuery communication is
allowed prior to sending it client request. What would be the simplest monitor template to use?
A. TCP
B. ICMP
C. HTTP
D. BIG-IP
E. SNMP
Correct Answer: D
Section: (none)
Explanation
QUESTION 315
Which two ports must be enabled to establish communication between GTM Systems and other BIG IP
Systems? (Choose two.)
A. 22
B. 53
C. 443
D. 4353
E. 4354
Correct Answer: AD
Section: (none)
Explanation
QUESTION 316
When probing LDNSs, which protocol is used by default?
A. TCP
B. ICMP
C. DNS_REV
D. DNS_DOT
Correct Answer: B
Section: (none)
Explanation
QUESTION 317
Which of the following platforms support both standalone and modular BIG-IP ASM implementations? (Choose
2)
A. 3900
B. 6800
C. 6900
D. 8800
Correct Answer: AC
Section: (none)
Explanation
QUESTION 318
Use a proprietary syntax language. Must contain at least one event declaration. Must contain at least one
conditional statement. Must contain at least one pool assignment statement. What must be sent to the license
server to generate a new license?
A. the system's dossier

B. the system's base license
C. the system's serial number
D. the system's purchase order number
Correct Answer: A
Section: (none)
Explanation
QUESTION 319
What is the difference between primary and secondary DNS servers?
A. Only primary servers can issue authoritative responses.

B. Primary servers host the original copy of the zone database file.
C. Primary servers resolve names more efficiently than secondary servers.
D. Secondary servers act as backups and will respond only if the primary fails.
Correct Answer: B
Section: (none)
Explanation
QUESTION 320
If the config tool is complete, which two access methods are available by default for GTM administration and
configuration? (Choose two.)
A. network access via http

B. network access via https
C. network access via telnet
D. direct access via serial port
Correct Answer: BD
Section: (none)
Explanation
QUESTION 321
A GTM System performs a name resolution that is not a Wide-IP. The name is in a domain for which the GTM
System is authoritative. Where does the information come from?
A. It comes from BIND database (zone) files on the GTM System.

B. GTM System cannot resolve a host name that is not a Wide-IP.
C. It comes from the database of previously cached name resolutions.
D. It comes from a zone transfer initiated when the request was received.
Correct Answer: A
Section: (none)
Explanation
QUESTION 322
A site wishes to delegate the name .wmysite.com to a GTM System. Which entry would be appropriate in their
current DNS servers?
A. vww.mysite.com. IN A 132.26.33.15
B. 15.33.addrin.arpa.com IN PRT .wiw.mysite.com.
C. iw.mysite.com. IN CNAME wwip.mysite.com.
D. wwmysite.com. IN DEL wiwGTM.mysite.com.
Correct Answer: C
Section: (none)
Explanation
QUESTION 323
Which statement about root DNS servers is true?
A. Root servers have databases of all registered DNS servers.

B. Root servers have databases of the DNS servers for top-level domains.
C. Root servers have databases of DNS servers for each geographical area. They direct requests to
appropriate LDNS servers.
D. Root servers have databases of commonly accessed sites. They also cache entries for additional servers
as requests are made.
Correct Answer: B
Section: (none)
Explanation
QUESTION 324
What is the advantage of specifying three load balancing methods when load balancing within pools?
A. Specifying three methods allows the GTM System to use all three methods simultaneously.
B. Specifying three methods allows the GTM System to choose the optimal method for each name resolution.
C. Specifying three methods allows the GTM System alternate methods if insufficient data is available for other
methods.
D. Specifying three methods allows the GTM System to rotate between the three methods so that no one
method is used too often.
Correct Answer: C
Section: (none)
Explanation
QUESTION 325
A pool is using Round Trip Time as its load balancing method (Alternate: Round Robin; Fallback:None). The
last five resolutions have been C, D, C, D, C. Given the current conditions shown in the table below, which
address will be used for the next resolution?
A. A
B. B
C. C
D. D
Correct Answer: B
Section: (none)
Explanation
QUESTION 326
A pool is using Global Availability as its load balancing method (Alternate:Round Robin; Fallback: Return to
DNS). The last five resolutions have been C, D, C, D, C. Given the current conditions shown in the table, which
address will be used for the next resolution?
A. A
B. B
C. C
D. D
Correct Answer: B
Section: (none)
Explanation
QUESTION 327
What are some changes that must be made on the GTM System so that log messages are sent to centralized
System Log servers?
A. The IP address of the server must be added to the wideip.conf file.

B. The IP address of the server must be added to the syslogng.conf file.
C. The IP address of the server and valid user id/password combination must be added to the hosts.allow file.
D. The IP address of the server and valid user id/password combination must be added to the syslog ng.conf
file.
Correct Answer: B
Section: (none)
Explanation
QUESTION 328
What are two advantages of the Quality of Service (QoS) load balancing method? (Choose two.)
A. It resolves requests to the site with the highest QoS value in the IP header.
B. It combines multiple load balancing metric values in a single load balancing method.
C. It allows the GTM administrator to place relative values on each metric used to determine the optimum site.
D. It allows the GTM System to select the optimum virtual server based on all available path and server
metrics.
Correct Answer: BC
Section: (none)
Explanation
QUESTION 329
When is a Virtual Server hosted by an LTM System defined with two IP addresses?
A. Two addresses are used to define the Virtual Server when it is managed by redundant LTM Systems.
B. Two addresses are used to define some Virtual Servers so that the GTM System can choose the better
address when resolving the name.
C. Two addresses are used to define Virtual Servers when the LTM System hosting it is behind a firewall that
is translating the Virtual Server address.
D. Two addresses are used to define a Virtual Server when the Wide-IP should resolve to a different address
depending on which LTM System is active.
Correct Answer: C
Section: (none)
Explanation
QUESTION 330
What is a characteristic of iQuery?
A. It uses SSH.
B. It uses SSL.
C. It uses SCP.
D. It uses HTTPS.
Correct Answer: B
Section: (none)
Explanation
QUESTION 331
Listeners that correspond to nonfloating self IP addresses are stored in which configuration file?
A. /config/BIG-IP.conf
B. /config/BIG-IP_base.conf
C. /config/gtm/wideip.conf
D. /config/BIG-IP_local.conf
Correct Answer: D
Section: (none)
Explanation
QUESTION 332
What is the primary benefit of associating Servers with Data Centers?
A. The primary benefit is in assigning a single IP address to identify a Data Center.

B. The primary benefit is in combining probing metrics. Load balancing decisions can be made more
intelligently.
C. The primary benefit is administrative. It is easier to remember to add servers when they are categorized by
a physical location.
D. The primary benefit is in load balancing. Clients will not be directed to Data Centers that are separated from
them by great distances.
Correct Answer: B
Section: (none)
Explanation
QUESTION 333
Which two are events that can be used to trigger GTM iRule data processing? (Choose two.)
A. LB_FAILED
B. DNS_REQUEST
C. HTTP REQUEST
D. CLIENT_ACCEPTED
Correct Answer: AB
Section: (none)
Explanation
QUESTION 334
How do you support non intelligent DNS resolution in an environment with GTM Systems and standard DNS
servers? (Choose two.)
A. The GTM System must be a secondary server in all of your zones.

B. Your GTM System must delegate some DNS names to the DNS Servers.
C. Your DNS servers may delegate some DNS names to the GTM Systems.
D. The GTM System may have a Listener set for your DNS server's address.
E. The GTM System may have a Listener set for the GTM's loopback address.
Correct Answer: CD
Section: (none)
Explanation
QUESTION 335
iQuery is a proprietary protocol that distributes metrics gathered from which three sources? (Choose three.)
A. SNMP
B. DNS root servers
C. path probes such as ICMP
D. monitors from LTM Systems
E. monitors from Generic Host Servers
Correct Answer: ACD

Section: (none)
Explanation
QUESTION 336
What is the purpose of the GTM Systems Address Exclusion List concerning local DNS servers?
A. to prevent probing of specific local DNSs

B. to prevent name resolution to specific Virtual Servers
C. to prevent name resolution for requests from specific local DNSs
D. to prevent probing of any local DNS servers by specific F5 devices
Correct Answer: A
Section: (none)
Explanation
QUESTION 337
Which three must be done so that Generic Host Servers can be monitored using SNMP? (Choose three.)
A. The SNMP monitor must be added to all BIG-IP Systems.

B. The Generic Host Server must be running the big3d agent.
C. The GTM System must be configured for the appropriate MIB.
D. The Generic Host Server must be added to the GTM Configuration.
E. The Generic Host Server must be enabled to answer SNMP queries.
Correct Answer: CDE

Section: (none)
Explanation
QUESTION 338
Monitors can be assigned to which three resources? (Choose three.)
A. Pools
B. Servers
C. Wide-IPs
D. Data Centers
E. Pool Members
Correct Answer: ABE

Section: (none)
Explanation
QUESTION 339
What will likely happen if you were to define a LTM System in the wrong Data Center?
A. There would be no effect if the LTM System is defined in the wrong Data Center.
B. The GTM System would not be able to communicate with that LTM System.
C. Data from probes from that LTM System might result in inaccurate path metrics and load balancing
decisions.
D. The GTM System would not be able to resolve Wide-IPs to the addresses associated with that LTM
System's Virtual Servers.
Correct Answer: C
Section: (none)
Explanation
QUESTION 340
When initially configuring the GTM System using the config tool, which two parameters can be set? (Choose
two.)
A. System hostname
B. IP Address of management port
C. IP Address of the external VLAN
D. Default route for management port
E. Port lockdown of management port
Correct Answer: BD
Section: (none)
Explanation
QUESTION 341
Without creating a user defined region, what is the most specific group a topology record can identify?
A. city
B. country
C. continent
D. state/province
E. region of country
Correct Answer: D
Section: (none)
Explanation
QUESTION 342
The SNMP monitor can collect data based on which three metrics? (Choose three.)
A. packet rate
B. memory utilization
C. content verification
D. current connections
E. hops along the network path
Correct Answer: ABD

Section: (none)
Explanation
QUESTION 343
Which facility logs messages concerning GTM System parameters?
A. local0
B. local1
C. local2
D. local3
Correct Answer: C
Section: (none)
Explanation
QUESTION 344
When users are created, which three access levels can be granted through the GTM Configuration Utility?
(Choose three.)
A. Root
B. Guest
C. Operator
D. Administrator
E. CLI + Web Read Only
Correct Answer: BCD

Section: (none)
Explanation
QUESTION 345
The BIG-IP ASM System is configured with a virtual server that contains an HTTP class profile and the
protected pool members are associated within the HTTP class profile pool definition. The status of this virtual
server is unknown (Blue). Which of the following conditions will make this virtual server become available
(Green)?
A. Assign a successful monitor to the virtual server

B. Assign a successful monitor to the members of the HTTP class profile pool
C. Associate a fallback host to the virtual server and assign a successful monitor to the fallback host
D. Associate a default pool to the virtual server and assign a successful monitor to the pool members
Correct Answer: D
Section: (none)
Explanation
QUESTION 346
Which of the following does not pertain to protecting the Requested Resource (URI) element?
A. File type validation

B. URL name validation
C. Domain cookie validation
D. Attack signature validation
Correct Answer: C
Section: (none)
Explanation
QUESTION 347
Which of the following protocol protections is not provided by the Protocol Security Manager?
A. FTP
B. SSH
C. HTTP
D. SMTP
Correct Answer: B
Section: (none)
Explanation
QUESTION 348
Which of the following is correct regarding User-defined Attack signatures?
A. User-defined signatures use an F5-supplied syntax

B. User-defined signatures may only use regular expressions
C. Attack signatures may be grouped within system-supplied signatures
D. User-defined signatures may not be applied globally within the entire policy
Correct Answer: A
Section: (none)
Explanation
QUESTION 349
Which of the following methods of protection is not available within the Protocol Security Manager for HTTP
traffic?
A. Data guard
B. Attack signatures
C. Evasion techniques
D. File type enforcement
Correct Answer: B
Section: (none)
Explanation
QUESTION 350
There are many user roles configurable on the BIG-IP ASM System. Which of the following user roles have
access to make changes to ASM policies? (Choose three.)
A. Guest
B. Operator
C. Administrator
D. Web Application Security Editor
E. Web Application Security Administrator
Correct Answer: CDE

Section: (none)
Explanation
QUESTION 351
Which of the following statements are correct regarding positive and negative security models? (Choose two.)
A. Positive security model allows all transactions by default.

B. Negative security model denies all transactions by default.
C. Negative security model allows all transactions by default and rejects only transactions that contain attacks.
D. Positive security mode l denies all transactions by default and uses rules that allow only those transactions
that are considered safe and valid.
Correct Answer: CD
Section: (none)
Explanation
QUESTION 352
Which events are valid iRule events triggered by BIG-IP ASM processing? (Choose two.)
A. ASM_REQUEST_BLOCKING
B. ASM_REQUEST_ACCEPTED
C. ASM_REQUEST_VIOLATION
D. ASM_RESPONSE_BLOCKING
Correct Answer: AC
Section: (none)
Explanation
QUESTION 353
Which of the following methods of protection is not available within the Protocol Security Manager for FTP
protection?
A. Session timeout
B. Command length
C. Allowed commands
D. Anonymous FTP restriction
Correct Answer: A
Section: (none)
Explanation
QUESTION 354
Logging profiles are assigned to?
A. HTTP class
B. Security policies
C. Web applications
D. Attack signatures
Correct Answer: C
Section: (none)
Explanation
QUESTION 355
Which of the following is a language used for content provided by a web server to a web client?
A. FTP
B. TCP
C. HTTP
D. HTML
Correct Answer: D
Section: (none)
Explanation
QUESTION 356
Which of the following methods are used by the BIG-IP ASM System to protect against SQL injections?
A. HTTP RFC compliancy checks

B. Metacharacter enforcement and attack signatures
C. HTTP RFC compliancy checks and length restrictions
D. Response scrubbing, HTTP RFC compliancy checks, and metacharacter enforcement
Correct Answer: B
Section: (none)
Explanation
QUESTION 357
Which of the following can be associated with an XML profile?
A. Flow
B. Method
C. Parameter
D. File type
Correct Answer: C
Section: (none)
Explanation
QUESTION 358
An HTTP class is available
A. on any BIG-IP LTM system

B. only when ASM is licensed.
C. only when ASM or WA are licensed.
D. only when a specific license key is required.
Correct Answer: A
Section: (none)
Explanation
QUESTION 359
Which of the following methods of protection operates on server responses?
A. Dynamic parameter protection

B. Response code validation and response scrubbing
C. Response code validation and HTTP method validation
D. HTTP RFC compliancy check and metacharacter enforcement
Correct Answer: B
Section: (none)
Explanation
QUESTION 360
Which of the following is not a configurable parameter data type?
A. Email
B. Array
C. Binary
D. Decimal
Correct Answer: B
Section: (none)
Explanation
QUESTION 361
When we have a * wildcard entity configured in the File Type section with tightening enabled, the following may
occur when requests are passed through the policy. Which is the most accurate statement?
A. File type violations will not be triggered.

B. File type violations will be triggered and learning will be available based on these violations.
C. File type entities will automatically be added to the policy (policy will tighten).
D. File type violations will not be triggered and the entity learning section will be populated with file type
recommendations.
Correct Answer: B
Section: (none)
Explanation
QUESTION 362
A request is sent to the BIG-IP ASM System that generates a Length error violation. Which of the following
length types provides a valid learning suggestion? (Choose three.)
A. URL
B. Cookie
C. Response
D. POST data
E. Query string
Correct Answer: ADE

Section: (none)
Explanation
QUESTION 363
There are multiple HTTP class profiles assigned to a virtual server. Each profile has Application Security
enabled. Which statement is true?
A. Traffic will process through every HTTP class profile every time.
B. Traffic will process through the first HTTP class profile that it matches and then stops.
C. Traffic will process through one HTTP class profile and if the traffic matches another profile, BIG-IP System
will send a redirect to the client.
D. Traffic will only process through the HTTP class profile that it matches but always processes through the
whole list and will process through each HTTP class profile it matches.
Correct Answer: B
Section: (none)
Explanation
QUESTION 364
A security audit has determined that your web application is vulnerable to a cross site scripting attack. Which of
the following measures are appropriate when building a security policy? (Choose two.)
A. Cookie length must be restricted to 1024 bytes.
B. Attack signature sets must be applied to any user input parameters.
C. Parameter data entered for explicit objects must be checked for minimum and maximum values.
D. Parameter data entered for flow level parameters must allow some metacharacters but not others.
Correct Answer: BD
Section: (none)
Explanation
QUESTION 365
The BIG-IP ASM System sets two types of cookies to enforce elements in the security policy. The two types are
main and frame cookies. What is the purpose of the frame cookie? (Choose two.)
A. Validates domain cookies

B. Detects session expiration
C. Stores dynamic parameters and values
D. Handles dynamic parameter names and flow extractions
Correct Answer: CD
Section: (none)
Explanation
QUESTION 366
Which statement is correct concerning differences between BIG-IP ASM platforms?
A. The 3900 has more ports than the 6800.

B. The 3900 and 6800 have the same number of ports.
C. The 3900 and 6800 can support both the module and standalone versions of BIG-IP ASM.
D. The 3900 can support both module and standalone versions of BIG-IP ASM whereas the 6800 can support
only the module version of BIG-IP ASM.
Correct Answer: D
Section: (none)
Explanation
QUESTION 367
Which of the following mitigation techniques is based on anomaly detection? (Choose two)
A. Brute force attack prevention

B. Cross site request forgery prevention
C. Web scraping attack prevention
D. Parameter tampering prevention
Correct Answer: AC
Section: (none)
Explanation
QUESTION 368
Which of the following are default settings when using the Policy Builder to build a security policy based on the
QA lab deployment scenario? (Choose two.)
A. All learned entities are placed in staging.

B. Attack signatures are not placed in staging
C. The security policy is placed in blocking mode
D. Tightening is enabled only on file types and parameters.
Correct Answer: BC
Section: (none)
Explanation
QUESTION 369
Which of the following statements are incorrect regarding protection of web services? (Choose two.)
A. The BIG-IP ASM System checks to ensure web services use cookies.
B. The BIG-IP ASM System parses XML requests and XML responses.
C. The BIG-IP ASM System checks to ensure XML documents are well formed.
D. The BIG-IP ASM System uses attack signatures to enforce negative security logic.
E. The BIG-IP ASM System checks for XML syntax, schema validation, and WSDL validation.
Correct Answer: AB
Section: (none)
Explanation
QUESTION 370
Which of the following is correct regarding static parameters?
A. A static parameter is stored in a frame cookie.

B. A static parameter is predefined by the web application logic.
C. A static parameter is learned only by using the Deployment Wizard.
D. A static parameter is mapped once when creating the application flow model.
Correct Answer: B
Section: (none)
Explanation
QUESTION 371
When configuring the BIG-IP ASM System in redundant pairs, which of the following are synchronized?
(Choose two.)
A. License file
B. Security policies
C. Web applications
D. Request information
E. Traffic learning information
Correct Answer: BC
Section: (none)
Explanation
QUESTION 372
Sensitive parameter is a feature used to hide sensitive information from being displayed in which of the
following?
A. Client request
B. Server response
C. GUI and logs of BIG-IP ASM System
D. Configuration file of BIG-IP ASM System
Correct Answer: C
Section: (none)
Explanation
QUESTION 373
Tightening is a feature of which type of entity?
A. Explicit URLs
C. Flow login URLs
D. Wildcard parameters
Correct Answer: D
Section: (none)
Explanation
QUESTION 374
A client sends a request to a virtual server http://www.foo.com configured on the BIG-IP ASM System. The
virtual server has an HTTP class profile associated with Application Security enabled, all class filters set to
match all, and a pool consisting of foo.com members. The virtual server also has a default pool associated with
it. When the client sends a request for
http://www.foo.com, this traffic will be forwarded to which of the following?
A. The fallback host

B. The default pool
C. The HTTP class profile pool
D. The request will be dropped
Correct Answer: C
Section: (none)
Explanation
QUESTION 375
Which of the following is correct concerning HTTP classes?
A. A single web application can be used by several HTTP classes

B. A virtual server can only have one web application associated with it
C. A single ASM enabled HTTP class can be used by multiple virtual servers
D. Each ASM enabled HTTP class can have several active security policies associated with it
Correct Answer: C
Section: (none)
Explanation
QUESTION 376
Which of the following statements are correct regarding Attack signatures? (Choose two.)
A. Attack signatures can apply to requests, responses, and parameters.

B. Attack signatures are the basis for positive security logic with the BIG-IP ASM System.
C. Any new Attack signature downloaded manually or automatically will be active and assigned directly to the
security policy.
D. Individual Attack signatures can be assigned to the security policy. Only Attack signature sets can apply to
the security policy.
Correct Answer: AD
Section: (none)
Explanation
QUESTION 377
Which of the following is not a feature of a standalone BIG-IP ASM System?
A. Attack signatures
B. Multiple pool members
C. Positive security model
D. Real-time traffic policy builder
E. Predefined security policy templates
Correct Answer: B
Section: (none)
Explanation
QUESTION 378
What are the best reasons for using the Deployment Wizard? (Choose three.)
A. Flow level parameters checking is required.

B. The application encoding scheme needs to be determined by the BIG-IP ASM System.
C. Sufficient time is available to allow completely automated policy building based on observing live traffic.
D. The application platform must be protected against known attacks for the specific operating system, web
server, and database.
Correct Answer: BCD

Section: (none)
Explanation
QUESTION 379
When initially configuring the BIG-IP System using the config tool, which of the following parameters can be
configured? (Choose three.)
A. System hostname
B. Netmask of the management port
C. IP address of the management port
D. Default route of the management port
E. Port lockdown of the management port
Correct Answer: BCD

Section: (none)
Explanation
QUESTION 380
When building a policy based on live traffic using the automated policy builder, which of the following elements
will not be taken into account when analyzing the traffic?
A. The size of the response

B. The requested resource (URI)
C. The response code from the web server
D. The parameter values of static based parameters
Correct Answer: A
Section: (none)
Explanation
QUESTION 381
A user is building a security policy using the Deployment Wizard and the Rapid Deployment application
template. By default, which settings will be applied to the security policy? (Choose three.)
A. Data Guard will be enabled.

B. The enforcement mode will be set to transparent.
C. The encoding language will be set to auto detect.
D. Wildcard tightening will be enabled on file types and parameters.
E. The Attack signature set applied will be Generic Detection Signatures.
Correct Answer: ABE

Section: (none)
Explanation
QUESTION 382
Which method of protection is not provided by the Rapid Deployment policy template?
A. Data leakage
B. Buffer overflow
C. HTTP protocol compliance
D. Dynamic parameter validation
Correct Answer: D
Section: (none)
Explanation
QUESTION 383
Which of the following are properties of an ASM logging profile? (Choose three.)
A. storage type
B. storage filter
C. storage policy
D. web application
Correct Answer: AB
Section: (none)
Explanation
QUESTION 384
Which of the following methods of protection are used by the BIG-IP ASM System to mitigate buffer overflow
attacks?
A. HTTP RFC compliancy checks

B. Length restrictions and attack signatures
C. Length restrictions and site cookie compliancy checks
D. Metacharacter enforcement and HTTP RFC compliancy check
Correct Answer: B
Section: (none)
Explanation
QUESTION 385
Which HTTP response code ranges indicate an error condition? (Choose two.)
A. 1xx
B. 2xx
C. 3xx
D. 4xx
E. 5xx
Correct Answer: DE
Section: (none)
Explanation
QUESTION 386
The Web Application Security Administrator user role can perform which of the following functions? (Choose
two.)
A. Modify HTTP class profiles

B. Create new HTTP class profiles
C. Create new Attack signature sets
D. Assign HTTP class profiles to virtual servers
E. Configure Advanced options within the BIG-IP ASM System
Correct Answer: CE
Section: (none)
Explanation
QUESTION 387
On a BIG-IP ASM 3600, in standalone mode, which of the following pool configurations is valid?
A. Pool named vs_pool with 1 pool member, no persistence, and no load balancing method
B. Pool named vs_pool with 1 pool member, cookie persistence, and ratio load balancing method
C. Pool named vs_pool with 2 pool members, cookie persistence, and ratio load balancing method
D. Pool named vs_pool with 3 pool members, source IP persistence, and least connections load balancing
method
Correct Answer: A
Section: (none)
Explanation
QUESTION 388
The following request is sent to the BIG-IP ASM System:
GET http://www.example.local/financials/week1.xls?display=yes&user=john&logon=true
Which of the following components in this requests line represent the query string?
A. .xls
B. /week1.xls
C. /financials/week1.xls
D. display=yes&user=john&logon=true
Correct Answer: D
Section: (none)
Explanation
QUESTION 389
Which level of parameter assumes the highest precedence in BIG-IP ASM System processing logic?
A. Flow
B. Object
C. Global
D. URL
Correct Answer: A
Section: (none)
Explanation
QUESTION 390
Which of the following storage type combinations are configurable in an ASM logging profile?
A. Local and Syslog

B. Local and Remote
C. Remote and Syslog
D. Remote and Reporting Server
Correct Answer: B
Section: (none)
Explanation
QUESTION 391
Which must be sent to the license server to generate a new license?
A. the system's dossier

B. the system's host name
C. the system's base license
D. the system's purchase order number
Correct Answer: A
Section: (none)
Explanation
QUESTION 392
When initially configuring the BIG-IP system using the config utility, which two parameters can be set. (Choose
two.)
A. the netmask of the SCCP

B. the IP address of the SCCP
C. the port lockdown settings for the SCCP
D. the netmask of the host via the management port
E. the IP address of the host via the management port
F. the port lockdown settings for the host via the management port
Correct Answer: DE
Section: (none)
Explanation
QUESTION 393
A site has six members in a pool. All of the servers have been designed, built, and configured with the same
applications. It is known that each client's interactions vary significantly and can affect the performance of the
servers. If traffic should be sent to all members on a regular basis, which load balancing mode is most effective
if the goal is to maintain a relatively even load across all servers.
A. Ratio
B. Priority
C. Observed
D. Round Robin
Correct Answer: C
Section: (none)
Explanation
QUESTION 394
The incoming client IP address is 205.12.45.52. The last five connections have been sent to members C, D, A,
B, B. Given the virtual server and pool definitions and the statistics shown in the graphic, which member will be
used for the next connection?
A. 10.10.20.1:80
B. 10.10.20.2:80
C. 10.10.20.3:80
D. 10.10.20.4:80
E. 10.10.20.5:80
Correct Answer: A
Section: (none)
Explanation
QUESTION 395
A site has six members in a pool. Three of the servers are new and have more memory and a faster processor
than the others. Assuming all other factors are equal and traffic should be sent to all members, which two load
balancing methods are most appropriate? (Choose two.)
A. Ratio
B. Priority
C. Observed
D. Round Robin
Correct Answer: AC
Section: (none)
Explanation
QUESTION 396
Which two can be a part of a pool's definition? (Choose two.)
A. rule(s)
B. profile(s)
C. monitor(s)
D. persistence type
E. load balancing mode
Correct Answer: CE
Section: (none)
Explanation
QUESTION 397
What is required for a virtual server to support clients whose traffic arrives on the internal VLAN and pool
members whose traffic arrives on the external VLAN?
A. That support is never available.

B. The virtual server must be enabled for both VLANs.
C. The virtual server must be enabled on the internal VLAN.
D. The virtual server must be enabled on the external VLAN.
Correct Answer: C
Section: (none)
Explanation
QUESTION 398
A standard virtual server has been associated with a pool with multiple members. Assuming all other settings
are left at their defaults, which statement is always true concerning traffic processed by the virtual server?
A. The client IP address is unchanged between the client-side connection and the server-side connection.
B. The server IP address is unchanged between the client-side connection and the server-side connection.
C. The TCP ports used in the client-side connection are the same as the TCP ports server-side connection.
D. The IP addresses used in the client-side connection are the same as the IP addresses used in the server-
side connection.
Correct Answer: A
Section: (none)
Explanation
QUESTION 399
Monitors can be assigned to which three resources? (Choose three.)
A. NATs
B. pools
C. iRules
D. nodes
E. SNATs
F. pool members
G. virtual servers
Correct Answer: BDF

Section: (none)
Explanation
QUESTION 400
A site has assigned the ICMP monitor to all nodes and a custom monitor, based on the HTTP template, to a
pool of web servers. The HTTP-based monitor is working in all cases. The ICMP monitor is failing for 2 of the
pool member 5 nodes. All other settings are default. What is the status of the monitor is working in all cases?
What is the status of the pool members?
A. All pool members are up since the HTTP-based monitor is successful.

B. All pool members are down since the ICMP-based monitor is failing in some cases.
C. The pool members whose nodes are failing the ICMP-based monitor will be marked disabled.
D. The pool members whose nodes are failing the ICMP-based monitor will be marked unavailable.
Correct Answer: D
Section: (none)
Explanation
QUESTION 401
A site would like to ensure that a given web server's default page is being served correctly prior to sending it
client traffic. They assigned the A site would like to ensure that a given web server's default page is being
served correctly prior to sending it client traffic. They be assigned the default HTTP monitor to the pool. What
would the member status be if it sent an unexpected response to the GET request default HTTP monitor to the
pool?
A. The pool member would be marked offline (red).

B. The pool member would be marked online (green).
C. The pool member would be marked unknown (blue).
D. The pool member would alternate between red and green.
Correct Answer: B
Section: (none)
Explanation
QUESTION 402
A site is load balancing to a pool of web servers. Which statement is true concerning BIG-IP's ability to verify
whether the web servers are functioning properly or not?
A. Web server monitors can test the content of any page on the server.
B. Web server monitors always verify the contents of the index.html page.
C. Web server monitors can test whether the server's address is reachable, but cannot test a page's content.
D. Web server monitors can test the content of static web pages, but cannot test pages that would require the
web server to dynamically build content.
Correct Answer: A
Section: (none)
Explanation
QUESTION 403
The current status of a given pool is offline (red). Which condition could explain that state? Assume the
descriptions below include all monitors assigned for each scenario.
A. No monitors are currently assigned to any pool, member or node.

B. The pool has a monitor assigned to it, and none of the pool members passed the test. The pool has a
monitor assigned to it, and none of the pool members passed the test.
C. The pool has a monitor assigned to it, and only some of the pool's members passed the test.
D. A monitor is assigned to all nodes and all nodes have passed the test. The pool's members have no specific
monitor assigned to them.
Correct Answer: B
Section: (none)
Explanation
QUESTION 404
You need to terminate client SSL traffic at the BIG-IP and also to persist client traffic to the same pool member
based on a BIG-IP supplied cookie. Which four are profiles that would normally be included in the virtual
server's definition? (Choose four.)
A. TCP
B. HTTP
C. HTTPS
D. ClientSSL
E. ServerSSL
F. CookieBased Persistence

Section: (none)
Explanation
QUESTION 405
A site needs to terminate client HTTPS traffic at the BIG-IP and forward that traffic unencrypted. Which two are
profile types that must be associated with such a virtual server? (Choose two.)
A. TCP
B. HTTP
C. HTTPS
D. ClientSSL
E. ServerSSL
Correct Answer: AD
Section: (none)
Explanation
QUESTION 406
Which three statements describe a characteristic of profiles? (Choose three.)
A. Default profiles cannot be created or deleted.

B. Custom profiles are always based on a parent profile.
C. A profile can be a child of one profile and a parent of another.
D. All changes to parent profiles are propagated to their child profiles.
E. While most virtual servers have at least one profile associated with them, it is not required.
Correct Answer: ABC

Section: (none)
Explanation
QUESTION 407
A virtual server is defined using a source address based persistence profile. The last five connections were A,
B, C, A, C. Given the conditions shown in the graphic, if a client with IP address 205.12.45.52 opens a
connection to the virtual server, which member will be used for the connection?
A. 10.10.20.1:80
B. 10.10.20.2:80
C. 10.10.20.3:80
D. 10.10.20.4:80
E. 10.10.20.5:80
Correct Answer: B
Section: (none)
Explanation
QUESTION 408
How is persistence configured?
A. Persistence is an option within each pool's definition.
B. Persistence is a profile type; an appropriate profile is created and associated with virtual server.
C. Persistence is a global setting; once enabled, load balancing choices are superceded by the persistence
method that is specified.
D. Persistence is an option for each pool member. When a pool is defined, each member's definition includes
the option for persistence.
Correct Answer: B
Section: (none)
Explanation
QUESTION 409
Which cookie persistence method requires the fewest configuration changes on the web servers to be
implemented correctly?
A. insert
B. rewrite
C. passive
D. session
Correct Answer: A
Section: (none)
Explanation
QUESTION 410
Assume a virtual server has a ServerSSL profile. What SSL certificates are required on the pool members.
A. No SSL certificates are required on the pool members.

B. The pool members SSL certificates must only exist.
C. The pool members SSL certificates must be issued from a certificate authority.
D. The pool members SSL certificates must be created within the company hosting the BIG-IPs.
Correct Answer: B
Section: (none)
Explanation
QUESTION 411
Which is an advantage of terminating SSL communication at the BIG-IP rather than the ultimate web server.
A. Terminating SSL at the BIG-IP can eliminate SSL processing at the web servers.
B. Terminating SSL at the BIG-IP eliminates all unencrypted traffic from the internal network.
C. Terminating SSL at the BIG-IP eliminates all unencrypted traffic from the internal network.
D. Terminating SSL at the BIG-IP eliminates the need to purchase SSL certificates from a certificate authority.
E. Terminating SSL at the BIG-IP eliminates the need to use SSL acceleration hardware anywhere in the
network.
Correct Answer: A
Section: (none)
Explanation
QUESTION 412
A BIG-IP has two load balancing virtual servers at 150.150.10.10:80 and 150.150.10.10:443. The port 80 virtual
server has SNAT automap configured. There is also a SNAT configured at 150.150.10.11 set for a source
address range of 200.200.1.0 / 255.255.255.0. All other settings are at their default states.
If a client with the IP address 200.200.1.1 sends a request to https://150.150.10.10, what is the source IP
address when the associated packet is sent to the pool member?
A. 200.200.1.1
B. 150.150.10.11
C. Floating self IP address on VLAN where the packet leaves the system
D. Floating self IP address on VLAN where the packet arrives on the system
Correct Answer: B
Section: (none)
Explanation
QUESTION 413
Which statement is true concerning SNATs using automap?
A. Only specified self-IP addresses are used as automap addresses.

B. SNATs using automap will translate all client addresses to an automap address.
C. A SNAT using automap will preferentially use a floating self-IP over a nonfloating self-IP.
D. A SNAT using automap can be used to translate the source address of all outgoing traffic to the same
address regardless of which VLAN the traffic is sent through.
Correct Answer: C
Section: (none)
Explanation
QUESTION 414
Which two statements are true about NATs? (Choose two.)
A. NATs support UDP, TCP, and ICMP traffic.

B. NATs can be configured with mirroring enabled or disabled.
C. NATs provide a one-to-one mapping between IP addresses.
D. NATs provide a many-to-one mapping between IP addresses.
Correct Answer: AC
Section: (none)
Explanation
QUESTION 415
Which statement describes a typical purpose of iRules?
A. iRules can be used to add individual control characters to an HTTP data stream.
B. iRules can be used to update the timers on monitors as a server load changes.
C. iRules can examine a server response and remove it from a pool if the response is unexpected
D. iRules can be used to look at client requests and server responses to choose a pool member to select for
load balancing.
Correct Answer: A
Section: (none)
Explanation
QUESTION 416
A virtual server is listening at 10.10.1.100:80 and has the following iRule associated with it:
If a user connects to http://10.10.1.100/foo.html and their browser does not specify a UserAgent, which pool will
receive the request?
A. MSIE_pool
B. Mozilla_pool
Correct Answer: B
Section: (none)
Explanation
QUESTION 417
Which event is always triggered when the client sends data to a virtual server using TCP?
A. HTTP_DATA
B. CLIENT_DATA
C. HTTP_REQUEST
D. VS_CONNECTED
Correct Answer: B
Section: (none)
Explanation
QUESTION 418
A virtual server is listening at 10.10.1.100:any and has the following iRule associated with it:
If a user connects to 10.10.1.100 and port 22, which pool will receive the request?
A. ftp pool
B. telnet pool
Correct Answer: D
Section: (none)
Explanation
QUESTION 419
When configuring a Virtual Server to use an iRule with an HTTP_REQUEST event, which lists required steps in
a proper order to create all necessary objects?
A. create profiles, create the iRule, create required pools, create the Virtual Server
B. create the Virtual Server, create required pools, create the iRule, edit the Virtual Server
C. create a custom HTTP profile, create required pools, create the Virtual Server, create the iRule
D. create required pools, create a custom HTTP profile, create the iRule, create the Virtual Server
Correct Answer: B
Section: (none)
Explanation
QUESTION 420
Which statement is true concerning a functional iRule?
A. iRules use a proprietary syntax language.

B. iRules must contain at least one event declaration.
C. iRules must contain at least one conditional statement.
D. iRules must contain at least one pool assignment statement.
Correct Answer: B
Section: (none)
Explanation
QUESTION 421
What is the purpose of ZoneRunner?
A. ZoneRunner adds a GUI interface for configuration of Wide-IP names.

B. ZoneRunner adds a GUI interface for configuration of BIND database files for zones where the GTM
System is a primary name server.
C. ZoneRunner adds a GUI interface for configuration of BIND database files where the GTM System is not a
primary or secondary server.
D. Zonerunner adds a GUI interface for configuration of BIND database files for zones where the GTM System
is a primary or secondary name server.
Correct Answer: D
Section: (none)
Explanation
QUESTION 422
GTM can sign a DNS response using DNSSEC only if the DNS request. GTM can sign a DNS response using
DNSSEC only if the DNS request.
A. has the DO bit set.

B. is a part of a DNSSEC zone.
C. is for a Wide-IP name on the GTM.
D. is answered by BIND running on the GTM.
Correct Answer: B
Section: (none)
Explanation
QUESTION 423
Which statement about Generic Host Servers is true?
A. GTM Systems can initiate a big3d agent on Generic Host Servers.

B. GTM Systems cannot provide path metrics for Virtual Servers managed by a Generic Host Server.
C. GTM Systems can monitor a Generic Host Server and can cause a Generic Host Server to act as a
Statistics Collection Server.
D. GTM Systems can monitor a Generic Host Server but cannot cause a Generic Host Server to act as a
Statistics Collection Server.
Correct Answer: D
Section: (none)
Explanation
QUESTION 424
By default, how frequently are log files rotated?
A. hourly
B. daily
C. weekly
D. There is no default; the administrator sets the frequency.
Correct Answer: B
Section: (none)
Explanation
QUESTION 425
When configuring monitors for individual pool members, which three options can be selected? (Choose three.)
A. inherit the pool's monitor

B. choose a default monitor
C. inherit the Wide-IP's monitor
D. assign a monitor to the specific pool member
E. do not assign any monitor to the specific pool member
Correct Answer: ADE

Section: (none)
Explanation
QUESTION 426
Which two daemons only run after the entire license process has been completed? (Choose two.)
A. zrd
B. tmm
C. ntpd
D. gtmd
Correct Answer: AD
Section: (none)
Explanation
QUESTION 427
What does the BIG-IP_add script do?
A. add BIG-IP servers to the wideip.conf file

B. add an existing GTM System to a sync group
C. synchronize configuration files between BIG-IP Systems
D. exchange web certificates and keys between BIG-IP Systems
Correct Answer: D
Section: (none)
Explanation
QUESTION 428
Which dynamic load balancing mode affects load balancing decisions based on path metrics?
A. Packet Rate
B. Completion Rate
C. Least Connections
D. Virtual Server Capacity
Correct Answer: B
Section: (none)
Explanation
QUESTION 429
If the GTM System receives a packet destined for one of its Listener addresses the GTM will process the
request _____
A. either through Wide-IP processing or BIND processing

B. through Wide-IP processing and may process it through BIND processing
C. through BIND processing and may process it through Wide-IP processing
D. through Wide-IP processing and BIND processing and choose the best answer between the two
Correct Answer: B
Section: (none)
Explanation
QUESTION 430
Which file contains the list of events for which the GTM System will send traps to an SNMP manager?
A. /etc/snmpd.conf
B. /etc/syslogng.conf
C. /etc/alertd/alert.conf
D. /etc/gtm_snmptrap.conf
Correct Answer: C
Section: (none)
Explanation
QUESTION 431
Which three parameters can be specified within the Setup Utility? (Choose three.)
A. password of the "root" user

B. IP address of an NTP server
C. IP address of an initial Wide-IP
D. IP address restrictions for SSH access
E. all necessary administrative IP addresses (including floating addresses)
Correct Answer: ADE

Section: (none)
Explanation
QUESTION 432
Which of the following are correct regarding Wildcard entities? (Choose two.)
A. Wildcard entities are the basis for positive security logic.

B. Wildcard entities are the basis for negative security logic.
C. Wildcard entities require the need to learn only from violations.
D. Wildcard entities can be applied to file types, URLs, cookies and parameters.
Correct Answer: AD
Section: (none)
Explanation
QUESTION 433
Flow login allows for more granular protection of login and logout URLs within web applications. Which of the
following are components of flow login? (Choose three.)
A. Schema
B. Login URLs
C. Login pages
D. Attack signatures
E. Access validation
Correct Answer: BCE

Section: (none)
Explanation
QUESTION 434
What occurs when a load command is issued?
A. The running configuration is replaced by the any portion of the configuration files that are syntactically
correct.
B. The running configuration is loaded into files for storage.
C. The running configuration is compared to the configuration in files and, when changes are noted, the
version in the files is loaded over what is in money.
D. The running configuration is replaced by the configuration in the files, but only if they are syntactically
correct.
Correct Answer: D
Section: (none)
Explanation
QUESTION 435
What occurs when a load command is issued?
A. rootBIG-IPsystem[Active][tmos.Itm.pool]#create pooh members add {170.16.20.1:80}

B. rootBIG-IPsystem[Active][tmos.Itm.pool]#create pooh members add {172.16.20.1:80}
C. rootBIG-IPsystem[Active][tmos.Itm.pool]#create pooh members add {172.16.20.1:80{} }
D. rootBIG-IPsystem[Active][tmos.Itm.pool]#create pooh members add {172.16.20.1:80{priority group 2}}
Correct Answer: A
Section: (none)
Explanation
QUESTION 436
Which three files/data items are included in a BIG-IP UCS backup file? (Choose three.)
A. the BIG-IP administrative addresses

B. the BIG-IP license
C. the BIG-IP log files
D. the BIG-IP default traps
E. the BIG-IP host name
Correct Answer: ABE

Section: (none)
Explanation
QUESTION 437
Could an iRule perform persistence based on a cookie?
A. Yes an iRule could be designed to persist based on the contents of a cookie.

B. No. iRules cannot affect persistence.
C. Yes. An iRule could be designed to persist based on the contents of a cookie.
D. No. Cookie persistence is only is based on a cookie persistence profile.
Correct Answer: C
Section: (none)
Explanation
QUESTION 438
An LTM has the 3 virtual servers, 2 SNATs, four self IP addresses defined and the networks shown in the
exhibit. Selected options for each object are shown below. Settings not shown are at their defaults. Assume
port exhaustion has not been reached.
10.10.2.102:443.
When the request is processed, what will be the source and destination IP addresses?
A. Source IP: 10.10.2.103; Destination IP: pool member in the 192.168/16 network
B. Source IP: 10.10.201; Destination IP: pool member in the 192.168/16 network G
C. Source IP: 10.10.2.103; Destination IP: 10.10.2.102
E. Source IP: 10.20.10.50; Destination IP: pool member in the 192.168/16 network
F. Source IP: 10.10.201; Destination IP: 10.102.102
Correct Answer: C
Section: (none)
Explanation
QUESTION 439
How is traffic flow through transparent virtual servers different from typical virtual servers?
A. Traffic flow through transparent virtual servers must be forwarded through a single routing device.
B. Traffic flow through transparent virtual servers does not have IP address translation performed.
C. Traffic flow through transparent virtual severs is not load balanced.
D. Traffic flow through transparent virtual servers is bridged (leave IP and MAC.addresses intact) rather than
routed (leave IP address intact but change the MAC.addresses).
Correct Answer: B
Section: (none)
Explanation
QUESTION 440
How is traffic flow through transparent virtual servers different from typical virtual servers? (Choose two.)
A. any text string within a cookie

B. any bytes within the initial client request packet
C. an IP address
D. the value in the tcp acknowledgement field
Correct Answer: AC
Section: (none)
Explanation
QUESTION 441
A monitor has been defined with an alias port of 443. All other options are left at their defaults. The
administrator wishes to assign it to a pool of members where the members' ports vary. Which is the result?
A. For each member, if the member port is not 443, the member will be marked down. For each member, if the
member port is not 443, the member will be marked down.
B. For each member, the monitor will test member node at port 443. For each member, the monitor will test
the member node at port 443.
C. For each member. If it is running an SSL service at the member port, the monitor may work. Otherwise, the
monitor will fail and the member for each member, if it is running an SSL service at the member port, the
monitor may work. Otherwise, the monitor will fail and the member will be marked down.
D. This assignment is not allowed since the port do not match.
Correct Answer: B
Section: (none)
Explanation
QUESTION 442
Which two processes are involved when BIG-IP systems issue traps? (Choose two.)
A. bigd
B. alertd
C. smtpd
D. syslogng
Correct Answer: BD
Section: (none)
Explanation
QUESTION 443
After editing and saving changes to the configuration file containing virtual servers, what is the immediate
result?
A. The new configuration is verified and loaded.

B. The new configuration is verified not loaded.
C. The new configuration is verified.
D. The new configuration is loaded but not verified.
E. The new configuration is neither verified not loaded.
F. The new configuration is verified and loaded if is it syntactically correct.
Correct Answer: E
Section: (none)
Explanation
QUESTION 444
In the following configuration, a virtual server has the following HTTP class configuration:
A request arriving for WWW.F5.COM will be matched by which class(es)?
A. Class 1
B. Class 2
C. Both Class 1 and Class 2
D. The request will be dropped
Correct Answer: B
Section: (none)
Explanation
QUESTION 445
Learning suggestions in the Policy Building pages allow for which of the following? (Choose two.)
A. XML-based parameters and associated schema are automatically learned.

B. Blocking response pages can be automatically generated from web site content.
C. Flow level parameters are displayed when found and can be accepted into the current policy.
D. The administrator may modify whether the BIG-IP ASM System will learn, alarm, or block detected
violations.
E. Maximum acceptable values for length violations are calculated and can be accepted into the security policy
by the administrator.
Correct Answer: CE
Section: (none)
Explanation
QUESTION 446
Under what condition must an appliance license be reactivated?
A. Licenses only have to be reactivated for RMAs no other situations.

B. Licenses generally have to be reactivated during system software upgrades.
C. Licenses only have to be reactivated when new features are added (IPv6, Routing Modules, etc.) no other
situations.
D. Never. Licenses are permanent for the platform regardless the version of software installed.
Correct Answer: B
Section: (none)
Explanation
QUESTION 447
Which three methods can be used for initial access to a BIG-IP system. (Choose three.)
A. CLI access to the serial console port

B. SSH access to the management port
C. SSH access to any of the switch ports
D. HTTP access to the management port
E. HTTP access to any of the switch ports
F. HTTPS access to the management port
G. HTTPS access to any of the switch ports
Correct Answer: ABF

Section: (none)
Explanation
QUESTION 448
When implementing Data Guard, BIG-IP ASM scans for suspicious patterns in? (Choose two.)
A. All client requests

B. All server responses
C. Specific client requests
D. Specific server responses
Correct Answer: BD
Section: (none)
Explanation
QUESTION 449
A web client accesses a web application using what protocol?
A. TCP
B. XML
C. HTML
D. HTTP
Correct Answer: D
Section: (none)
Explanation
QUESTION 450
In the following request, which portion represents a parameter name?
A. Yes
B. User
C. Week1
D. Financials
Correct Answer: B
Section: (none)
Explanation
QUESTION 451
Which of the following is not a method of protection for user-input parameters?
A. Value extraction
C. Length restriction
D. Meta character enforcement
Correct Answer: A
Section: (none)
Explanation
QUESTION 452
By default, BIG-IP ASM allows which of the following HTTP methods in a client request? (Choose three.)
A. PUT
B. GET
C. POST
D. HEAD
E. TRACE
Correct Answer: BCD

Section: (none)
Explanation
QUESTION 453
The Flow Login feature prevents which web vulnerability from occurring?
A. Buffer overflow
B. Cookie poisoning
C. Forceful browsing
D. Cross site scripting
Correct Answer: C
Section: (none)
Explanation
QUESTION 454
On a standalone BIG-IP ASM system, which of the following configuration is valid?
A. Pool named http_pool with 1 pool member, no persistence, and no load balancing method
B. Pool named http_pool with 3 pool members, cookie persistence, and ratio load balancing method
C. Pool named http_pool with 2 pool members, source IP persistence, and least connections load balancing
method
D. Pool named http_pool with 3 pool members, cookie persistence, and least connections load balancing
method
Correct Answer: A
Section: (none)
Explanation
QUESTION 455
Which of the following violations cannot be learned by Traffic Learning?
A. RFC violations
B. File type length violations
C. Attack signature violations
D. Meta character violations on a specific parameter.
Correct Answer: A
Section: (none)
Explanation
QUESTION 456
What is the purpose of the IP addresses listed in the Trusted IP section when using Policy Builder?
A. Incoming requests with these IP addresses will never get blocked by BIG-IP ASM.
B. Incoming requests with these IP addresses will not be taken into account as part of the learning process,
they will be allowed to do anything.
C. Incoming requests with these IP addresses will automatically be accepted into the security
www.braindumps.com 87 F5 101 Exam policy, Policy Builder will validate that future requests with this traffic
will not create a violation.
D. Incoming requests with these IP addresses will be used by Policy Builder to create an alternate more
advanced security policy, this additional policy will not be enabled unless forced by the administrator.
Correct Answer: C
Section: (none)
Explanation
QUESTION 457
Which of the following protocols can be protected by Protocol Security Manager? (Choose three.)
A. FTP
B. SSH
C. HTTP
D. SMTP
E. Telnet
Correct Answer: D
Section: (none)
Explanation
QUESTION 458
Which of the following user roles have access to make changes to security policies? (Choose two.)
A. Guest
B. Operator
C. Administrator
D. Web Application Security Editor
Correct Answer: CD
Section: (none)
Explanation
QUESTION 459
Which of the following are methods BIG-IP ASM utilizes to mitigate web scraping vulnerabilities? (Choose two.)
A. Monitors mouse and keyboard events

B. Detects excessive failures to authenticate
C. Injects JavaScript code on the server side
D. Verifies the client supports JavaScript and cookies
Correct Answer: AD
Section: (none)
Explanation
QUESTION 460
When choosing Fundamental as the Policy Builder security policy type, BIG-IP ASM will learn and enforce the
following components? (Choose two.)
A. Attack signatures
B. Global parameters
C. HTTP protocol compliance
D. URLs and meta characters
Correct Answer: AC
Section: (none)
Explanation

f5 101 Latest

Загружено:

Сведения о документе

Оригинальное название

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

f5 101 Latest

Загружено:

Авторское право:

Доступные форматы

101.prepaway.premium.exam.

Application Delivery Fundamentals

A. Visual Policy Editor

A. Doesn't require in depth web application knowledge

A. They provide a secure connection between a client and LTM

Correct Answer: BCDE

A. It increases the bandwidth between the client and LTM.

TCP Express is licensed including in LTM

A. It decreases the CPU load on LTM

Correct Answer: ACE

GTM solves three of these standard DNS limitations

Correct Answer: ABD

Correct Answer: contain -or- include

A _______ object maps a FQDN to virtual servers. (Fill in)

Correct Answer: Wide IP

A. Connect the GTM and LTM with a network crossover cable.

Correct Answer: BCF

Integrating LTM systems with GTM systems on a network

Correct Answer: iQuery

Correct Answer: ABEF

A. GTM uses cached information to determine an alternate route.

A. Subscription purchasing options

Subscription purchasing options is in Partner Resource Center

A. Only requests for specific ports are allowed through LTM.

Correct Answer: BCF

A. Track inbound and outbound traffic

A. Only GTM devices can act as a prober.

Correct Answer: BDEF

A. They want GTM to examine all DNS queries.

A. F5 can ensure a DNS DDoS attack is not successful.

A. Secure the connection between WAN sites.

Correct Answer: BDE

A. It verifies traffic based on antivirus signatures.

Correct Answer: BCEF

A. The cookie's timeout value can be customized.

Correct Answer: BCD

Correct Answer: DEF

Correct Answer: CDF

Correct Answer: BCDE

Correct Answer: TMOS

A. On a DNS listener object

Correct Answer: ABD

Correct Answer: ABD

A. Caching HTTP data

A. Doesn't require in depth web application knowledge

A. The attacks are requests a user should be allowed to make

A. ASM can be deployed easily

A. Number of active sessions

A. It performs rate shaping to reduce overflow.

A. Challenge them to run performance testing on their Web site.

A. It adds a layer, security to a Web site

Correct Answer: BCD

A. An organization using Novell Netware for authentication.

Correct Answer: BCE

Correct Answer: ACE

A. A Web site that goes unused

Correct Answer: ABCD

A. Windows Group Policy

A. The time it takes to generate an HTTP request.

Correct Answer: CEF

Correct Answer: ABCD

A. Improve website performance

A. Layer 7 DoS attacks