Free F5 Networks F5CAB3 Exam Dumps August 2026

The log message 'aggressive mode activated' indicates that the BIG-IP's adaptive connection management system (the 'Sweeper') has detected that the system's memory or connection limits are reaching a critical threshold. To protect the system from crashing due to memory exhaustion (OOM), the BIG-IP enters Aggressive Mode, where it begins to proactively and rapidly reap (close) idle connections to free up resources for new incoming traffic.

To mitigate this and return the system to a healthy state, the administrator needs to reduce the overall resource footprint of existing connections. Decreasing the TCP profile Idle Timeout value (Option B) is the most effective administrative action. In many environments, the default idle timeout is 300 seconds (5 minutes). If a large number of connections remain 'open' in the BIG-IP connection table long after the clients have stopped sending data, they consume valuable TMM (Traffic Management Microkernel) memory. By lowering the timeout (e.g., to 60 or 120 seconds), the BIG-IP can expire and remove these inactive entries much sooner, preventing the connection table from bloating and triggering the Sweeper's aggressive mode.

Conversely, increasing the timeout (Option C) would exacerbate the problem by keeping 'dead' connections in memory even longer. Connection Mirroring (Option D) actually increases memory usage because every connection must be duplicated on the standby peer. An active-active configuration (Option A) might spread the load but does not address the underlying resource management issue on the individual units. Therefore, tightening the idle timers is the standard procedural fix for memory pressure caused by high connection volumes.

When multiple hostnames resolve to the same IP address and encrypted communication is required, the BIG-IP must be able to present the correct SSL certificate based on the hostname requested by the client. This is accomplished using Server Name Indication (SNI).

According to BIG-IP Administration: Data Plane Configuration documentation:

SNI is a client-side TLS extension, where the client includes the requested hostname during the SSL handshake.

BIG-IP evaluates this hostname using the Client SSL profile, not the Server SSL profile.

The ''Server Name'' setting in the Client SSL profile enables BIG-IP to select the appropriate SSL certificate for the requested hostname.

Why option C is correct:

Client SSL profile handles inbound (client-side) encryption.

Server Name enables SNI-based certificate selection when multiple DNS names share the same virtual server IP.

Why the other options are incorrect:

A . Client SSL, Client NameThere is no Client SSL setting called Client Name for SNI certificate selection.

B . Server SSL, Server NameServer SSL is used for encryption between BIG-IP and backend servers, not for client-side hostname identification.

D . Server SSL, Client NameServer SSL does not process client-requested hostnames during TLS negotiation.

Correct Resolution:

Configure a Client SSL profile and enable the Server Name (SNI) setting to support multiple encrypted hostnames on the same virtual server IP.

The BIG-IP Configuration Utility (GUI) organizes information hierarchically to allow for granular management of application objects. A Pool is a collection of backend servers (pool members) that provide the same service. To verify the specific network parameters---such as the IP address and the service port---of the servers within a pool, the administrator must navigate to the specific pool's configuration.

The standard procedural path to verify this is Local Traffic > Pools: Pool List, where the administrator selects the specific pool name. Once inside the pool's configuration, the Members tab displays a list of all IP addresses and service ports associated with that pool. Under the 'Service Port' column, the administrator can confirm if the member is listening on port 80 (HTTP).

Options A and B are incorrect for this specific verification task. While Nodes (Option A) show the health of a physical server, a node represents only an IP address and does not have a 'Service Port' associated with it until it is defined as a pool member. Verifying the Health Monitor (Option B) would tell the administrator how the system is checking the member's status, but it does not definitively show the port on which the member is actually receiving application traffic. In a BIG-IP environment, a pool member is uniquely identified by the combination of its Node IP and its Service Port, and the Members tab is the primary interface for managing and auditing these specific member attributes.

X-Forwarded-For inserts the original client IP into HTTP headers while SNAT is enabled.

The log message ''Intercept exhaustion'' indicates that the BIG-IP system has exhausted the available source port translations for one or more SNAT addresses. This occurs when too many concurrent client connections are being translated through a limited number of SNAT IP addresses, and all ephemeral source ports (typically ~64,000 per SNAT IP) are in use.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Each SNAT IP address provides a finite number of available source ports.

When the number of concurrent connections exceeds the available port space, the BIG-IP logs an Intercept exhaustion error and new connections fail.

The recommended resolution is to increase the available SNAT resources by adding additional IP addresses to the SNAT pool.

Why the other options are incorrect:

A . Increase the timeout of the SNAT addressesIncreasing timeouts may actually worsen the problem by keeping ports allocated longer, accelerating port exhaustion.

B . Remove the SNAT pool and apply SNAT AutomapSNAT Automap uses the Self IP addresses on the egress VLAN, which may not provide additional capacity and can introduce routing or design issues. This is not a direct or recommended fix for SNAT exhaustion.

C . Remove an IP address from the SNAT poolThis would reduce the number of available source ports and further exacerbate the intercept exhaustion condition.

Correct Resolution:

By adding an IP address to the SNAT pool, the BIG-IP increases the total number of available source ports, alleviating intercept exhaustion and restoring successful client connections.

In BIG-IP systems, iRules influence traffic only when they are attached to a Virtual Server. If application traffic is being sent to nodes or pool members that are not defined in the pool, this typically indicates that an iRule is overriding the default load-balancing behavior by explicitly selecting a pool or node.

According to BIG-IP Administration: Data Plane Configuration and official F5 guidance:

iRules are associated with Virtual Servers, not directly with pools or nodes.

To determine whether an iRule is actively affecting traffic, the administrator must inspect the Virtual Server configuration.

Explanation of the correct answers:

B . Via the GUI at the Resources tab for the virtual serverThe Resources tab in the Configuration Utility displays all traffic-handling objects applied to the Virtual Server, including assigned iRules. This is the primary GUI location to verify whether an iRule is influencing data plane traffic.

C . Via TMSH with the list /ltm virtual <virtual_server> commandThis TMSH command displays the full Virtual Server configuration, including any iRules listed under the rules section. It is the authoritative CLI method to confirm iRule usage.

Why the other options are incorrect:

A . Via TMSH with the list /ltm rule <irule> commandThis command only shows the contents of an iRule and does not indicate whether the iRule is attached to or used by any Virtual Server.

D . Via the GUI at the iRule tab for the virtual serverBIG-IP does not provide a dedicated ''iRule'' tab on Virtual Servers. iRules are viewed and managed under the Resources tab.

Correct Conclusion:

To verify whether an iRule is responsible for unexpected node selection, the BIG-IP Administrator must examine the Virtual Server configuration, either through the Resources tab in the GUI or by using TMSH to list the Virtual Server configuration.