F5CAB3 Exam Dumps - BIG-IP Administration Data Plane Configuration (F5CAB3) exam

For HTTP-based applications, cookie persistence is the most appropriate and commonly recommended persistence method.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Cookie persistence inserts or uses an HTTP cookie to maintain session affinity.

It operates at Layer 7 (HTTP) and is application-aware.

It allows persistence to be maintained even when multiple clients are behind a NAT device.

Why the other options are incorrect:

A. Destination addressDestination address persistence is generally used for inbound traffic patterns such as firewall or proxy scenarios.

B. Hash persistenceHash persistence is less granular and not HTTP-specific.

C. SSL persistenceSSL persistence is typically used when SSL session IDs are reused and is less reliable than cookies for HTTP applications.

Correct Resolution:

Using cookie persistence ensures that HTTP web requests are consistently directed to the same pool member.

Forwarding (IP) virtual servers forward traffic based on routing decisions and do not use pools or pool members.

SSH is a Layer 4 TCP-based protocol that operates on TCP port 22 and does not use HTTP in any capacity. In the exhibit, the Virtual Server is configured with an HTTP Profile applied, which is inappropriate for SSH traffic and causes connection failures.

According to the BIG-IP Administration: Data Plane Configuration documentation:

An HTTP profile must only be applied to Virtual Servers handling HTTP or HTTPS traffic.

When an HTTP profile is attached, BIG-IP expects HTTP headers and attempts to parse application-layer data.

Non-HTTP protocols such as SSH, FTP (control), SMTP, and other raw TCP services will fail if an HTTP profile is enabled.

Why the other options are incorrect:

A. Set Protocol to UDPSSH uses TCP, not UDP. Changing the protocol would break SSH entirely.

B. Set Source Address to 10.1.1.2The source address setting controls client access restrictions and is unrelated to protocol parsing issues.

C. Set Destination Address/Mask to 0.0.0.0/0The destination address is already valid for a specific SSH service and does not impact protocol handling.

Correct Resolution:

The BIG-IP Administrator should remove the HTTP Profile (set it to None) so the Virtual Server functions as a pure Layer 4 TCP service, allowing SSH connections to pass through successfully.

In a BIG-IP environment, a Fallback Persistence Profile is utilized as a secondary "stickiness" mechanism when the primary (Default) persistence method fails to provide a valid persistence record. For example, if a Virtual Server uses HTTP Cookie Persistence as its primary method, but a client’s browser has cookies disabled, the BIG-IP will be unable to find a persistence cookie in the request. Without a fallback method, the system would treat every request from that client as a new, independent connection, potentially breaking the application session.

Source Address Affinity (also known as Source Address Persistence) is the most common and standard choice for a fallback profile. It operates at the network layer (Layer 3) by tracking the client’s source IP address. Because every IP packet contains a source address, this method is virtually guaranteed to work even when application-layer data (like Cookies or SSL Session IDs) is missing or encrypted beyond the BIG-IP's visibility. While Universal (Option A) and Hash (Option D) profiles are highly flexible and can use iRules to persist on almost any data, they require specific configuration and logic that may not always be present or valid. SSL persistence (Option C) relies on the SSL Session ID, which frequently changes due to modern browser security practices (session renegotiation), making it less reliable than Source Address Affinity. By configuring Source Address Affinity as the fallback, the administrator ensures that the BIG-IP has a "safety net" to maintain session integrity based on the client's IP address when the more granular cookie-based persistence is unavailable.

X-Forwarded-For inserts the original client IP into HTTP headers, preserving client identity while SNAT is enabled.