Free F5-CSE Cloud Practice Questions

Question 1

During a one-arm BIG-IP VE migration, pool monitors stay green but client requests time out; captures show server replies bypassing BIG-IP. Backend routes are fixed, and a valid SNAT address is available. Clients connect directly to the TLS-terminating BIG-IP and can supply arbitrary X-Forwarded-For headers. The application logs the header received from BIG-IP. How should routing and trustworthy client-address logging be completed?

Accepted Answer

Use the SNAT address, remove supplied X-Forwarded-For values, and insert the observed client IP.

Answer

Overwrite X-Forwarded-For with the observed client IP, preserving the packet source on server-side connections.

Answer

Enable source-address persistence and retain the incoming X-Forwarded-For header to preserve the client return path.

Answer

Use the SNAT address and retain an incoming X-Forwarded-For value whenever the client supplies one.

Question 2

Payroll federation still works, but the newly registered Inventory application fails sign-in at BIG-IP APM, its SAML service provider. Inventory's assertion has a valid trusted-IdP signature, a current validity interval, and the correct Inventory recipient URL. Its Audience value is Payroll's entity ID. The two applications must retain separate SP identities. Where should the corrective change be made?

Accepted Answer

In Inventory's IdP application entry, by correcting the audience mapping while preserving Inventory's distinct SP entity ID.

Answer

In APM's time validation settings, by extending the accepted assertion lifetime and clock-skew allowance for both applications.

Answer

In Inventory's SP registration, by replacing its entity ID with Payroll's and leaving the existing IdP application entries unchanged.

Answer

In the shared federation service, by suspending both applications and rotating the IdP signing key before restoring access.

Question 3

No response reaches the orchestrator after an iControl REST call to create the pool /Retail/checkout_pool. Its journal records only request submission. A pool named checkout_pool already exists in /Common, and the endpoint offers no request-deduplication token. Before attempting another write, the recovery handler should:

Accepted Answer

Retrieve /Retail/checkout_pool and compare its members and settings with the submitted request.

Answer

Repeat the create request; a name-conflict response will confirm that the intended configuration was applied.

Answer

Delete /Retail/checkout_pool, then recreate it and record the acknowledged response.

Answer

Reuse /Common/checkout_pool if its members match, changing the Retail service to reference that shared pool.

Question 4

An active/standby BIG-IP VE pair must sustain 1.2 Gbit/s after either appliance fails, while leaving at least 20% of the surviving appliance's effective throughput unused. All profiles meet the other resource requirements. Each option lists independent throughput limits for the same workload: the purchased license, production cloud path, and processing capacity benchmarked without those two caps, in Gbit/s. Which per-appliance profile qualifies?

Accepted Answer

License 3.0; cloud path 5.0; processing 1.8

Answer

License 3.0; cloud path 1.4; processing 2.4

Answer

License 1.0; cloud path 5.0; processing 3.0

Answer

License 3.0; cloud path 5.0; processing 1.3

Question 5

A traffic review finds that BIG-IP DNS returned Site A in 49% of its answers and Site B in 51%, close to the configured 1:1 Ratio policy. Both sites remained healthy, but their HTTP request totals were 80% and 20%. Recursive resolvers serve different-sized client populations, and many clients reuse established connections. Each site's LTM serves only its local backends. What is the soundest interpretation?

Accepted Answer

The ratio governs DNS selections; cached answers and connection reuse can produce a different distribution of HTTP requests.

Answer

Local LTM persistence overrides the DNS weights, so authoritative selection counts cannot validate the configured policy.

Answer

Equal DNS selections establish equal client connections, so the imbalance indicates inaccurate HTTP logging.

Answer

The 80:20 HTTP split establishes that Site A's DNS answers remain cached four times as long as Site B's.

Question 6

An on-premises BIG-IP pool member is being retired after cloud capacity comes online. The remaining members have adequate capacity and access to the same application session data. Although the retiring member is Disabled, it still receives new TCP connections matching existing persistence records. Active uploads must finish, no additional TCP connections may reach that member, and new clients must still reach the other members. Choose the operation that preserves service during the drain.

Accepted Answer

Set it to Forced Offline and let active connections drain.

Answer

Leave it Disabled until the existing persistence records expire.

Answer

Clear all persistence records and reset the member's active connections.

Answer

Disable the virtual server until the member's connection count reaches zero.

Question 7

A retailer requires BIG-IP to inspect decrypted HTTP request bodies while every client-facing and origin-facing network segment carries TLS. TLS termination on BIG-IP is authorized, the required certificates and keys are available, and the origin servers must continue to receive HTTPS. Select the connection layout that creates the required inspection point.

Accepted Answer

Terminate client TLS with Client SSL, inspect HTTP, and establish separate origin-side TLS using Server SSL.

Answer

Terminate client TLS with Client SSL, inspect HTTP, and use plaintext on the private origin network.

Answer

Preserve a single client-to-origin TLS session through a TCP virtual server and attach an HTTP inspection policy to that virtual server.

Answer

Attach Server SSL and an HTTP inspection policy while preserving the client's TLS session unchanged until it reaches the origin.

Question 8

An operator changes a service's HTTP health-check path after an orchestrator reads that service at ETag "r17". The cloud controller's API supports strong ETags and conditional PUT requests. The orchestrator then submits a backend addition using If-Match: "r17" and receives HTTP 412. The resource representation contains both the backend list and the health-check settings, and both changes are approved. How can the update preserve both changes?

Accepted Answer

Read the current resource, merge the backend addition, and submit it with the current ETag.

Answer

Resend the original representation without If-Match so that the approved backend addition can complete despite the concurrent update.

Answer

Retrieve the current ETag and attach it to the original representation, retaining its earlier health-check settings.

Answer

Retry the unchanged conditional request after a longer delay so that the health-check update has time to become consistent.

Question 9

Eight minutes after an order service moves to a cloud site, its error rate rises enough to trigger rollback. The cloud database is the sole writer and contains acknowledged orders absent from the on-premises database, which remains write-blocked. Stored orders are intact, and a reverse-replication procedure has been rehearsed. No acknowledged order may be lost. Which rollback sequence preserves that requirement?

Accepted Answer

Prevent further cloud writes, synchronize and validate the old database, then redirect writes.

Answer

Enable old-site writes and redirect requests, then copy back the cloud orders.

Answer

Reopen the old database for writes, synchronize both directions, then remove the cloud pool.

Answer

Restore the pre-cutover snapshot at the old site, then replay only transactions that clients retry.

Question 10

A read-only catalog is being extended into a public cloud. Each response requires eight sequential database calls that cannot overlap. Application and database processing, plus all other delays, total 50 ms per response at either database location; network round trips are additional. The on-premises database has a 40 ms round-trip time. An approved cloud read replica has a 2 ms round-trip time and stays no more than 5 seconds behind the primary. The service requires responses within 250 ms and permits data up to 30 seconds old. Capacity is sufficient at both locations. Which proposal can satisfy both requirements?

Accepted Answer

Use the cloud read replica, giving a 66 ms response time with at most 5 seconds of data lag.

Answer

Retain the primary database because the eight calls share one 40 ms round trip, giving a total response time of 90 ms.

Answer

Double the cloud web instances because distributing requests across twice as many instances halves each response time to 185 ms.

Answer

Keep the primary database and reduce other work to 10 ms for a 170 ms response.

Free F5-CSE Cloud Practice Questions

Domain 1: FOUNDATIONAL CLOUD CONCEPTS

Question 1

Question 2

Domain 2: CLOUD INFRASTRUCTURE DESIGN

Question 3

Question 4

Question 5

Domain 3: CLOUD MIGRATION

Question 6

Question 7

Domain 4: CLOUD DEPLOYMENT

Question 8

Domain 5: CLOUD ORCHESTRATION AND AUTOMATION

Question 9

Question 10

That's 10 of 1,030