F5 Networks F5CAB5 Dumps - Pass BIG-IP Administration Support and Troubleshooting Exam in 2026

To successfully performSSL offload and re-encryptionon a BIG-IP system, the virtual server must be configured withboth a Client SSL profile and a Server SSL profile. The Client SSL profile enables BIG-IP to decrypt inbound HTTPS traffic from clients, while the Server SSL profile is required tore-encrypt traffic before forwarding it to the pool members.

From the exhibit, the virtual server has aClient SSL profile configured, which allows BIG-IP to accept HTTPS connections from clients. However, there isno Server SSL profile attached, meaning BIG-IP attempts to sendunencrypted HTTP trafficto pool members listening on HTTPS (port 443). This protocol mismatch causes the server-side SSL handshake to fail, resulting in users being unable to connect to the application.

This behavior is well documented in BIG-IP SSL troubleshooting guides: when backend servers expect HTTPS, a Server SSL profile is mandatory to establish a secure connection from BIG-IP to the pool members.

The other options are incorrect:

Removing the Client SSL profile (Option A) would break client-side HTTPS.

The server-side TCP profile (Option B) is unrelated to SSL encryption.

Forward Proxy (Option C) is only used for outbound SSL inspection scenarios.

Therefore, configuring anSSL Profile (Server)is the correct and required solution.

When analyzing HTTPS traffic using tools like tcpdump without access to the SSL private keys for decryption, only the Layer 2 through Layer 4 information remains visible.

Visible Information: You can see the Source and Destination IP addresses, TCP ports, and the TLS handshake headers (such as the Server Name Indication/SNI in the Client Hello).

Encrypted Information: Once the encrypted tunnel is established, all Layer 7 data is masked. This includes HTTP Request/Response Headers (Option A and D) and Cookies (Option C).

Troubleshooting Note: To see the headers or cookies, an administrator must either perform the packet capture on the 'server-side' of the BIG-IP (if it is performing SSL Offload) or use a tool like Wireshark with the appropriate SSL keys loaded.

The pool member is markedDOWNbecause it is monitored bymultiple health monitors, specifically anHTTPmonitor and anHTTP/2monitor. The status message clearly shows that theHTTP monitor is UP, while theHTTP/2 monitor is DOWN. In BIG-IP, when multiple monitors are assigned to a pool member, the default behavior isAND logic, meaningall assigned monitors must succeedfor the pool member to be considered healthy.

In this scenario, the server is responding successfully to standard HTTP (likely HTTP/1.1) requests but does not support or respond correctly to HTTP/2 requests. As a result, the HTTP/2 monitor fails, which causes the overall monitor status to beDOWN, even though HTTP traffic itself is working.

This behavior is expected and documented in BIG-IP monitoring logic. Unless the monitor rule is explicitly changed to''at least one of'', a single failing monitor will mark the pool member down. Therefore, the correct conclusion is that the pool member isonly serving HTTP traffic, not HTTP/2.

The resolution would be to either remove the HTTP/2 monitor, correct the application to support HTTP/2, or adjust the monitor rule to match the intended health-check logic.

To gather granular Layer 7 data such as specific HTTP methods (GET, POST, etc.) and HTTP status codes (200, 404, 500), the BIG-IP system utilizes the Analytics (AVR) profile.

Analytics Profile (Application Visibility and Reporting): While a standard HTTP profile tracks basic byte counts and requests, the Analytics profile is designed specifically to capture, analyze, and display detailed application performance metrics.

Metrics Captured: When attached to a virtual server, it records URL-level statistics, response codes, page load times, and client-side metrics.

Why not others? * HTTP Profile (Option A): This profile handles the parsing of HTTP traffic but does not provide a built-in reporting dashboard for status code distribution.

Statistics Profile (Option C): This is a legacy profile used for custom user-defined counters and does not automatically categorize HTTP methods or status codes.

Request Adapt (Option D): This is used for integrating with ICAP servers (like virus scanners) and does not perform traffic reporting.

When a BIG-IP system experiences high overall CPU usage, troubleshooting requires identifying which specific application or service is the primary consumer of resources. While the system-wide performance graphs provide a global view, the granular data necessary to isolate a 'top talker' is found in the 'Local Traffic' statistics. Navigating to Statistics > Module Statistics > Local Traffic > Virtual Servers allows the administrator to see specific metrics for each configured virtual server, including the number of packets processed, current connections, and critical CPU cycles consumed. This is essential for troubleshooting performance issues where an inefficient iRule, high SSL handshake volume, or complex L7 profiles (like Compression or ASM) might be overtaxing the Traffic Management Microkernel (TMM) for one specific application. By reviewing these basic stats, an administrator can determine if a performance bottle-neck is a system-wide h1ardware issue or if it is isolated to a single virtual server, enabling targeted remediation such as optimizing iRule logic or moving the high-load virtual server to a dedicated device.