F5 Networks BIG-IP Administration Support and Troubleshooting (F5CAB5)

✅ Option C (Correct)

Reasoning: The log messages state "X Connections killed", directly indicating the BIG-IP system is actively terminating some existing connections as part of its aggressive memory reclamation strategy.

✅ Option D (Correct)

Reasoning: The messages "Aggressive mode /Common/default-eviction-policy activated" and "(global memory)" signify that the TMM (Traffic Management Microkernel) is experiencing memory exhaustion, triggering the global eviction policy to free up resources.

❌ Why the other choices are incorrect:

• Option A is incorrect: The logs specifically mention "global memory", referring to TMM's internal memory, not swap memory. While related to memory pressure, swap isn't the direct trigger indicated here.
• Option B is incorrect: While connections are killed, the logs show specific small numbers (1, 2) of connections killed, not "all". Aggressive mode selectively reaps connections to alleviate pressure, not necessarily all of them.

The exhibit shows the pool member status as "Availability: Offline (Enabled) - Parent down" and the "Parent Node" (172.16.20.6) marked with a red diamond. This status explicitly indicates that the BIG-IP system considers the underlying server node as unreachable or non-responsive at a fundamental level, preventing it from processing traffic or health checks. Therefore, the BIG-IP cannot reach the pool member.

✅ Option A (Correct)

❌ Why the other choices are incorrect:

• Option B is incorrect: Automap (SNAT) translates the client's source IP to a self-IP on the BIG-IP for server-side connections. It happens after the load balancing decision and does not inherently cause uneven load distribution.
• Option C is incorrect: The pool members' ratio settings (1, 2, 3) are only active if a Ratio-based load balancing method (e.g., Ratio (member)) is selected. Since Round Robin is configured, these ratio settings are ignored.
• Option D is incorrect: Round Robin is a Layer 4 load balancing method that operates on TCP connections. It does not require an HTTP profile to function efficiently; a TCP profile is sufficient for its operation.

✅ Option D (Correct)
Reasoning: The EUD results are logged to /shared/log/eud.log after an execution. Collecting this file provides the required output to F5 Support without interrupting live traffic, thus minimizing impact.
❌ Why the other choices are incorrect:

• Option A is incorrect: Booting the device into EUD requires a reboot, which would cause an outage and disrupt business-critical traffic.
• Option B is incorrect: Executing EUD from tmsh typically involves a diagnostic boot or maintenance window, causing service interruption. Running it on a live system can severely impact performance or cause an outage.
• Option C is incorrect: The /var/log/messages file contains general system logs, but not the detailed, specific output of an EUD test.

To open an F5 Support ticket, the fundamental administrative information required includes the device's serial number for product identification, a clear problem description summarizing the issue, and accurate contact information so F5 Support can communicate. These details are typically mandatory fields for initial case submission.

Options A, B, and C include items like a qkview, UCS file, license file, or packet capture. While a qkview is crucial diagnostic data and highly recommended for efficient troubleshooting, and often requested immediately after opening the case, it is generally considered supplementary information rather than a strictly mandatory field required to initially open the support ticket itself.

✅ Option A (Correct)
Reasoning: The F5 BIG-IP system defines a node as a logical object representing a server's IP address. The network map shows three distinct IP addresses acting as nodes: 2.2.2.2, 192.168.42.1, and 2.2.2.3. While 2.2.2.2 is used by two pool members with different ports, it still corresponds to a single underlying node object.

❌ Why the other choices are incorrect:

• Option B is incorrect: Counting four would imply counting pool members (IP:Port pairs) as nodes, which contradicts the F5 definition where a node is solely the IP address.
• Option C is incorrect: Two distinct nodes are insufficient, as there are three unique IP addresses presented.
• Option D is incorrect: One distinct node is incorrect, as multiple unique IP addresses are present.