View all questions & answers for the BIG-IP Administration Data Plane Concepts (F5CAB2) exam
BIG-IP Administration Data Plane Concepts (F5CAB2)-Question 39 Discussion
Comments
Selected Answers: A
Selected Answers: A
A. Drop VS
A Drop virtual server silently drops traffic—no response is sent to the client.
This is often used to block traffic from a specific IP or subnet. ✅
B. Block VS
“Block” is not an actual BIG-IP virtual server type. ❌
C. Reject VS
A Reject virtual server sends a TCP RST or ICMP unreachable to the client.
This actively informs the client that traffic is blocked. ❌ (less stealthy than Drop)
D. Standard VS
A standard virtual server forwards traffic to a pool; it doesn’t block traffic. ❌
Step 2: Apply the requirement
Requirement: block responses for one IP → we want traffic silently dropped.
✅ That is exactly what a Drop virtual server does.
✅ Answer:
A. Drop
Selected Answers: C
- “Block” is not an actual BIG-IP virtual server type. ❌
- A standard virtual server forwards traffic to a pool; it doesn’t block traffic. ❌
- A Reject virtual server specifies that the BIG-IP system rejects any traffic destined for the virtual server IP address. ✅
Selected Answers: C
Precedence & Matching: In F5 BIG-IP, virtual servers are evaluated using longest-prefix matching (most specific subnet mask wins). To block a single IP within a broader subnet handled by another virtual server (e.g., 10.10.10.0/24), you create a /32 host virtual server configured as Reject. Because it is more specific, it takes precedence over the subnet virtual server and rejects all traffic destined for that single IP address.
Why others are incorrect:
Drop and Block are not valid virtual server types in the BIG-IP system configuration menu.
Standard virtual servers are used for standard application load balancing to a pool, rather than rejecting traffic.
What type of virtual server should be used to block responses for one IP in a subnet with a virtual server? (Choose one answer)
Brave-Dump Clients Votes