402 Cloud Solutions (402 - Cloud Solution Expert) Practice Questions
Prepare for 402 with more than an answer.
- Exam fee
- $180 USD
- Level
- Expert (F5 Certified Solution Expert)
- Valid for
- See F5 recertification policy (F5-CSE credentials follow F5 Certified program validity)
Domains covered on the exam 5
- FOUNDATIONAL CLOUD CONCEPTS14%
- CLOUD INFRASTRUCTURE DESIGN31%
- CLOUD MIGRATION17%
- CLOUD DEPLOYMENT7%
- CLOUD ORCHESTRATION AND AUTOMATION31%
- 1
A solutions architect is designing a multi-tier application delivery architecture in a green-field cloud data center. The requirements mandate that Layer 4 transport load balancing (TCP/UDP) scales independently from Layer 7 Web Application Firewall (WAF) inspections. Which architecture provides the most efficient scaling and resource isolation for this scenario?
Show answer details
Correct answer: B
A multi-tier architecture separates networking functions by layer. By using a highly scalable Layer 4 load balancer (like AWS NLB or Azure Standard LB) as Tier 1, it can distribute traffic to a dynamically scaling Tier 2 composed of computationally heavy BIG-IP Advanced WAF instances. This meets the requirement for independent scaling and resource isolation.
flowchart TD Client --> NLB[Tier 1: Cloud Native L4 LB] NLB --> WAF1[Tier 2: BIG-IP WAF VE 1] NLB --> WAF2[Tier 2: BIG-IP WAF VE 2] WAF1 --> App[Application Servers] WAF2 --> App - 2
When comparing F5 virtualization permutations for a hybrid cloud deployment, a network engineer notices a specific technology is available on-premises but CANNOT be deployed in public clouds like AWS or Azure. Which F5 virtualization technology is strictly limited to purpose-built F5 hardware?
Show answer details
Correct answer: A
vCMP is a hypervisor technology custom-built by F5 that allows multiple independent BIG-IP instances (guests) to run on a single F5 hardware platform (VIPRION or iSeries). Because it requires F5's proprietary hardware layer, it cannot be run inside public cloud environments (which rely on their own hypervisors like KVM or Hyper-V).
- 3
A Managed Service Provider (MSP) is designing a green-field cloud data center to offer Load Balancing as a Service (LBaaS) to hundreds of distinct tenants. They must ensure overlapping IP address spaces between tenants are strictly isolated while sharing the same underlying BIG-IP VE instances to optimize compute costs. Which BIG-IP feature must be integrated into their design?
Show answer details
Correct answer: B
Route Domains provide network-level isolation on the BIG-IP system, allowing the same IP address (e.g., 10.0.0.1) to be used in multiple distinct routing tables. This is critical for MSPs offering multi-tenant services where different customers might bring overlapping RFC 1918 IP spaces. Administrative partitions provide logical separation for configuration, but Route Domains provide the necessary network separation.
- 4
When implementing F5 Cloud Failover Extension (CFE) for BIG-IP High Availability in AWS, the CFE uses the cloud provider's API to remap traffic during a failover event. Which TWO AWS networking constructs can CFE manipulate to successfully redirect inbound and outbound traffic to the newly active BIG-IP instance? (Select TWO)
Show answer details
Correct answer: A, C
F5 Cloud Failover Extension (CFE) updates AWS VPC Route Tables to point outbound or inter-subnet routing targets to the Elastic Network Interface (ENI) of the newly active BIG-IP.
CFE uses AWS APIs to disassociate Elastic IPs (EIPs) from the failed unit's interface and reassociate them with the active unit's interface, allowing inbound internet traffic to failover seamlessly.
- 5
AeroLogistics is adopting a hybrid cloud model to scale their seasonal workloads. They are transitioning from owning all physical infrastructure to a model where the cloud provider manages the underlying hypervisor, storage, and networking, but AeroLogistics retains full control over the operating systems, BIG-IP Virtual Editions, and application stacks. Which cloud service model does this represent?
Show answer details
Correct answer: B
Infrastructure as a Service (IaaS) is a cloud computing model where the provider manages the physical infrastructure (servers, network, storage, hypervisor), while the consumer controls the operating systems, virtual appliances (like BIG-IP VE), and deployed applications. PaaS abstracts the OS layer, and SaaS abstracts everything up to the application software.
- 6
A security architect at FinTech Nexus is implementing cloud Identity and Access Management (IAM) for their BIG-IP administrators. They want to use Azure Active Directory (Azure AD) as the central identity provider. When an administrator attempts to log into the BIG-IP Configuration utility, they should be redirected to Azure AD for authentication, and upon success, granted role-based access on the BIG-IP. Which standard protocol should the BIG-IP APM be configured to use as a Service Provider (SP) in this scenario?
Show answer details
Correct answer: C
SAML 2.0 is the standard federation protocol used for web-based Single Sign-On (SSO) where the BIG-IP acts as the Service Provider (SP) and Azure AD acts as the Identity Provider (IdP). While LDAP and RADIUS can be used for authentication, they do not facilitate the standard browser-based redirection federation flow required by modern cloud IAM integrations like Azure AD SSO.
