100+ Free F5-CTP Practice Questions

Pass your F5 Certified! Technical Professional (F5-CTP) — Specialty Tracks exam on the first try — instant access, no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately

~55-65% Pass Rate

100+ Questions

100% Free

1 / 10

Question 1

Score: 0/0

Which F5 specialty exam focuses on BIG-IP LTM advanced topics and is commonly referred to as 301a?

302 DNS Specialist

301a LTM Specialist Architect, Set Up, and Deploy

303 ASM Specialist

304 APM Specialist

to track

2026 Statistics

Key Facts: F5-CTP Exam

~80

Questions per specialty exam

245/300

Passing Score (scaled)

F5 (~69%)

90 min

Exam Duration

$180

Per Specialty Exam

Pearson VUE

4 tracks

Specialty Options

LTM/DNS/ASM/APM

2 years

Certification Validity

F5-CTP requires F5-CA plus one specialty exam (301a/b, 302, 303, or 304). Each specialty exam has ~80 questions in 90 minutes. Passing score 245/300 scaled (~69%). Each specialty is ~$180 USD at Pearson VUE. Valid 2 years. Multiple CTP titles can be held concurrently (LTM+ASM, LTM+APM, etc.).

Sample F5-CTP Practice Questions

Try these sample questions to test your F5-CTP exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1Which F5 specialty exam focuses on BIG-IP LTM advanced topics and is commonly referred to as 301a?

A.302 DNS Specialist

B.301a LTM Specialist Architect, Set Up, and Deploy

C.303 ASM Specialist

D.304 APM Specialist

Explanation: Exam 301a LTM Specialist: Architect, Set Up, and Deploy focuses on designing and initially configuring LTM deployments. The companion exam 301b covers day-to-day maintenance and troubleshooting. Passing 301a OR 301b, together with F5-CA, earns the LTM Specialist CTP credential.

2Which LTM feature allows session stickiness based on a value stored in an iRule session table?

A.Universal Persistence

B.Source Address Affinity

C.SSL Session ID

D.Destination Address

Explanation: Universal persistence uses an arbitrary value (extracted by an iRule — often via the persist uie command) as the persistence key. This enables sticky sessions based on JSESSIONID, custom headers, API keys, or any application-level token.

3Which iRule command stores a universal persistence record?

A.persist uie <key>

B.HTTP::persist

C.pool::persist

D.session::add

Explanation: 'persist uie <key> <timeout>' tells BIG-IP to add a universal persistence record using the supplied key. On subsequent requests, BIG-IP reuses the stored pool member selection. This enables stickiness on things like application session tokens.

4Which advanced monitor is used to verify a directory bind on an LDAP server?

A.HTTP monitor

B.External (EAV) monitor with ldapsearch

C.ICMP monitor

D.FastL4 monitor

Explanation: LDAP monitoring typically uses an External (EAV) monitor running ldapsearch with a bind DN and password. BIG-IP also has a native LDAP monitor template in newer versions that performs a simple bind. EAV gives the most flexibility for custom searches.

5Which iRule event fires after the load balancing decision but before server-side connection establishment?

A.CLIENT_ACCEPTED

B.LB_SELECTED

C.SERVER_CONNECTED

D.HTTP_RESPONSE

Explanation: LB_SELECTED fires after BIG-IP has chosen a pool member but before the server-side connection is established. You can override the selection using 'LB::reselect' or 'pool' and 'member' iRule commands at this stage.

6Which iRule command rewrites the HTTP URI for the current request, routing to a different backend path?

A.HTTP::uri <new-uri>

B.HTTP::host <new-host>

C.HTTP::redirect

D.HTTP::header replace

Explanation: HTTP::uri with an argument rewrites the URI used when BIG-IP forwards the request to the backend pool member. The client sees nothing different, but the backend receives the new URI. This enables URL routing across different app versions or microservices.

7Which F5 DNS (formerly GTM) object represents a globally-resolvable FQDN mapped to multiple virtual servers across data centers?

A.Wide IP

B.Pool

C.Server

D.Listener

Explanation: A Wide IP is the FQDN clients resolve against F5 DNS. It maps to one or more pools of virtual servers across data centers. Load balancing methods at the Wide IP level include topology, round robin, global availability, and ratio.

8What does iQuery enable in F5 DNS?

A.DNS cache lookups

B.SSL inspection

C.Secure communication between BIG-IP devices to share health and performance data

D.IPv6 translation

Explanation: iQuery is F5's proprietary TLS-secured protocol used between BIG-IP DNS and BIG-IP LTM devices (or between DNS boxes) to exchange health, persistence, and performance metrics. It enables topology-aware global load balancing.

9Which F5 DNS feature signs zone data and responses using DNSSEC?

A.DNS Express

B.DNSSEC signing

C.DNS Cache

D.DNS Firewall

Explanation: BIG-IP DNS supports real-time DNSSEC signing of authoritative responses using configured keys (KSK/ZSK). This provides DNS response authenticity and integrity to resolvers that validate DNSSEC.

10What does DNS Express do?

A.Acts as a high-performance cache-less zone transfer slave for fast authoritative response

B.Resolves external DNS recursively

C.Blocks DNS queries

D.Encrypts all DNS traffic

Explanation: DNS Express pulls zone data from a master DNS server via AXFR/IXFR and serves it from BIG-IP's high-speed in-memory database. This provides very fast authoritative responses and DDoS resilience without forwarding each query to a BIND server.

About the F5-CTP Exam

F5 Certified! Technical Professional (F5-CTP) is F5's mid-tier credential earned by passing F5-CA plus one specialty exam — 301a/301b LTM Specialist, 302 DNS Specialist, 303 ASM/Advanced WAF Specialist, or 304 APM Specialist. It validates deep expertise in one or more application delivery specialties: advanced LTM (iRules, universal persistence, advanced monitors, OneConnect), F5 DNS/GTM (Wide IPs, iQuery, DNSSEC, DNS Express), ASM/Advanced WAF (policy building, bot defense, L7 DoS, API security), or APM (Visual Policy Editor, SAML, OAuth, KCD, SSL VPN).

Questions

80 scored questions

Time Limit

90 minutes

Passing Score

245/300 scaled (~69%) per specialty exam

Exam Fee

$180 per specialty exam (F5 / Pearson VUE)

F5-CTP Exam Content Outline

25%

Advanced LTM (301a/301b)

Universal persistence via iRule, advanced monitors (EAV, LDAP, SIP, Inband), OneConnect, HTTP/TCP profile tuning, multi-tier application delivery, iRules commands (HTTP::uri, HTTP::host, HTTP::redirect, pool, node, persist uie), rate shaping

20%

DNS / GTM (302)

Wide IPs, pools, servers, data centers, DNS listeners, iQuery, DNSSEC, DNS Express, DNS Cache (Transparent/Resolver/Validating), DNS Firewall, LB methods (Round Robin, Ratio, Global Availability, Topology, Completion Rate), Last Resort Pool, Sync Groups

20%

ASM / Advanced WAF (303)

Policy building (Rapid Deployment, Comprehensive, learning), attack signatures with staging, bot defense (PBD, CAPTCHA), L7 DoS profile (TPS-based, behavioral/stress-based), brute-force protection, session hijacking, API security (OpenAPI/Swagger), Data Guard, DataSafe, credential stuffing protection, behavioral analysis

20%

APM (304)

Access Policies via Visual Policy Editor (VPE), AD Auth, SAML IdP/SP, OAuth/OIDC, RADIUS, Kerberos Constrained Delegation (KCD), client cert inspection, Web SSO, Network Access (SSL VPN), Per-request policies, endpoint posture, webtops, MFA integration

15%

Automation Basics

iControl REST (token-based auth, X-F5-Auth-Token, endpoint structure), AS3 declarations (Tenant > Application > Services), Declarative Onboarding (DO), Telemetry Streaming (TS), iControl LX extensions, BIG-IQ centralized management

How to Pass the F5-CTP Exam

What You Need to Know

Passing score: 245/300 scaled (~69%) per specialty exam
Exam length: 80 questions
Time limit: 90 minutes
Exam fee: $180 per specialty exam

Keys to Passing

Complete 500+ practice questions
Score 80%+ consistently before scheduling
Focus on highest-weighted sections
Use our AI tutor for tough concepts

F5-CTP Study Tips from Top Performers

1Choose your specialty (301a/b, 302, 303, 304) based on career focus — each has different blueprints

2Build a BIG-IP VE lab with the relevant module provisioned (LTM, DNS, ASM, APM)

3For 301a/b: master universal persistence via iRule, OneConnect, advanced monitors, HTTP/TCP tuning

4For 302: know Wide IPs, iQuery, DNSSEC, DNS Express, and topology LB cold

5For 303: practice building ASM policies (Rapid Deployment, Comprehensive), work with signatures and bot defense

6For 304: build VPE policies with AD, SAML, OAuth, KCD, MFA — practice both per-session and per-request

7Study F5 DevCentral articles and the F5 University specialty exam prep guides extensively

Frequently Asked Questions

What is F5-CTP?

F5 Certified! Technical Professional (F5-CTP) is F5's mid-tier credential for application delivery specialists. It requires passing F5-CA (exams 101 + 201) plus at least one specialty exam — 301a/301b (LTM), 302 (DNS), 303 (ASM/Advanced WAF), or 304 (APM). Each specialty earns a specific CTP title (e.g., F5-CTP LTM).

Which specialty exam should I take first?

301a/301b (LTM) is the most common starting point since it builds directly on F5-CA fundamentals and supports all other modules. Choose 302 (DNS) if you work with F5 GTM/DNS. Choose 303 (ASM) for WAF/security focus. Choose 304 (APM) for identity/access/VPN focus. You can hold multiple CTP titles.

How much does F5-CTP cost in total?

Each exam is approximately $180 USD. A typical CTP path costs $180 × 3 (101 prerequisite + 201 CA + specialty exam) = ~$540. Adding additional specialty exams for multiple CTP titles costs another ~$180 each.

What is the passing score for CTP specialty exams?

Each specialty exam uses a scaled score of 245/300 (~69% raw) as the passing threshold. Each exam has approximately 80 questions in 90 minutes at Pearson VUE, onsite or online proctored.

How long is F5-CTP valid?

F5 certifications, including CTP, are valid for 2 years. Recertify by passing the current version of the specialty exam OR a higher-level F5 exam (CSE 401 or 402) before expiration to retain the credential.

What jobs can I get with F5-CTP?

F5-CTP targets senior application delivery roles: Senior Network Engineer, Application Delivery Engineer, WAF/Security Engineer (303 ASM), Identity/VPN Engineer (304 APM), DNS Architect (302), and Pre-Sales Systems Engineer. F5 partner companies often require CTP for technical account manager roles.