F5 F5-304 Practice Test

F5-304 practice test: what's covered

• APM Architecture
• Visual Policy Editor
• Authentication & SSO
• Network, Portal & App Tunnels
• Endpoint Checks
• Session Troubleshooting

Free F5-304 sample questions

1. An engineer attaches an access profile to a virtual server and users are prompted for credentials, but no access policy has been configured. What behaviour should be expected?

   • A. Users are granted full access because no restrictions have been defined
   • B. The virtual server rejects the configuration and refuses to accept traffic
   • C. The access profile automatically creates an Active Directory authentication agent
   • D. The policy ends at the default deny terminal so users are refused access
   Show answer

   Correct: D. A newly created access policy runs from start straight to the deny ending, so users are refused until the administrator builds a path to an allow terminal. It does not fail open, the virtual server accepts the configuration normally, and no authentication agent is created automatically.

2. An engineer must publish an internal web application to remote users without giving them network level access to the subnet. Which APM deployment mode fits?

   • A. Application tunnel, which opens a local listener for a thick client application
   • B. Transparent forward proxy, which inspects outbound client traffic to the internet
   • C. Portal access, which proxies and rewrites the application through the browser
   • D. Network access, which assigns the client an IP address on the corporate network
   Show answer

   Correct: C. Portal access renders the internal application through the browser with content rewriting, so the client never receives network reachability to the subnet. Network access is a full VPN by design, application tunnels serve thick clients on specific ports, and forward proxy handles outbound rather than inbound application publishing.

3. An engineer is choosing the access profile type for a new deployment. Select the TWO statements that correctly describe profile type selection. (Choose TWO)

   • A. The LTM-APM type is required before any authentication agent can be used
   • B. The profile type determines which DNS listener the system will use
   • C. The all profile type supports the full range of access methods including network access
   • D. The SWG explicit type is used when the system acts as an explicit forward proxy
   • E. The profile type can be changed freely after the profile has been created
   Show answer

   Correct: C and D. Profile type constrains which access methods and agents are available, so the all type is chosen for full remote access while the explicit forward proxy type is chosen for secure web gateway deployments. The type is fixed at creation, authentication agents are not gated on the LTM-APM type, and DNS listeners are unrelated to access profiles.

4. A customer reports that users are unexpectedly logged out after exactly four hours regardless of activity. Which access profile timer is responsible?

   • A. The maximum session timeout, which ends the session regardless of user activity
   • B. The inactivity timeout, which ends the session only after a period of idleness
   • C. The access policy timeout, which limits how long policy evaluation may take
   • D. The TCP idle timeout configured on the virtual server profile
   Show answer

   Correct: A. A fixed logout at a consistent interval regardless of activity is the signature of the maximum session timeout. The inactivity timeout would only trigger after idleness, the policy timeout governs how long a user may take to complete the policy, and TCP idle timeouts affect individual connections rather than the access session.

5. An engineer must support 6,000 concurrent remote access users on a BIG-IP platform. Which licensing element governs whether that is possible?

   • A. The number of virtual servers configured with an access profile attached
   • B. The number of access policies created within the administrative partition
   • C. The size of the certificate used to secure the access virtual server
   • D. The APM concurrent user or access session licence limit provisioned on the system
   Show answer

   Correct: D. Concurrent access sessions are the licensed unit, so the provisioned limit determines whether 6,000 users can connect simultaneously. Counts of virtual servers and policies are configuration objects rather than licensed capacity, and certificate key size affects cryptographic strength rather than session scale.

Last updated: 2026-09-23

F5-304 practice test FAQ

Related practice tests

• F5 F5101 practice test
• F5 F5201 practice test
• F5 F5301 practice test
• F5 F5-302 practice test
• F5 F5-303 practice test