F5 Certification in 2026: BIG-IP Administrator Modular Exams, LTM, DNS, ASM, APM, Security, Cloud, NGINX, and Renewal

F5’s certification program is in a significant transition in 2026. The current exam catalogue includes a new modular BIG-IP Administrator path with exams F5CAB1 through F5CAB5, while several established Technology Specialist and Solution Expert exams remain available, including BIG-IP LTM 301a and 301b, BIG-IP DNS 302, BIG-IP ASM 303, BIG-IP APM 304, Security Solutions 401, and Cloud Solutions 402. F5 also supports NGINX certification tracks. Candidates therefore need to check eligibility and version carefully rather than relying on an older diagram built around 101 and 201.

The largest current change is administration. F5 now lists five modular BIG-IP Administration exams covering installation and initial configuration, data-plane concepts, data-plane configuration, control-plane administration, and support/troubleshooting. The classic 201 TMOS Administration exam is now limited to candidates who had already passed 101 before May 1, 2025 and whose eligibility remains valid. New candidates should plan around the modular path.

F5CAB1 starts with installation, initial configuration, and upgrade

The F5CAB1 exam maps directly to the current BIG-IP Administration modular track. The first module validates the ability to install or initialise BIG-IP, perform baseline configuration, and understand upgrade-related tasks.

Administrators should know management networking, licensing, provisioning, device setup, software images, backup concepts, and the dependencies required before traffic services can be configured.

Upgrade preparation should include compatibility, backup, change windows, validation, and rollback. A successful software installation is not enough if virtual servers or application traffic fail afterward.

The data plane is the heart of application delivery

The current F5 Administrator path includes a data-plane concepts module and a data-plane configuration module. F5CAB3 covers the configuration portion, while F5CAB2 represents the current concepts module. Candidates should use F5's current blueprint to keep the two modules and their versions distinct.

The conceptual foundation is load balancing. A virtual server receives traffic, pools group backend members, health monitors determine availability, persistence can influence server selection, profiles control protocol behaviour, and traffic policies or iRules can alter processing.

Candidates should be able to trace one connection from client to virtual server to pool member and back, including SNAT, routing, and profile behaviour.

F5CAB4 covers control-plane administration

The F5CAB4 exam focuses on control-plane administration. F5’s current exam description positions it within day-to-day deployment, management, security, and support of BIG-IP after implementation.

Control-plane competence includes user administration, device settings, high availability, configuration synchronisation, certificates, licensing, system services, and the operational mechanisms that keep the platform manageable.

High availability should be learned as a failure process. Candidates should know what state changes when one device fails, which configuration must be synchronised, how floating addresses behave, and what evidence confirms traffic moved successfully.

F5CAB5 validates support and troubleshooting

The current F5CAB5 exam represents the support and troubleshooting module. This is where candidates need a disciplined method rather than feature memorisation.

Start with the expected traffic path, then verify DNS, client connectivity, routing, virtual-server match, pool and member state, health monitors, profiles, SNAT, persistence, SSL, and application response. Packet capture and logs should be used to prove where the flow breaks.

Troubleshooting is strongest when the candidate changes one hypothesis at a time and preserves evidence before modifying configuration.

F5CABR provides a renewal route

F5CABR belongs to the current BIG-IP Administrator renewal framework. F5 certifications have renewal requirements, so professionals should understand maintenance before waiting until expiration.

Renewal exists because BIG-IP software, security practices, protocols, and the certification programme itself change. A professional who originally certified under a previous administration model may need updated evidence to show that skills remain current.

Candidates should use the live F5 Education Services portal to confirm eligibility and renewal options because the transition from older exam structures is still active.

LTM specialist certification remains an advanced traffic-management path

F5’s current catalogue still lists BIG-IP LTM Specialist exams 301a and 301b. In 2026, F5 also ran a redesigned modular LTM Specialist beta series covering base networking, virtual servers and traffic objects, iRules and analytics, upgrades and HA, packet troubleshooting, and TLS/SSL troubleshooting.

That beta period closed in July 2026, so candidates in late September should check the current catalog for the production release before assuming the beta codes are bookable.

LTM-level work requires deeper application-delivery understanding than Administrator: traffic processing order, profiles, persistence, iRules, high availability, performance, and complex troubleshooting.

DNS Specialist requires both F5 and DNS fundamentals

BIG-IP DNS Specialist is built on ordinary DNS behaviour. Candidates should understand authoritative servers, delegation, recursion, records, caching, TTL, health, and global server load balancing before studying F5-specific objects.

The explanations of DNS caching, DNS TTL, and authoritative DNS servers are useful because BIG-IP DNS decisions still operate inside the DNS protocol.

Global traffic management should be tied to service health and policy. A DNS answer is part of application delivery, not merely a static name-to-address mapping.

ASM and security paths protect the application layer

BIG-IP ASM Specialist and the broader Security Solutions track focus on web-application protection and F5 security architecture. Candidates need to understand HTTP, application attacks, policy tuning, false positives, logging, bot or threat controls, and the relationship between WAF enforcement and application behaviour.

TLS is another key layer. The difference between SSL and TLS and the operational realities of certificate chains, cipher configuration, termination, re-encryption, and inspection matter across LTM, APM, and security work.

A WAF should be tuned from evidence. Blocking every anomaly without understanding the application can create an availability problem rather than a security improvement.

APM Specialist is identity-aware access and policy

BIG-IP APM Specialist focuses on access policy, authentication, federation, remote access, application access, and identity-aware control. APM engineers need to understand the user journey through authentication, endpoint checks, policy branches, session creation, and application access.

Modern access designs increasingly align with zero-trust principles: verify identity, evaluate context, reduce broad network exposure, and grant only the application access the user needs.

Troubleshooting should follow the policy event-by-event. Generic “login failed” symptoms can originate in identity providers, certificates, group lookup, policy logic, network reachability, or the protected application.

F5 also certifies cloud and NGINX skills

The F5 catalogue includes Cloud Solutions and NGINX certification paths, reflecting the company’s expansion beyond classic BIG-IP appliances. Application delivery now spans data centres, public clouds, Kubernetes, APIs, ingress, reverse proxies, service architectures, and distributed security controls.

Professionals should choose the track that matches the platform they operate. A BIG-IP specialist does not automatically demonstrate NGINX administration, and a cloud solution architect needs additional understanding of provider networking, automation, identity, and distributed application architecture.

The common theme is application traffic: availability, performance, routing, security, identity, and observability from client to service.

Use the current F5 exam catalogue rather than an old certification map

F5’s 2026 transition means old preparation diagrams can be misleading. The new BIG-IP Administrator modular exams are active, 201 is restricted to eligible legacy candidates, established specialist exams remain listed, and newer LTM specialist modules have been through beta.

Current F5 material here covers F5CAB1, F5CAB3, F5CAB4, F5CAB5, and F5CABR, while F5CAB2 is also part of the current certification sequence. Candidates should follow the live F5 exam catalogue for the complete active set and should not infer exam status from the availability of a particular study page.

Certification planning should start in the current Education Services portal, then use hands-on BIG-IP or NGINX labs to develop the operational skill the exam is meant to validate.

Health monitors need to reflect actual application readiness

A pool member can answer TCP connections while the application behind it is broken. F5 health monitors should therefore test enough of the application path to distinguish real readiness from basic reachability without becoming unnecessarily expensive or fragile.

Candidates should understand monitor intervals, timeouts, send and receive strings, inheritance, and how monitor failure changes pool-member state. A poorly designed monitor can either send traffic to a broken service or remove healthy capacity.

Testing should include an application that returns the wrong content while still listening on the expected port.

F5 LTM can make sophisticated traffic decisions with policies and iRules. That power should be used when standard objects cannot express a requirement cleanly, not as the default solution for every change.

Custom logic needs version control, comments, testing, performance awareness, and ownership. An iRule that silently rewrites headers or routes traffic can become a critical application dependency.

Specialist candidates should be able to read existing logic, explain the event that triggers it, and predict what happens when several rules or profiles interact.

BIG-IP commonly terminates or re-encrypts TLS, which means certificate expiry can become an application outage. Administrators should track certificate ownership, renewal, private-key protection, chain completeness, supported protocols, and cipher policy.

The basics of SSL/TLS certificates matter because a valid certificate depends on trust, names, dates, signature chains, and secure handling of the private key.

A mature environment alerts well before expiry and has a tested process for replacing certificates without breaking application traffic. Teams should also rehearse emergency replacement so an unexpected compromise or key problem does not turn routine certificate work into an application outage.