F5 Certifications in 2026: BIG-IP Administration, Specialists, Security, Cloud and NGINX

F5’s certification program in 2026 is more modular than the older administrator path many engineers remember. The current F5 Certified Administrator, BIG-IP route is built from five focused exams—F5CAB1 through F5CAB5—covering installation and initial configuration, data-plane concepts, data-plane configuration, control-plane administration, and support and troubleshooting. F5 also maintains specialist and solution-level credentials for BIG-IP technologies, plus a separate four-exam administrator route for NGINX.

This structure makes path planning easier if candidates begin with the traffic and systems they operate. BIG-IP administrators need to understand how application traffic enters, is processed and reaches a pool member. Specialists deepen that knowledge in LTM, DNS, ASM or APM. NGINX administrators work with a different platform and exam sequence. The certifications are related by application-delivery concepts, but they are not interchangeable.

BIG-IP administration is now divided into five focused exams

The modular administrator route allows candidates to study one operational domain at a time. F5CAB1 covers installation, initial configuration and upgrade work; F5CAB2 focuses on data-plane concepts; F5CAB3 validates data-plane configuration; F5CAB4 addresses control-plane administration; and F5CAB5 concentrates on support and troubleshooting. Candidates should still connect those modules into one operating model rather than treating them as five unrelated mini-exams.

Build a small BIG-IP lab around a complete request path. Configure the network pieces, a virtual server, pool, pool members, monitor and relevant profiles. Send traffic, confirm the expected behavior, then change one element and observe the result. If a pool member is marked down, explain whether the cause is the monitor, reachability, service state or configuration. If the request reaches BIG-IP but not the application, identify where the data-plane decision changes. This turns exam objectives into observable behavior.

Upgrade and initial-configuration topics deserve practical attention too. Candidates should understand what information must be backed up, how configuration state is preserved, what dependencies can change during an upgrade and how to verify service after maintenance. A successful upgrade is not merely a software version change; it is a controlled operational event with a test and rollback plan.

Application delivery requires traffic-flow reasoning

F5 work becomes much easier when every configuration object is placed in the request flow. DNS resolves a name, a client reaches a virtual address, BIG-IP applies profiles and policy, selects a pool and member, and then handles the return path. Understanding load balancers, DNS and CDNs provides the right conceptual foundation because it explains how application traffic reaches services without tying the discussion to an unrelated AWS practice test.

Candidates should practice drawing that flow from memory and annotating where persistence, SSL handling, health monitoring, routing, NAT or policy changes behavior. When troubleshooting, compare the expected and observed path. This prevents the common mistake of changing a pool, profile or route simply because it is familiar. The correct object to inspect depends on where the evidence first diverges from the expected flow.

Specialist credentials deepen product-specific architecture

F5 continues to list specialist exams for BIG-IP LTM, DNS, ASM and APM, with higher-level Security and Cloud solution exams. These paths assume that the candidate can already reason about application delivery. An LTM specialist needs deeper understanding of traffic management and resilience; DNS specialists need global name-resolution and availability concepts; security-focused credentials add application protection and access decisions.

Encrypted traffic is an important example of cross-domain reasoning. Security controls may need visibility into TLS-protected sessions, but decryption creates performance, privacy and key-management considerations. A closer look at SSL decryption provides useful context for those tradeoffs. Candidates should be able to explain when decryption is technically possible, where it occurs and what operational or governance risks the design introduces.

NGINX follows a separate four-exam administrator route

F5 Certified Administrator, NGINX validates day-to-day administration of NGINX as a web and proxy server. The current route requires NGINX Management (F5N1), Configuration: Knowledge (F5N2), Configuration: Demonstrate (F5N3) and Troubleshoot (F5N4). The sequence reflects a practical progression: understand platform management, know the configuration model, demonstrate configuration skill and diagnose failures.

A useful NGINX lab includes reverse proxying, upstream servers, TLS, logs and at least one failure scenario. Change an upstream address, introduce an invalid or logically wrong directive, or make one backend unhealthy. Verify what the user sees, what the logs show and how the configuration should be corrected. Candidates should also be comfortable with the Linux environment around NGINX because day-to-day administration rarely occurs in isolation from the operating system.

The NGINX route has its own recertification exam, so candidates should not assume that BIG-IP renewal procedures apply automatically. Keep certification status and exam eligibility separate for each credential family, especially if a role spans both BIG-IP and NGINX.

Recertification should be treated as an operational refresh

F5 offers recertification routes for established credentials, including the BIG-IP administrator recertification exam. Experienced engineers should use renewal as an opportunity to identify skills that became stale because their production environment uses only a subset of BIG-IP capabilities. A person who spends two years on one stable LTM design may be very competent operationally while becoming rusty on installation, upgrade or less frequently used control-plane tasks.

Before renewal, compare the current blueprint with the work performed since the original certification. Build labs specifically around areas with little recent exposure. That produces a more useful refresh than repeating the strongest topics simply because they are comfortable.

Use blueprints as a lab checklist, not a reading list

F5 publishes exam information and blueprints, but effective preparation converts every objective into a working configuration or troubleshooting exercise. For each topic, decide whether the candidate should be able to explain, configure, verify or diagnose it. Then create evidence: command output, traffic behavior, logs or configuration state. If the task fails, record the reason and the recovery step.

The goal across F5 certifications is consistent even when the product changes: understand how application traffic is processed and how configuration choices affect availability, security and performance. Candidates who can trace a request, predict the impact of a change and isolate a fault are much better prepared than those who memorize object definitions. The modular 2026 exam structure makes that operational approach even more important because each focused exam still belongs to one end-to-end application-delivery system.

Health monitoring deserves deeper practice because it directly affects application availability. Configure monitors that test different layers and observe how pool-member state changes. A TCP connection may succeed while the application itself returns an error, so the chosen monitor should reflect the service outcome that matters. Candidates should understand how aggressive intervals can create noise and how weak monitors can leave broken members marked available.

Persistence and state are another source of subtle failures. When an application requires a client to remain on the same backend, candidates should understand why persistence is needed, what key identifies the session and what happens when a member fails. Test the behavior rather than relying on configuration alone. A design that appears correct in the GUI can still create uneven distribution or unexpected failover behavior under real traffic.

Logging and packet-level evidence should be part of troubleshooting. When a request fails, capture enough information to determine whether the problem occurs before BIG-IP, on BIG-IP or after traffic leaves it. Compare client-side and server-side connections, inspect relevant logs and verify name resolution and routing. This disciplined sequence is faster than changing profiles or pool settings without evidence.

For cloud and security candidates, repeat the same traffic-flow method across changing deployment models. The control plane may be delivered differently, but users still need DNS, secure transport, policy, application reachability and observability. Certification knowledge becomes more durable when product objects are understood as mechanisms in that broader flow rather than as isolated vocabulary.

Configuration review should include security boundaries. Administrative access, management interfaces, certificates, keys and high-privilege accounts deserve the same attention as traffic objects. Practice identifying which interfaces should be reachable from which networks and how credentials are protected. A device that balances traffic correctly but exposes its control plane unnecessarily is not a sound deployment.

High availability should be tested as behavior, not assumed from configuration. Build or study a failover pair, establish which objects and state are synchronized, then trigger a controlled failure and verify client impact. Check what happens to persistence, connections and management access. Understanding the difference between configuration synchronization and live traffic state makes HA troubleshooting much more precise.

Finally, make a habit of reading packet and log evidence before editing the configuration. A reset, timeout and application error point to different stages of the request path. The more quickly a candidate can place the symptom in that path, the fewer objects need to be inspected. This is the common skill that ties together administrator, specialist, security and cloud-oriented F5 work.

Performance testing should be tied to a baseline. Record normal connection rates, response times and resource use before tuning profiles or persistence behavior, then change one variable and measure again. Without a baseline, a configuration can appear faster or safer simply because the workload changed. Certification labs are more useful when candidates learn to prove the effect of a change instead of relying on intuition.