F5 F5CAB1 Online Practice Questions and Exam Preparation

F5 F5CAB1 Online Questions & Answers

• Question 1:

  Which configuration file can a BIG-IP administrator use to verify the provisioned modules ?

  A. /config/bigip.license
  B. /config/bigip_base.conf
  C. /config/bigip.conf
  D. /var/local/ucs/config.ucs
  C. /config/bigip.conf

  ---

  Provisioning settings define which modules are enabled and how system resources are allocated to them.

  These provisioning declarations are stored in:

  /config/bigip.conf

  This file contains:

  Full module provisioning statements

  TMSH-equivalent provisioning configurations such as:

  sys provision ltm { level nominal }

  sys provision asm { level nominal }

  It is the primary system configuration file that stores all active provisioning details.

  Why the other answers are incorrect

  A. /config/bigip.license

  Shows licensed modules, not provisioned modules.

  B. /config/bigip_base.conf

  Stores base networking (VLANs, Self-IPs, routes), not provisioning.

  D. config.ucs

  A backup archive, not a live configuration file.

  Thus, the correct file to review active module provisioning is /config/bigip.conf .

• Question 2:

  A BIG-IP Administrator has just completed the initial setup of a new BIG-IP system using the Configuration Utility. The administrator wants to verify which boot volume is currently active without rebooting the device. Which tmsh command should be used?

  A. tmsh list sys software update
  B. tmsh show sys software status
  C. tmsh list sys software volume
  D. tmsh show sys version
  B. tmsh show sys software status

  ---

  BIG-IP systems can have multiple boot volumes installed, and administrators must often verify which volume is currently active.

  The command:

  tmsh show sys software status displays detailed information about all installed volumes, including:

  1.

  Software version

  2.

  Installation status

  3.

  Whether the volume is active

  This command is the authoritative method for confirming the active boot location. The other commands either show configuration data, update settings, or general version information but do not clearly identify the active volume.

• Question 3:

  Which one of the following is a port and protocol combination allowed by the Allow Default setting for Port Lockdown?

  A. TCP 80
  B. UDP 8443
  C. TCP 443
  C. TCP 443

  ---

  Port Lockdown controls which ports and protocols a Self IP will respond to. The Allow Default setting permits only a predefined set of BIG-IP internal and required service ports.

  The Allow Default list includes :

  TCP 443# HTTPS (Management/TMUI access via Self-IP)

  TCP 4353 # CMI (device sync)

  TCP/UDP ports related to HA communication

  Other essential internal F5 ports

  Why TCP 443 is correct:

  It is one of the officially allowed ports under Allow Default .

  It enables HTTPS/TMUI access through a Self IP.

  Why the other options are incorrect:

  A. TCP 80 (HTTP) Not allowed under Allow Default HTTP via Self-IP is blocked unless placed under Allow Custom

  B. UDP 8443 Not an F5 default service Not part of the Allow Default ports

• Question 4:

  For security reasons, a BIG-IP Administrator needs to specify allowable IP ranges for access to the Configuration Utility (WebUI). The exhibit shows the User Administration section of the Configuration Utility.

  

  The administrator could not find any setting that explicitly restricts access to the Configuration Utility. Which one of the following is a reason for that?

  A. Restricting access to the Configuration Utility can only be done from the Command Line Interface
  B. The administrator must restrict access by IP address for SSH, which will implicitly restrict access to the Configuration Utility
  C. To avoid locking out the administrator, recent versions of BIG-IP no longer allow restricting administrator access to the Configuration Utility by source IP address
  D. The administrator needs to switch to the "Advanced" view mode in order to display the relevant setting
  A. Restricting access to the Configuration Utility can only be done from the Command Line Interface

  ---

  The screenshot shown is from the User Administration section of the BIG-IP GUI.

  This section controls:

  Root and Admin passwords

  SSH Access

  SSH IP Allow settings

  However, it does not contain any controls for restricting access to the WebUI (TMUI) .

  BIG-IP does not provide TMUI access restrictions from this part of the GUI.

  Access to the web-based Configuration Utility is controlled by the httpd allow list , configured through TMSH:

  tmsh modify /sys httpd allow { }

  This setting is not displayed in the User Administration panel, and in many BIG-IP versions, the httpd allow list is only configurable from the CLI , not the GUI.

  Therefore, the administrator cannot find the setting in the screen shown because:

  TMUI access restriction is not located in this GUI section

  It must be configured using tmsh under /sys httpd allow

  This is why Option A is correct.

• Question 5:

  A secondary administrator has been granted access to a BIG-IP device through its Management Interface , but is unable to access the Configuration Utility (WebUI) . What command can be run from the CLI to capture the network traffic on the management interface and troubleshoot the issue? (Choose two.)

  A. tcpdump -i eth0 -n port 443
  B. tcpdump -i mgmt -n port 443
  C. tcpdump -i 0.0 -n port 443
  D. tcpdump -i tun0 -n port 443
  E. tcpdump -i management -n port 443
  A. tcpdump -i eth0 -n port 443
  B. tcpdump -i mgmt -n port 443

  ---

  The BIG-IP has two distinct planes:

  Management-plane# handled entirely by the management interface (MGMT)

  Data-plane (TMM)# handles Self IPs, VLAN interfaces, and traffic processing

  To capture traffic on the management interface, only the management-side NICs may be used:

  mgmt# Logical name for the management interface

  eth0# Physical Linux interface mapped to the management port on most BIG-IP platforms

  Both of these correctly capture inbound/outbound WebUI (HTTPS/443) traffic on the management port.

  Why the correct answers are A and B

  A. tcpdump -i eth0 -n port 443

  On BIG-IP appliances and VMs, the management port maps to eth0 at the Linux OS level.

  Capturing on eth0 correctly shows HTTPS traffic to the WebUI.

  B. tcpdump -i mgmt -n port 443

  mgmtis the BIG-IP alias for the management interface.

  This is the preferred and most explicit capture interface for management-plane packet captures.

  Why the other options are incorrect:

  C. tcpdump -i 0.0

  Interface 0.0 is the TMM switch interface used for data-plane packet captures.

  It does NOT capture management-plane traffic.

  D. tcpdump -i tun0

  Used for tunnel interfaces (IPsec, VXLAN, etc.)

  Not related to management access.

  E. tcpdump -i management

  There is no interface named management on BIG-IP.

  The correct names are mgmt or eth0.

• Question 6:

  A BIG-IP device will be dedicated to functioning as a WAF, requiring only the ASM module to be provisioned.

  What provisioning level will ensure that the system allocates all CPU, memory, and disk resources to this module exclusively?

  A. Dedicated
  B. Comprehensive
  C. Maximal
  D. Nominal
  A. Dedicated

  ---

  Provisioning defines how BIG-IP allocates system resources to modules. The provisioning levels include: Dedicated allocates all CPU, memory, and disk resources to a single module Nominal standard resource allocation balanced with other modules Minimal lowest level, used for basic utility needs None module disabled Comprehensive / Maximal?not valid TMOS provisioning levels Why "Dedicated" is correct When a BIG-IP device is intended to run only ASM (Web Application Firewall), the recommended way to maximize performance is to provision the module at Dedicated level. With ASM: Dedicated :

  ASM receives theentire hardware capacity No other modules can or should be provisioned This is explicitly recommended when a device is used solely as a WAF platform Why other options are incorrect

  B. Comprehensive / C. Maximal

  These are not valid provisioning modes in BIG-IP.

  TMOS supports: Nominal, Minimal, Large (module-specific), and Dedicated.

  D. Nominal

  Shares resources with other modules

  Does not provide full system performance

  Not suitable when exclusive resource allocation is required

  Thus, Dedicated is the correct provisioning choice.

• Question 7:

  The Configuration Utility of a BIG-IP device is currently accessible via its management IP 10.53.1.245 from all VLANs.

  The BIG-IP Administrator needs to restrict access so only hosts from the 10.0.0.0/24 subnet can access the Configuration Utility.

  Which TMSH command accomplishes this?

  A. (tmos)# create /net acl MGMT.HTTP rule add { (permit tcp 10.0.0.0 0.0.0.255 host 10.53.1.245 http) }
  B. (tmos)# modify /ltm httpd allow replace-all-with {10.0.0.0/24}
  C. (tmos)# create /net acl MGMT.HTTP rule add { (permit tcp 10.0.0.0/24 10.53.1.245 http) (deny ip any any http) }
  D. (tmos)# modify /sys httpd allow replace-all-with {10.0.0.0/24}
  D. (tmos)# modify /sys httpd allow replace-all-with {10.0.0.0/24}

  ---

  BIG-IP controls access to the web-based Configuration Utility (TMUI) through the /sys httpd allow list. This parameter specifies which client IPs or subnets may initiate HTTP/HTTPS connections to the management interface.

  To restrict TMUI access to only the 10.0.0.0/24 subnet:

  The correct method is to modify the HTTPD allow list so that it contains only this subnet.

  This requires replacing the entire current list with the new subnet using:

  modify /sys httpd allow replace-all-with {10.0.0.0/24}

  This ensures that only clients within 10.0.0.0/24 can reach the Configuration Utility.

  Why the other options are incorrect:

  Options A and Ccreate network ACL objects under /net acl, which apply to data-plane traffic, not management-plane TMUI access. TMUI access is not controlled by LTM ACLs but by the HTTPD allow directive.

  Option Bis incorrect syntax and references /ltm httpd, which is not the proper object; the correct hierarchy is /sys httpd.

  Thus, only modifying the /sys httpd allow list achieves the required restriction.

• Question 8:

  A BIG-IP Administrator is responsible for deploying a new software image on an F5 BIG-IP HA pair and has scheduled a one-hour maintenance window. With a focus on minimizing service disruption, which of the following strategies is the most appropriate?

  A. Update the active node first, reboot to the newly updated boot location and verify functionality, then push the update from the active to the standby node and reboot the standby node.
  B. Reset the Device Trust, apply the update to each node separately, reboot both nodes, then re-establish the Device Trust.
  C. Update the standby node first and reboot it to the newly updated boot location, failover to the newly updated node and verify functionality. Repeat the upgrade procedures on the next node, which is now in standby mode.
  D. Update both nodes in the HA pair, then reboot both nodes simultaneously to ensure they run the same software version.
  C. Update the standby node first and reboot it to the newly updated boot location, failover to the newly updated node and verify functionality. Repeat the upgrade procedures on the next node, which is now in standby mode.

  ---

  For BIG-IP high-availability (HA) pairs, F5's recommended upgrade workflow prioritizes service continuity , predictable failover , and minimal downtime . The established best-practice sequence is:

  Upgrade the standby unit first

  Because the standby device is not passing traffic, upgrading and rebooting it does not impact production.

  Boot the standby unit into the newly installed version

  Once online, the administrator verifies basic health, device sync status, cluster communication, and module functionality.

  Perform a controlled failover to the upgraded unit

  Traffic shifts to the newly upgraded device, allowing validation of the configuration and operational behavior under real traffic loads.

  Upgrade the second device (now standby)

  The previously active device becomes standby after failover, allowing it to be safely upgraded and rebooted without interruption.

  This phased approach ensures only one device is unavailable at a time, allowing continuous traffic flow throughout the upgrade process.

  Why the Correct Answer is C

  Option exactly matches F5's documented production-safe upgrade method: C

  Upgrade the standby node first

  Reboot into new image

  Failover to upgraded device

  Validate

  Upgrade the remaining (now-standby) device

  This procedure minimizes risk and traffic disruption.

  Why the other options are incorrect:

  A. Upgrade the active node first

  Upgrading the active device requires removing it from service and failing over abruptly. This is not recommended and increases service disruption risk.

  B. Resetting device trust

  Resetting trust is unnecessary and can disrupt configuration sync, peer communication, and cluster operation. It is not part of any standard upgrade workflow.

  D. Upgrading and rebooting both nodes simultaneously

  This would cause total outage , because both HA members would be unavailable at the same time.

• Question 9:

  The device is currently on v15.1.2.1 .

  The BIG-IP Administrator needs to boot the device back to v13.1.0.6 to gather data for troubleshooting.

  The system shows:

  Sys::Software Status

  Volume Product Version Build Active Status Allowed

  HD1.1 BIG-IP 15.1.2.1 0.0.10 yes complete yes

  HD1.2 BIG-IP 13.1.0.6 0.0.3 no complete yes

  Which is the correct command-line sequence to boot the device to version 13.1.0.6 ?

  A. Use tmsh to select a new boot volume, tmsh reboot HD1.2
  B. switchboot -b HD1.2, then reboot
  C. switchboot -I HD1.2, then reboot
  D. Use tmsh to select a new boot volume, tmsh switchboot HD1.2
  B. switchboot -b HD1.2, then reboot

  ---

  To change the boot volume on a BIG-IP system from one installed TMOS version to another, the correct CLI tool is:

  switchboot

  The correct syntax uses the -b flag:

  switchboot -b

  This command marks the specified boot location as the one to be used on the next reboot.

  Thus, to boot into HD1.2 which contains 13.1.0.6 , the sequence is:

  Mark HD1.2 as the next boot location:

  switchboot -b HD1.2

  Reboot the system:

  reboot

  This is the standard and officially supported method for selecting a different installed volume.

  Why the other options are incorrect:

  A. "tmsh reboot HD1.2"

  There is no such tmsh syntax.

  Boot volume cannot be selected by adding a parameter to reboot.

  C. switchboot -I HD1.2

  The -I flag is invalid. Only -b is used.

  D. "tmsh switchboot HD1.2"

  switchboot is not a tmsh command; it is a system-level shell utility.

  Therefore, Option B is the correct and valid command sequence.

• Question 10:

  A BIG-IP Administrator needs to install a HotFix on a standalone BIG-IP device, which has HD1.1 as the Active Boot Location.

  The administrator has already re-activated the license and created a UCS archive.

  In which sequence should the administrator perform the remaining steps?

  A. Install HotFix in HD1.2, Install base Image in HD1.2, Activate HD1.2
  B. Install HotFix in HD1.1, Reboot the BIG-IP device, Install UCS Archive
  C. Install base Image in HD1.2, Install HotFix in HD1.2, Activate HD1.2
  D. Activate HD1.2, Install base Image in HD1.2, Install HotFix in HD1.2
  C. Install base Image in HD1.2, Install HotFix in HD1.2, Activate HD1.2

  ---

  When installing a HotFix on a BIG-IP device, F5 best practices require:

  Installing the base TMOS image on a new, unused boot volume (HD1.2)

  This ensures the upgrade happens on a clean volume.

  The existing active boot location remains untouched for rollback.

  Installing the HotFix onto the SAME new boot volume (HD1.2)

  HotFixes must be applied on top of a base version.

  They cannot be installed on an empty volume.

  They must match the base image version.

  Activating the new boot volume (HD1.2)

  The system reboots into the updated software stack.

  Activation happens after base + HotFix installation is complete.

  This sequence is exactly shown in Option C :

  Install base Image in HD1.2

  Install HotFix in HD1.2

  Activate HD1.2

  Why the other options are incorrect:

  A. Install HotFix before base image

  Impossible.

  HotFix requires an installed base version first.

  B. Installing HotFix on HD1.1 (active boot volume)

  Not recommended.

  Upgrading in-place removes rollback safety.

  HotFix cannot be applied cleanly without applying base image first.

  D. Activate HD1.2 before installing anything

  You cannot activate an empty boot volume.

  Activation only occurs after the base + HotFix software is installed.