F5 F5CAB1 Online Practice Questions and Exam Preparation

F5 F5CAB1 Online Questions & Answers

• Question 11:

  When logged into the bash shell of a BIG-IP system, which of the following commands will display the management-ip address? (Choose two.)

  A. tmsh list /sys management-ip
  B. show mgmt ip
  C. ifconfig mgmt
  D. list / sys management-ip
  A. tmsh list /sys management-ip
  C. ifconfig mgmt

  ---

  When logged into the bash shell of a BIG-IP system, there are two valid ways to view the management-ip address:

  A. tmsh list /sys management-ip

  Even from the bash shell, the administrator can enter a tmsh command by typing:

  tmsh list /sys management-ip

  This displays:

  Management IP address

  Netmask

  Any configured management routes

  This is the official tmsh method for viewing the management-ip configuration.

  C. ifconfig mgmt

  In the underlying Linux OS, the management interface maps to the mgmt interface.

  Running:

  ifconfig mgmt

  displays:

  Assigned management IP

  Netmask

  Link-level status

  This is a valid Linux-level method used frequently for troubleshooting.

  Why the other options are incorrect:

  B. show mgmt ip

  Not a valid bash or tmsh command on BIG-IP.

  D. list / sys management-ip

  Missing the tmsh prefix.

  In bash, this will generate a syntax error.

  The correct form requires:

  tmsh list /sys management-ip

• Question 12:

  An administrator is in the process of reactivating the license using the interface displayed in the exhibit.

  What is the address of the license server to which the BIG-IP device must be able to establish an outbound connection in order to use the Automatic Activation Method ?

  A. license.f5.com
  B. callhome.f5.com
  C. ask.f5.com
  D. activate.f5.com
  D. activate.f5.com

  ---

  When you choose Automatic as the activation method in the License > Re-activate screen, the BIG-IP device itself contacts F5's license activation service over the Internet.

  For successful automatic activation:

  The BIG-IP must have outbound network connectivity (typically via the management interface).

  DNS resolution and routing must allow it to reach the F5 license activation host (the one shown in option D).

  The device sends its dossier and registration key to that service and receives an updated license file in return, which is then installed automatically.

  The other hostnames in the options are not used by BIG-IP for license activation, so they cannot be correct in the context of Automatic Activation .

• Question 13:

  A BIG-IP Administrator needs to install a HotFix on a standalone BIG-IP device.

  The device currently has HD1.1 as the Active Boot Location.

  The administrator has already reactivated the license and created a UCS archive.

  In which sequence should the administrator perform the remaining steps ?

  A. Install HotFix in HD1.2, Install base Image in HD1.2, Activate HD1.2
  B. Install HotFix in HD1.1, Reboot the BIG-IP device, Install UCS Archive
  C. Install base Image in HD1.2, Install HotFix in HD1.2, Activate HD1.2
  D. Activate HD1.2, Install base Image in HD1.2, Install HotFix in HD1.2
  C. Install base Image in HD1.2, Install HotFix in HD1.2, Activate HD1.2

  ---

  When installing a software upgrade with a HotFix on BIG-IP, the correct workflow requires: Install the base TMOS imageon an unused boot volume Install the corresponding HotFixonto that same boot volume Activate the updated boot volumeto boot into the new software This method ensures: The existing active system (HD1.1) is untouched The upgrade occurs in a new, clean volume (HD1.2) The HotFix applies properly to the same base image The administrator can revert to HD1.1 if issues occur Option matches the correct F5 upgrade sequence: C

  1.

  Install base image on HD1.2

  2.

  Install HotFix on HD1.2

  3.

  Activate HD1.2

  Why the other options are incorrect:

  A. Install HotFix before base image

  HotFixes must be applied after the base image; not valid.

  B. Installing a HotFix on the active boot location (HD1.1)

  Not recommended and does not use a clean new volume.

  Also does not involve installing the base image.

  D. Activating HD1.2 before installing anything

  Cannot activate an empty or invalid boot volume.

  Thus, Option C is the correct sequence.

• Question 14:

  Which port is an exception to the Port Lockdown function of Self-IPs if a device-group synchronization cluster is configured?

  A. TCP 443
  B. TCP 4353
  C. UDP 53
  B. TCP 4353

  ---

  Self-IPs implement a security feature known as Port Lockdown , which limits which services are reachable on a Self-IP. However, certain services required for BIG-IP device-to-device communication bypass Port Lockdown to ensure cluster and HA functionality. TCP 4353 TCP port 4353 is used by Device Service Clustering (DSC) for: Device trust establishment Configuration synchronization Failover communication Because BIG-IP devices must always be able to communicate for HA functions to remain operational, port 4353 is exempt from Port Lockdown rules . Why the other options are incorrect

  A. TCP 443

  Not required for device trust or synchronization.

  HTTPS access is fully controlled by Port Lockdown.

  C. UDP 53

  DNS traffic is not required for synchronization and has no exemption under Port Lockdown.

• Question 15:

  Which two items demonstrate the creation of a new volume for software images? (Choose two.)

  A. tmsh install software image /shared/images/BIGIP-.iso volume HD1.5 create-volume
  B. tmsh install /sys software image BIGIP-.iso volume HD1.5 create-volume
  C. Using the GUI, go to System > Disk Management , select New Volume . In the pop-up window, type the name or number of the new volume and click Apply .
  D. tmsh install sys software image /shared/images/BIGIP-.iso volume HD1.5 create-volume
  E. Using the GUI, go to System > Software Management > Available Images > Install , and in the Install Software Image pop-up window, type the new volume name or number and click Install .
  A. tmsh install software image /shared/images/BIGIP-.iso volume HD1.5 create-volume
  C. Using the GUI, go to System > Disk Management , select New Volume . In the pop-up window, type the name or number of the new volume and click Apply .

  ---

  In BIG-IP, software images are installed on boot volumes (for example, HD1.1, HD1.2, HD1.3, etc.).

  To install software on a new volume , the administrator must instruct the system to create a new boot location before installation.

  There are two correct ways to create a new volume:

  A. tmsh command (with correct syntax)

  tmsh install software image /shared/images/BIGIP-.iso volume HD1.5 create-volume

  This syntax correctly includes:

  install software image

  full path to ISO (/shared/images/...)

  volume name (HD1.5)

  create-volumekeyword

  This instructs BIG-IP to create the new boot volume as part of the installation.

  C. Using the GUI # System > Disk Management

  From the Disk Management menu, the administrator can:

  Select "New Volume"

  Enter the volume identifier (e.g., HD1.5)

  Apply changes

  This GUI method is officially supported and explicitly creates a new boot volume before installing the software.

  Why the other options are incorrect:

  B. Incorrect tmsh syntax

  Missing /shared/images/ path

  Incorrect command structure

  D. Incorrect command structure

  Missing required keywords and correct command hierarchy

  E. Software Management # Install does NOT create volumes

  This installs to an existing volume only

  The GUI install dialog does not create new boot volumes

  Thus, only Option A and Option C properly create a new software volume.

• Question 16:

  An F5 BIG-IP Administrator is asked to report which modules are provisioned on the BIG-IP. In which two ways can this be done? (Choose two.)

  A. Via the GUI atSystem # Resource Provisioning # Module Allocation
  B. Via TMSH withshow /sys provision
  C. Via the GUI atStatistics # Module Statistics # System
  D. Via TMSH withlist /sys provision
  A. Via the GUI atSystem # Resource Provisioning # Module Allocation
  D. Via TMSH withlist /sys provision

  ---

  Provisioning determines:

  Which BIG-IP modules are enabled (LTM, ASM, APM, AFM, DNS, etc.)

  Their provisioning levels (None, Minimal, Nominal, Dedicated)

  Two accurate ways to view provisioning settings are:

  A. GUI -- System # Resource Provisioning # Module Allocation

  This is the primary GUI screen showing:

  All modules

  Their provisioning level

  System resource distribution impact

  Administrators commonly use this page to confirm or change module provisioning.

  D. TMSH -- list /sys provision

  This tmsh command displays each module and its provisioning level:

  sys provision ltm { level nominal }

  sys provision asm { level none }

  This is the authoritative CLI method for checking module provisioning configurations.

  Why the other options are incorrect:

  B. show /sys provision

  Shows runtime information but not the actual configuration levels .

  list is the correct command for configuration details.

  C. Statistics # Module Statistics

  Shows performance statistics, NOT provisioning status.

  Therefore, the correct responses are and . A D

• Question 17:

  A BIG-IP Administrator plans to upgrade a BIG-IP device to the latest TMOS version.

  Which two tools could the administrator leverage to verify known issues for the target versions? (Choose two.)

  A. F5 End User Diagnostics (EUD)
  B. F5 iHealth
  C. F5 University
  D. F5 Bug Tracker
  E. F5 Downloads
  B. F5 iHealth
  D. F5 Bug Tracker

  ---

  Comprehensive and Detailed(Paraphrased from F5 BIG-IP Administration Install, Initial Configuration, and Upgrade concepts)

  When performing a TMOS upgrade, F5 recommends validating the target software version to ensure that the release does not contain defects that may impact system behavior. The upgrade preparation process includes checking for known issues, validating compatibility, and reviewing advisory information for the intended version. Two primary F5 tools serve this purpose:

  B. F5 iHealth

  iHealth is a cloud-based diagnostic and analysis platform used to evaluate the operational state of a BIG- IP system.

  Administrators upload a QKView file to iHealth to receive an automated assessment of the system. As part of upgrade planning, iHealth provides:

  Version-specific issue analysis, comparing the system's configuration and hardware against F5's internal catalog of published issues.

  Upgrade advisories, identifying potential risks such as deprecated features, module compatibility concerns, or changes in behavior between TMOS versions.

  Checks against known defects, allowing administrators to determine whether the target TMOS version contains issues relevant to their deployment.

  This aligns with F5's recommended upgrade workflow, where iHealth is used before upgrading to confirm system readiness and detect software-level concerns.

  D. F5 Bug Tracker

  The Bug Tracker is F5's dedicated interface for reviewing software defects across TMOS releases.

  It enables administrators to:

  Search for known bugs by TMOS version , module, severity, or defect ID.

  Review the status of defects (open, resolved, fixed in later releases).

  Identify whether high-impact or security-related issues are associated with the target upgrade version.

  F5 documentation emphasizes reviewing known defects prior to installation of new software images, making the Bug Tracker a critical resource for upgrade validation.

  Why the other options are not correct

  A. F5 End User Diagnostics (EUD)

  EUD is used exclusively for hardware diagnostics (ports, memory, fans). It does not provide software- related issue verification and is not used for upgrade planning.

  C. F5 University

  This is a training platform , not an operational tool. It does not provide defect listings or upgrade-specific warnings.

  E. F5 Downloads

  Although it provides access to software images and release notes, it is not a tool for identifying known bugs . Release notes summarize general fixes and features, but systematic bug verification requires iHealth or the Bug Tracker.

• Question 18:

  When is the License Service Check Date enforced on a BIG-IP system?

  A. After editing a virtual server
  B. During a software install
  C. During system startup
  B. During a software install

  ---

  The Service Check Date determines whether a particular software version is allowed to run under the device's license.

  When installing or upgrading TMOS, the installer checks the Service Check Date stored in the BIG-IP license file.

  If the license date is older than the minimum required for the target version, the software installation is blocked .

  This check happens specifically during a software install , not during routine device operations.

  Editing virtual servers or system startup do not trigger this validation.

  Thus, the enforcement happens during software installation .

• Question 19:

  A BIG-IP device is licensed for LTM, ASM, APM, and AFM .

  Currently, it will only be used for load balancing and web application firewalling .

  To ensure optimal performance and efficient resource utilization, which of the following module provisioning combinations is the best choice?

  A. LTM: Dedicated ASM: Dedicated APM: Minimal AFM: Minimal
  B. LTM: Dedicated ASM: Dedicated APM: None AFM: None
  C. LTM: Nominal ASM: Nominal APM: None AFM: None
  D. LTM: Nominal ASM: Nominal APM: Minimal AFM: Minimal
  C. LTM: Nominal ASM: Nominal APM: None AFM: None

  ---

  BIG-IP provisioning determines how CPU, memory, and disk resources are allocated to each module. The goal is to provision only the modules required and at levels appropriate to their performance needs.

  Requirements in the question

  The device will be used for:

  LTM(Local Traffic Manager) # load balancing

  ASM(Application Security Manager) # WAF

  No functions require:

  APM (Access Policy Manager)

  AFM (Advanced Firewall Manager)

  Why Option C is correct

  Provisioning both LTM and ASM Nominal at level provides:

  Adequate performance for production load

  Plentiful system resources while avoiding dedicating the entire system to a single module

  Balanced allocation without starving memory or CPU

  Setting APM: None and AFM: None ensures unused modules consume zero resources.

  Why the other options are incorrect

  A. Dedicated provisioning for both LTM and ASM

  Two modules cannot both run in "Dedicated" mode.

  Dedicated mode allocates all resources to a single module -- the second module cannot be dedicated simultaneously.

  B. LTM and ASM both Dedicated

  Same issue: only one module can be Dedicated at a time.

  Also unnecessary for load balancing + WAF.

  D. Setting APM and AFM to Minimal

  Minimal still consumes memory and CPU.

  Unused modules should be set to None .

  Therefore, Option C is the best provisioning strategy.

• Question 20:

  When using the tmsh shell of a BIG-IP system, which command will display the management-ip address?

  A. run /util bash ifconfig mgmt
  B. list /sys management-ip
  C. show /sys management-ip
  B. list /sys management-ip

  ---

  Comprehensive and Detailed(Paraphrased from F5 BIG-IP Administration / Installation / Initial Configuration concepts)

  Within the BIG-IP Traffic Management Shell (tmsh), system configuration objects--including the management IP--are organized under the /sys hierarchy. The management IP address is a configurable property stored in the system configuration and can be viewed using the tmsh list command, which displays configuration objects and their currently assigned values.

  Why "list /sys management-ip" is correct

  The list command in tmsh is used to display configured system values , not runtime statistics.

  The object that holds the management IP settings on BIG-IP systems is located at:/sys management-ip

  Running the command: list /sys management-ip will reveal the settings for the management IP interface, including the address, netmask, and any associated attributes.

  This is the standard method used during system setup and verification to confirm the management IP configuration.

  This behavior aligns with BIG-IP administration procedures, where configuration information is retrieved using list , while operational data is retrieved using show .

  Why the other options are incorrect

  A. run /util bash ifconfig mgmt

  This command enters the Bash shell, then runs ifconfig to display the management interface.

  While this can show the management interface address, it is not a tmsh-native command , and the question specifically asks for a tmsh command.

  Administrators use tmsh directly for configuration display rather than leaving the shell.

  C. show /sys management-ip

  The show command displays statistics or operational data , not configuration values.

  The management-ip object does not maintain statistics; therefore show does not return the configuration details required.

  Only the list command reveals stored configuration data such as IP address and netmask.