F5 F5CAB1 Online Practice Questions and Exam Preparation

F5 F5CAB1 Online Questions & Answers

• Question 21:

  The Port Lockdown feature prevents unwanted connection attempts to a Self IP. Which three types of connection attempts are unaffected by Port Lockdown settings?

  A. Defined virtual server traffic, Secure Shell (SSH), Centralized Management Infrastructure (CMI)
  B. Centralized Management Infrastructure (CMI), Secure Shell (SSH), Internet Control Message Protocol (ICMP)
  C. Defined virtual server traffic, Internet Control Message Protocol (ICMP), Centralized Management Infrastructure (CMI)
  C. Defined virtual server traffic, Internet Control Message Protocol (ICMP), Centralized Management Infrastructure (CMI)

  ---

  Port Lockdown controls which ports and protocols a Self IP will respond to.

  However, certain traffic types bypass Port Lockdown for BIG-IP functionality and routing integrity.

  The three types that are NOT affected by Port Lockdown are:

  1.

  Defined Virtual Server Traffic

  Traffic destined to a Self IP that matches a configured virtual server is always accepted by the BIG-IP, regardless of Port Lockdown settings.

  This ensures that traffic processing does not break when administrators restrict Self-IP ports.

  2.

  ICMP (Internet Control Message Protocol)

  ICMP (such as ping, traceroute responses, etc.) always passes through a Self IP even when Port Lockdown is set to:

  Allow Default

  Allow None

  Allow Custom

  F5 allows ICMP for reachability and diagnostic purposes independent of Port Lockdown rules.

  3.

  Centralized Management Infrastructure (CMI)

  CMI includes the internal HA services used for:

  Device Trust

  ConfigSync

  Failover

  Mirroring

  These essential HA communications bypass Port Lockdown to prevent accidental cluster failure.

  The well-known port for this traffic is TCP 4353 , which is always permitted.

  Why the other options are incorrect:

  Option A:SSH restricted by Port Lockdown unless explicitly allowed. is

  Option B:Same issue -- SSH does not bypass Port Lockdown.

  Only Defined VS Traffic ICMP , , and CMI bypass Port Lockdown.

• Question 22:

  The BIG-IP Administrator needs to update access to the Configuration Utility to include the 172.28.31.0/24 and 172.28.65.0/24 networks. From the TMOS Shell (tmsh), which command should the BIG-IP Administrator use to complete this task?

  A. modify /sys httpd allow add { 172.28.31.0/255.255.255.0 172.28.65.0/255.255.255.0 }
  B. modify /sys httpd allow add { 172.28.31.0 172.28.65.0 }
  C. modify /sys httpd permit add { 172.28.31.0/255.255.255.0 172.28.65.0/255.255.255.0 }
  A. modify /sys httpd allow add { 172.28.31.0/255.255.255.0 172.28.65.0/255.255.255.0 }

  ---

  Access to the BIG-IP Configuration Utility (TMUI) is controlled through the /sys httpd allow list.

  This list defines which IP addresses or subnets are allowed to connect to the management web interface.

  To allow two new subnets-- 172.28.31.0/24 and 172.28.65.0/24 --the administrator must add both subnets to the existing list without removing current entries.

  In tmsh, subnet entries must be specified in network/netmask format , for example:

  172.28.31.0/255.255.255.0

  The correct tmsh command to append these networks is:

  modify /sys httpd allow add { 172.28.31.0/255.255.255.0 172.28.65.0/255.255.255.0 }

  Why the other options are incorrect:

  Option B:

  IPs are listed without masks, which is invalid for subnet-based access control.

  The system requires network/netmask format.

  Option C:

  The command uses permit instead of allow, which is not a valid attribute of /sys httpd.

  The correct keyword must be allow .

  Thus, only Option A correctly adds both permitted subnets in the proper tmsh format.

• Question 23:

  How can the BIG-IP Administrator tell when an unlicensed module has been provisioned?

  A. A BIG-IP does not allow unlicensed modules to be provisioned.
  B. When provisioning an unlicensed module, a warning will appear.
  C. A Provisioning Warning will be displayed in the GUI in the upper left corner.
  C. A Provisioning Warning will be displayed in the GUI in the upper left corner.

  ---

  The BIG-IP system has built-in licensing enforcement.

  If an administrator provisions a module that the device is not licensed to run, the system will still allow the provisioning action to occur initially , but the system detects the mismatch and displays an alert.

  What actually happens:

  The GUI places a warning banner in the upper-left corner labeled something similar to: "Provisioning Warning"

  This appears immediately after provisioning a module that is not included in the active license.

  The system remains in an "inconsistent state" until the module is disabled again or the license is updated.

  This is the visual cue BIG-IP uses to indicate that a module was provisioned without valid licensing.

  Why the other options are incorrect:

  A. "A BIG-IP does not allow unlicensed modules to be provisioned."

  Not true. BIG-IP does allow provisioning, but warns afterward.

  B. "A warning will appear when provisioning an unlicensed module."

  The warning does not appear during the provisioning step itself. It appears after provisioning , in the main GUI, as a system banner.

• Question 24:

  An administrator needs to display the configured management IP address from within tmsh. Which command accomplishes this task?

  A. show sys management-ip
  B. list sys management-ip
  C. show net mgmt
  D. list net self
  B. list sys management-ip

  ---

  The management IP address is stored as a system configuration object under the /sys hierarchy.

  The tmsh list command displays configured values.

  Running:

  list sys management-ip

  shows the configured management IP address and netmask.

  The show command displays runtime statistics, and net self objects apply only to data-plane Self IPs.

• Question 25:

  For an upgrade of a standalone BIG-IP, a maintenance window is available in which brief interruptions are allowed.

  Actions with no impact can be done outside the maintenance window.

  When should a license reactivation be performed?

  A. During the maintenance window.
  B. Before the maintenance window.
  C. After the maintenance window.
  B. Before the maintenance window.

  ---

  License reactivation updates the BIG-IP device's license file to ensure:

  The Service Check Date is current

  The device is eligible to install the intended TMOS version

  Any module entitlement updates are received

  Reactivation does not interrupt traffic and does not require a reboot, making it safe to perform before the maintenance window.

  F5 best practices state:

  Perform all non-impact tasks prior to the scheduled maintenance window

  Leave the window available for activities that require rebooting, such as the software installation itself

  Since license reactivation is non-disruptive , it should be done before the upgrade window starts.

• Question 26:

  A BIG-IP Administrator discovers malicious brute-force attempts to access the BIG-IP device on the management interface via SSH.

  The administrator needs to restrict SSH access to the management interface.

  Where should this be accomplished?

  A. Network > Interfaces
  B. Network > Self IPs
  C. System > Configuration
  D. System > Platform
  C. System > Configuration

  ---

  The BIG-IP management interface (MGMT port) is controlled through System settings , not through the Network menu.

  SSH access on the management interface is configured here:

  System # Configuration # Device # General # SSH Access / SSH IP Allow

  This section allows the administrator to:

  Enable or disable SSH service

  Restrict SSH access to specific IP addresses or subnets

  Apply security policies to the management interface

  Why the other options are incorrect:

  A. Network > Interfaces

  Used for data-plane physical interface settings, not management plane SSH restrictions.

  B. Network > Self IPs

  Controls in-band management or data-plane access, not the dedicated management port.

  D. System > Platform

  Used for hostname, time zone, LCD contrast, hardware settings -- not SSH security on the management port.

  Therefore, restricting SSH access to the management interface must be done under:

  #System # Configuration # Device # General

  Which corresponds to Option C .

• Question 27:

  A BIG-IP Administrator needs to verify the state of equipment in the data center.

  A BIG-IP appliance has a solid yellow indicator on the status LED.

  How should the administrator interpret this LED indicator?

  A. Appliance is halted or in End-User Diagnostic (EUD) mode
  B. Appliance is a standby member in a device group
  C. A warning-level alarm condition is present
  D. A power supply is NOT operating properly
  C. A warning-level alarm condition is present

  ---

  BIG-IP hardware platforms use chassis LEDs to indicate system health states. A solid yellow status LED typically indicates a warning condition , such as: A non-critical hardware alert A temperature threshold nearing limit A minor fan or sensor irregularity Other non-fatal environmental or system conditions This state reflects a warning-level alarm , meaning the unit is operational but requires investigation. Why the other options are incorrect

  A. Halted or EUD mode

  This is associated with different LED patterns (usually flashing conditions or specific color codes), not a solid yellow status LED.

  B. Standby in device group

  HA state is not indicated by the chassis status LED.

  Standby status is a logical device state, not a hardware LED state.

  D. Power supply failure

  Power supply indicators use separate LEDs located on each power module (usually flashing amber/red), not the system status LED.

  Thus, a solid yellow status indicator signifies a warning-level alarm .

• Question 28:

  The BIG-IP Administrator uses Secure Copy Protocol (SCP) to upload a TMOS image to the/shared/ images/ directory in preparation for a TMOS upgrade.

  After the upload is completed, what will the system do before the image is shown in the GUI under:

  System > Software Management > Image List?

  A. The system performs a reboot into a new partition
  B. The system verifies the internal checksum
  C. The system copies the image to /var/local/images/
  B. The system verifies the internal checksum

  ---

  When a TMOS image (.iso file) is uploaded into the /shared/images/ directory, the BIG-IP performs an internal validation step before the ISO appears in the GUI.

  1. The system verifies the internal checksum BIG-IP automatically reads the embedded checksum inside the ISO file Verifies integrity of the uploaded image Confirms the file is not corrupted or incomplete Ensures the image is a valid F5 TMOS software image Only after this checksum verification succeeds does the image appear under: System # Software Management # Image List Why the other options are incorrect:

  A. The system performs a reboot into a new partition Uploading an ISO file never triggers a reboot.

  C. The system copies the image to /var/local/images/ All valid TMOS images remain in /shared/images/ . No copying occurs.

• Question 29:

  The monitoring team reports that the SNMP server is unable to poll data from a BIG-IP device.

  What information will help the BIG-IP Administrator determine whether the issue originates from the BIG-IP system?

  A. The "Port Lockdown" setting is preventing the SNMP server from polling data from the BIG-IP.
  B. The "Traffic Group" setting must use a floating Traffic Group.
  C. The "VLAN / Tunnel" setting must allow All Vlans.
  D. The configuration on the exhibit is correct and other options should be explored.
  A. The "Port Lockdown" setting is preventing the SNMP server from polling data from the BIG-IP.

  ---

  The exhibit shows a Self IP with:

  VLAN:Data

  Port Lockdown:Allow None

  Impact of "Allow None" on SNMP

  When a Self IP is configured with:

  Port Lockdown: Allow None

  the BIG-IP blocks all services and ports except a few hardcoded HA communication ports.

  This means:

  UDP/161 (SNMP)is blocked

  UDP/162 (SNMP traps)is blocked

  The SNMP server cannot poll or receive data from the BIG-IP through this Self IP

  SNMP relies on access through the Self IP if out-of-band (mgmt interface) is not used.

  Thus, the issue is directly caused by Port Lockdown = Allow None , which prevents SNMP communication.

  Why the other options are incorrect:

  B. Traffic Group must use a floating Traffic Group

  SNMP polling does not require floating Self IPs.

  Floating groups apply to HA failover IPs, not SNMP functionality.

  C. VLAN/Tunnel must allow All VLANs

  Self IPs are always bound to a VLAN; SNMP does not require All VLANs.

  As long as the Self IP belongs to a reachable VLAN, SNMP can work.

  D. Configuration is correct

  It is not correct: Allow None blocks SNMP and is the problem.

• Question 30:

  A BIG-IP system is licensed for multiple modules, but only LTM functionality is required. The administrator wants to ensure unused modules consume no system resources. What provisioning level should be configured for the unused modules?

  A. Nominal
  B. Minimal
  C. None
  D. Dedicated
  C. None

  ---

  Module provisioning controls how system resources are allocated.

  Setting a module to:

  None disables the module entirely and ensures it consumes zero CPU, memory, or disk resources. Minimal and Nominal still allocate resources, and Dedicated allocates all resources to a single module, which is not appropriate for unused modules.