F5 F5CAB1 Online Practice Questions and Exam Preparation

F5 F5CAB1 Online Questions & Answers

• Question 31:

  In order to configure allowed IP addresses for SSH access to a BIG-IP device, the BIG-IP Administrator has issued the commands shown in the exhibit.

  

  Which IP addresses will have SSH access after issuing the shown commands? (Choose two.)

  A. 10.0.0.100
  B. 10.0.0.254
  C. 10.0.0.256
  D. 100.0.1.10
  E. 100.0.0.10
  A. 10.0.0.100
  B. 10.0.0.254

  ---

  From the exhibit, the administrator performs the following actions:

  Displays the current SSH allow configuration:

  tmsh list sys sshd allow

  allow { ALL }

  Replaces the existing SSH allow list with a specific subnet:

  tmsh modify sys sshd allow replace-all-with { 10.0.0.0/24 }

  Confirms the updated configuration:

  tmsh list sys sshd allow

  allow { 10.0.0.0/24 }

  This configuration restricts SSH access to only hosts that fall within the 10.0.0.0/24 network.

  Evaluation of the options

  A. 10.0.0.100

  This address is within the 10.0.0.0/24 subnet and is a valid host address, so SSH access is permitted.

  B. 10.0.0.254

  This address is also within the 10.0.0.0/24 subnet and is a valid host address, so SSH access is permitted.

  C. 10.0.0.256

  This is not a valid IP address because an IPv4 octet cannot exceed 255.

  D. 100.0.1.10

  This address is outside the configured 10.0.0.0/24 subnet and will not be allowed.

  E. 100.0.0.10

  This address is also outside the configured subnet and will not be allowed.

• Question 32:

  What are the two options for securing a BIG-IP's management interface? (Choose two.)

  A. Limiting network access through the management interface to a trusted/secured network VLAN.
  B. Block all management-interface administrative HTTPS and SSH service ports to prevent access.
  C. Use the BIG-IP's Self-IP addresses for administrative access rather than the management interface.
  D. Restrict administrative HTTPS and SSH access to specific IP addresses or IP ranges.
  A. Limiting network access through the management interface to a trusted/secured network VLAN.
  D. Restrict administrative HTTPS and SSH access to specific IP addresses or IP ranges.

  ---

  Securing the BIG-IP management interface is a fundamental administrative responsibility. F5 best practices emphasize restricting who can reach the management port and ensuring that only authorized systems are allowed access.

  A. Limiting management access to trusted network segments

  F5 recommends placing the management interface on adedicated, isolated, and secured management network or VLAN , rather than exposing it to production or untrusted networks.

  This reduces the attack surface by ensuring only trusted segments have visibility to administrative interfaces.

  D. Restricting management access by IP or subnet

  F5 BIG-IP uses the /sys httpd allow list (for HTTPS) and configuration options in sshd (for SSH) to control which IP addresses or subnets can access the device.

  By specifying only known administrative IPs or ranges, unauthorized users cannot reach the login services.

  Why the other options are incorrect

  B. Blocking all management HTTPS/SSH ports

  This would prevent any administrative access and is not a viable security practice.

  C. Using Self-IP addresses for administrative access

  F5 explicitly warns against using Self-IPs for management access unless strictly necessary.

  Self-IPs are exposed to the data plane and should not be used as the primary administrative interface.

• Question 33:

  Refer to the exhibit.

  

  What traffic will be permitted to reach the BIG-IP?

  A. FTP
  B. SSH
  C. Telnet
  B. SSH

  ---

  The exhibit shows the configuration of a Self IP with:

  Port Lockdown: Allow Custom

  A Custom List that includes the following TCP ports:

  Meaning of these ports:

  TCP 443# HTTPS (TMUI -- web-based management)

  TCP 22# SSH (command-line remote access)

  No other TCP, UDP, or protocol entries are listed; therefore, only these two services are allowed to reach the BIG-IP via this Self IP.

  Evaluating the answer choices:

  Option

  Service

  Port

  Allowed

  FTP

  TCP 21

  Not listed

  Not allowed

  SSH

  TCP 22

  Listed

  Allowed

  Telnet

  TCP 23

  Not listed

  Not allowed

  Thus, SSH is the only traffic permitted through this Self IP configuration.

• Question 34:

  The BIG-IP Administrator received a ticket that an authorized user is attempting to connect to the Configuration Utility from a jump host and is being denied. The HTTPD allow list is configured as:

  sys httpd {

  allow { 172.28.31.0/255.255.255.0 172.28.65.0/255.255.255.0 }

  }

  The jump host IP is 172.28.32.22 .

  What command should the BIG-IP Administrator use to allow HTTPD access for this jump host?

  A. modify /sys httpd allow replace-all-with { 172.28.32.22 }
  B. modify /sys httpd allow delete { 172.28.31.0/255.255.255.0 172.28.65.0/255.255.255.0 }
  C. modify /sys httpd allow add { 172.28.32.22 }
  C. modify /sys httpd allow add { 172.28.32.22 }

  ---

  The HTTPD allow list controls which IP addresses or subnets may access the Configuration Utility (TMUI) on the BIG-IP system. The Administrator already has two subnets allowed and needs to add a single host IP to the existing list.

  The object /sys httpd allow supports actions such as add delete , , and replace-all-with . Because the goal is to add one more entry without removing the existing permitted subnets, the correct command is:

  modify /sys httpd allow add { 172.28.32.22 }

  This appends the new host to the existing list while preserving the previously configured networks.

  Why the other options are incorrect:

  Option A (replace-all-with)would overwrite the entire allow list, removing existing permitted subnets-- unacceptable.

  Option B (delete)would remove the existing networks and not add the required host.

  Therefore, the correct administrative action is to add the jump host's IP.

• Question 35:

  A new logging solution is being implemented on the network. Policy requires keeping management traffic sent from the BIG-IP out of the management interface . After configuring the BIG-IP to forward messages to the new Syslog server, the BIG-IP Administrator notices that packets are being sentfrom a numbered data- plane Self IP . What should the BIG-IP Administrator change to send the traffic out of the correct interface ?

  A. Set the Management IP as the source address when configuring a Remote Syslog destination.
  B. Create a Management Route for the specific address/subnet of the syslog service via TMSH.
  C. Create a new Self IP in the same subnet as the management IP address using a route domain.
  D. Modify the port lockdown settings on the Self IP address to allow UDP port 514 traffic.
  B. Create a Management Route for the specific address/subnet of the syslog service via TMSH.

  ---

  By default, management-plane traffic uses the management routing table , while data-plane traffic uses the TMM routing table .

  Remote Syslog traffic is management-plane traffic unless a management route exists.

  If no Management Route matches the Syslog server's destination IP, the BIG-IP will instead:

  Use TMM routes , and

  Source the packets from aSelf IP

  This is exactly what the administrator is observing.

  To force Syslog traffic out the management port:

  You must create a Management Route , which is configured using:

  tmsh create /sys management-route gateway network This sends syslog traffic:

  Out of themanagement interface

  Using the Management IP as the source

  Thus, Option B is correct.

  Why the other options are incorrect:

  A. Set the Management IP as the source address

  Source address selection is overridden by routing.

  Without a management route, traffic still goes out the data plane.

  C. Create a new Self IP using a route domain

  Unnecessary and not related to management-plane routing.

  Syslog traffic should not rely on data-plane Self IPs.

  D. Modify port lockdown on Self IP to allow UDP/514

  This would allow Syslog traffic into the BIG-IP over a Self IP, not force outbound traffic via management.

• Question 36:

  A BIG-IP Administrator plans to upgrade TMOS on a standalone device. Which task can safely be performed before the maintenance window because it does not cause traffic interruption?

  A. Installing the new TMOS image
  B. Rebooting into a new boot volume
  C. Reactivating the license
  D. Activating the new boot location
  C. Reactivating the license

  ---

  License reactivation updates the license file and Service Check Date without requiring a reboot or affecting traffic. F5 best practices recommend completing all non-disruptive tasks before the maintenance window. Installing software or activating a new boot volume requires a reboot and should occur during the maintenance window.

• Question 37:

  A BIG-IP Administrator needs to purchase new licenses for a BIG-IP appliance.

  1.

  The administrator needs to know:

  2.

  Whether a module is licensed

  3.

  The memory requirement for that module

  Where should the administrator view this information in the System menu ?

  A. Configuration ?OVSDB
  B. Software Management
  C. Configuration ?Device
  D. Resource Provisioning
  D. Resource Provisioning

  ---

  To understand:

  Which modules arelicensed

  Which modules areprovisioned

  The resource requirements (CPU / RAM) of each module

  The administrator uses:

  System

  Resource Provisioning

  This page displays:

  All modules present in the license

  Whether they are enabled or disabled

  Required memory to activate each module

  CPU and disk allocation information

  Provisioning level options (None / Minimal / Nominal / Dedicated)

  This is the exact location where BIG-IP administrators evaluate module capacity before enabling or purchasing licensing upgrades.

  Why the other options are incorrect:

  A. Configuration OVSDB

  Used for network virtualization integrations, not licenses or modules.

  B. Software Management

  Used for software image installation, not licensing.

  C. Configuration Device

  Displays hostname, failover settings, device properties -- not module resource requirements.

  Thus, module licensing and memory requirement data are found under Resource Provisioning .

• Question 38:

  The BIG-IP Administrator uses Secure Copy Protocol (SCP) to upload a TMOS image to the/shared/ images/ directory in preparation for an upgrade.

  After the upload is complete, what will the system do before the image appears in the GUI under: System ?Software Management ?Image List?

  A. The system performs a reboot into the new partition
  B. The system verifies the internal checksum
  C. The system copies the image to /var/local/images/
  B. The system verifies the internal checksum

  ---

  When a TMOS ISO file is transferred to /shared/images/ , the BIG-IP automatically performs a validation step:

  Checksum Verification

  Before the image becomes visible in the GUI, the system verifies the internal checksum embedded inside the ISO.

  This ensures:

  The file was fully transferred

  The image is not corrupted

  It matches the official F5 release signature

  Only after passing this verification does the GUI display the ISO under "Available Images."

  Why the other options are incorrect:

  A. Reboot into a new partition

  No reboot occurs simply from uploading an image.

  C. Copying into /var/local/images/

  This directory is not used for ISO storage.

  All valid images remain in /shared/images/ .

  Thus, the correct system action is checksum verification .

• Question 39:

  An organization is planning to upgrade a BIG-IP system from 16.1.x 17.1.x to .

  For a successful upgrade, the Service Check Date must be equal to or newer than the License Check Date required for 17.1.x.

  Which command will show the Service Check Date on the BIG-IP system being upgraded?

  A. grep "Service check date" /config/bigip.license
  B. grep "Service check date" /config/bigip.conf
  C. grep "Service check date" /config/svc_chk_date.dat
  D. grep "Service check date" /config/BigDB.dat
  A. grep "Service check date" /config/bigip.license

  ---

  BIG-IP licensing information, including the Service Check Date , is stored in the file:

  /config/bigip.license

  This file contains all license attributes downloaded from the F5 licensing server, including:

  License key

  Licensed modules

  Useful life date

  Service check date

  The Service Check Date determines whether the system is eligible for upgrades to specific TMOS versions. When reviewing upgrade readiness, administrators extract this value directly from the license file with:

  grep "Service check date" /config/bigip.license

  Why the other options are incorrect:

  /config/bigip.confstores BIG-IP configuration objects, not license metadata.

  /config/svc_chk_date.datis not a valid file in the licensing system; it does not contain license parameters.

  /config/BigDB.datstores internal database values, not licensing attributes.

  Thus, only the bigip.license file contains the correct licensing information required for verifying upgrade eligibility.

• Question 40:

  A BIG-IP Administrator upgrades the BIG-IP LTM to a newer software version. After the administrator reboots into the new volume, the configuration fails to load. Why is the configuration failing to load?

  A. The upgrade was performed on the standby unit.
  B. The license needed to be reactivated before the upgrade.
  C. A minimum of at least two reboots is required.
  D. Connectivity to the DNS server failed to be established.
  B. The license needed to be reactivated before the upgrade.

  ---

  When upgrading to a newer TMOS software version, BIG-IP validates whether the current license is permitted to run that version.

  This is controlled by the Service Check Date in the device's license file.

  If the Service Check Date is older than the minimum required for the target version:

  The system boots into the new volume ,

  But fails to load the configuration ,

  And will instead present messages indicating that the configuration cannot be applied due to aninvalid or outdated license.

  This is a well-known behavior:

  An outdated license, not reactivated before upgrade, causes configuration load failure after reboot into the new software.

  Why the other options are incorrect:

  A. Performed on the standby unit

  Upgrading a standby unit does not cause configuration load failure.

  Standby-only upgrades are standard best practice.

  C. Two reboots required

  BIG-IP does not require two reboots during an upgrade.

  One reboot into the new volume is sufficient.

  D. DNS connectivity failure

  DNS connectivity does not affect configuration loading.

  DNS is only needed for automatic license activation, not for applying config at boot.

  Thus, the configuration failed to load because the license was not reactivated before the upgrade , making Option B correct.