F5 F5CAB1 Online Practice Questions and Exam Preparation

F5 F5CAB1 Online Questions & Answers

• Question 41:

  A BIG-IP Administrator is using Secure Copy Protocol (SCP) to transfer a TMOS image to the BIG-IP system in preparation for an upgrade. To what directory should the file be transferred?

  A. /shared/images/
  B. /local/images/
  C. /var/images/
  A. /shared/images/

  ---

  BIG-IP systems require all ISO images (base TMOS images and HotFix images) to be stored in a specific directory used for software installation: /shared/images/ This directory: Is the only supported location from which the BIG-IP software installation system validates and installs ISO files Is accessible by both the GUI and TMSH installers Has adequate storage space allocated specifically for images Is part of the shared partition that persists across reboots When transferring images via SCP, the administrator must copy them directly into /shared/images/ so that: The GUI (System # Software Management # Available Images) can detect the image TMSH install software image commands can reference it Other directories such as /local/images/ /var/images/ or are not valid storage paths for software images.

• Question 42:

  What command will allow the BIG-IP Administrator to view the configured management IP of a BIG-IP system? (Choose one.)

  A. tmsh show sys management-ip
  B. tmsh list sys management-ip
  C. tmsh list sys management-route
  D. tmsh list net self
  B. tmsh list sys management-ip

  ---

  Comprehensive and Detailed(Paraphrased)

  The BIG-IP stores the configured management IP address as a system configuration object under the /sys hierarchy.

  To display configured (persistent) values, BIG-IP uses the tmsh list command , not show.

  Why tmsh list sys management-ip is correct

  The management IP configuration is defined under:

  /sys management-ip

  Running:

  tmsh list sys management-ip

  displays:

  The configured management IP address

  Netmask

  Associated attributes This command shows the actual configured management IP , which is what the question asks for. Why the other options are incorrect

  A. tmsh show sys management-ip

  The show command is used for runtime statistics and status.

  management-ip is a configuration object, not a statistics object.

  C. tmsh list sys management-route

  Displays management routing information, not the management IP address itself.

  D. tmsh list net self

  Displays Self IPs used on the data plane.

  Does not show the management interface IP.

• Question 43:

  A BIG-IP Administrator uploads a TMOS ISO image to the /shared/images directory using SCP. The image does not immediately appear in the GUI under Available Images. What process must complete before the image becomes visible?

  A. Device reboot
  B. License verification
  C. Checksum validation
  D. Disk expansion
  C. Checksum validation

  ---

  When a TMOS image is uploaded to /shared/images, the BIG-IP system automatically verifies the internal checksum embedded in the ISO file. This validation ensures that:

  1.

  The file transfer completed successfully

  2.

  The image is not corrupted

  Only after checksum verification succeeds does the image appear in the GUI. No reboot, license check, or disk operation is required at this stage.

• Question 44:

  An administrator wants to ensure that only hosts from a trusted subnet can access the BIG-IP Configuration Utility (TMUI). Which object controls this access on the BIG-IP system?

  A. /net self allow
  B. /sys httpd allow
  C. /sys sshd allow
  D. /net route-domain
  B. /sys httpd allow

  ---

  Access to the BIG-IP Configuration Utility (TMUI) is controlled by the HTTP daemon configuration.

  The object:

  /sys httpd allow defines which IP addresses or subnets are permitted to connect to the management web interface over HTTPS. SSH access is controlled separately under /sys sshd allow, and Self IP or routing objects do not govern TMUI access.

• Question 45:

  The BIG-IP Administrator wants to manage the newly built F5 system through an in-band Self-IP .

  The administrator has configured a VLAN and Self-IP and can ping the IP from their workstation, but cannot access the system via SSH HTTPS or.

  What port lockdown settings should the BIG-IP Administrator use to allow management access on the Self- IP? (Choose two.)

  A. The Self-IP port lockdown behavior could be adjusted toAllow Default
  B. The Self-IP port lockdown behavior could be adjusted toAllow All
  C. The Self-IP port lockdown behavior could be adjusted toAllow Mgmt
  D. The Self-IP port lockdown behavior could be adjusted toAllow Management
  C. The Self-IP port lockdown behavior could be adjusted toAllow Mgmt
  D. The Self-IP port lockdown behavior could be adjusted toAllow Management

  ---

  Self-IPs include a security feature called Port Lockdown , which restricts which services respond on that Self- IP.

  By default, Self-IPs block management access (SSH and HTTPS/TMUI), meaning an administrator cannot manage the device through in-band Self-IPs unless explicitly allowed.

  Allow Mgmt / Allow Management

  These settings enable only the management services required for administrative access, specifically:

  SSH (22)

  HTTPS/TMUI (443)

  These options allow secure administration without opening unnecessary ports.

  Why these are correct:

  They provide only the essential access for management.

  They follow F5 security best practices when using in-band admin access.

  They do not expose all services, reducing the attack surface.

  Why the other options are incorrect:

  A. Allow Default

  This allows only a minimal set of system-required ports (e.g., failover, config sync), not SSH or HTTPS.

  Administrator access would still fail.

  B. Allow All

  Opens all ports on the Self-IP, which is not secure .

  Exposes services that should remain restricted.

  Therefore, Allow Mgmt / Allow Management are the correct choices.

• Question 46:

  Which command will display the current active volume on a BIG-IP system?

  A. tmsh show sys version
  B. tmsh show sys software status
  C. tmsh list sys software update
  B. tmsh show sys software status

  ---

  To identify which boot volume is currently active on a BIG-IP system, the correct command is:

  tmsh show sys software status

  This command displays:

  All installed boot volumes (HD1.1, HD1.2, HD1.3, etc.)

  The BIG-IP software version installed on each volume

  The Active field, indicating which volume the system is currently booted from

  The installation status ("complete", "in-progress", "allowed")

  This is the standard and authoritative way to determine the active boot location.

  Why the other options are incorrect:

  A. tmsh show sys version

  Displays OS version, build, and date.

  Does not show boot locations or which volume is active.

  C. tmsh list sys software update

  Shows software update configurations, not boot volume status.

  Does not display which volume is active.

• Question 47:

  A BIG-IP system shows a solid yellow status LED on the chassis. What does this indicate?

  A. The system is powered off
  B. A critical hardware failure has occurred
  C. A warning-level condition is present
  D. The device is in standby mode
  C. A warning-level condition is present

  ---

  BIG-IP hardware status LEDs provide visual indicators of system health. A solid yellow status LED indicates a warning-level alarm, meaning the system is operational but has detected a non-critical issue that requires attention. Standby status and power conditions are not represented by this LED state, and critical failures use different indicators.

• Question 48:

  Refer to the exhibit.

  

  An organization has purchased a BIG-IP license that includes all available modules but has chosen to provision only the modules they require.

  The exhibit displays the current resource allocation from the System # Resource Provisioning page. Based on the information provided, which F5 modules have been provisioned?

  A. LTM, APM
  B. DNS, APM
  C. LTM, DNS, APM
  D. TMM, DNS, APS
  C. LTM, DNS, APM

  ---

  The exhibit shows the Current Resource Allocation for: CPU Disk Memory

  In particular, the Memory Allocation bar displays the modules that are currently provisioned.

  Memory is the most reliable indicator because BIG-IP allocates memory only to modules that are actively provisioned.

  From the exhibit:

  MGMT(Management) always present

  TMM(Traffic Management Microkernel) indicatesLTM is provisioned

  GTM this label indicates that the DNS module is provisioned (GTM = Global Traffic Manager, now called DNS)

  APM explicitly shown, indicating Access Policy Manager is provisioned

  Therefore, the provisioned modules are:

  LTM(implied by TMM allocation)

  DNS/GTM

  APM

  This matches Option C: LTM, DNS, APM .

• Question 49:

  How should a BIG-IP Administrator check the provisioned CPU percent for a module? (Choose two.)

  A. By running the top command and reviewing the output for the provisioned module.
  B. By running tmsh show /sys cpu and reviewing the specific module provisioned output.
  C. By going to System ?Resource Provisioning and hovering over the CPU section colors.
  D. By running tmsh show /sys provision and reviewing the specific module in the output.
  E. By checking the Dashboard output in the Statistics tab in the GUI.
  C. By going to System ?Resource Provisioning and hovering over the CPU section colors.
  D. By running tmsh show /sys provision and reviewing the specific module in the output.

  ---

  BIG-IP allocates CPU and memory resources based on module provisioning levels.

  To view how much CPU a module is assigned, administrators must check provisioning information from:

  C. GUI -- System ?Resource Provisioning

  This page visually displays CPU allocation via color-coded bars.

  Hovering over the CPU bar shows:

  CPU usage percent per module

  Which modules share CPU cycles

  The system's total resource allocation

  This is the primary GUI method.

  D. tmsh show /sys provision

  This command displays detailed module provisioning information including:

  Provisioned modules

  Their provisioning level

  CPU and memory allocation data

  It is the authoritative CLI method for resource provisioning status.

  Why the other options are incorrect:

  A. top

  Shows real-time process usage, not provisioned CPU allocation.

  B. tmsh show /sys cpu

  Displays CPU runtime utilization, not per-module provisioning.

  E. Statistics Dashboard

  Only shows traffic / system runtime metrics, not provisioning resource allocations.

  Therefore, C and D are correct.

• Question 50:

  What will setting a Self IP to "Allow None" for Port Lockdown do?

  A. Block HA communications, causing the systems to report their peer as offline and go active-active.
  B. Block HA communications, causing the systems to report their peer as online ready.
  C. Default allow port 1026 access between peer devices and traffic processing across the network failover.
  A. Block HA communications, causing the systems to report their peer as offline and go active-active.

  ---

  The Port Lockdown feature controls which services a Self-IP will respond to.

  Setting a Self-IP to Allow None means:

  The Self-IP will not accept any traffic except the very limited, hard-coded HA ports such as TCP 4353 used for device trust and configuration sync.

  All other HA ports, including those needed for network failover and other HA mechanisms,are blocked .

  When essential HA services cannot communicate, each device assumes its peer is down.

  This results in:

  HA failover misbehavior

  Both devices thinking the other is offline

  Potential active-active condition , which is not intended and can cause traffic disruption

  Thus, Allow None can break HA functionality unless the Self-IP is not used for HA links.