Free F5CAB1 Exam Dumps Preview

BIG-IP provisioning determines how CPU, memory, and disk resources are allocated to each module. The goal is to provision only the modules required and at levels appropriate to their performance needs.

Requirements in the question

The device will be used for:

LTM(Local Traffic Manager) # load balancing

ASM(Application Security Manager) # WAF
No functions require:

APM (Access Policy Manager)

AFM (Advanced Firewall Manager)

Why Option C is correct

Provisioning both LTM and ASM Nominal at level provides:

Adequate performance for production load

Plentiful system resources while avoiding dedicating the entire system to a single module

Balanced allocation without starving memory or CPU

Setting APM: None and AFM: None ensures unused modules consume zero resources.

Why the other options are incorrect

A. Dedicated provisioning for both LTM and ASM

Two modules cannot both run in "Dedicated" mode.

Dedicated mode allocates all resources to a single module -- the second module cannot be dedicated simultaneously.

B. LTM and ASM both Dedicated

Same issue: only one module can be Dedicated at a time.

Also unnecessary for load balancing + WAF.

D. Setting APM and AFM to Minimal

Minimal still consumes memory and CPU.

Unused modules should be set to None .

Therefore, Option C is the best provisioning strategy.

The HTTPD allow list controls which IP addresses or subnets may access the Configuration Utility (TMUI) on the BIG-IP system. The Administrator already has two subnets allowed and needs to add a single host IP to the existing list.

The object /sys httpd allow supports actions such as add delete , , and replace-all-with . Because the goal is to add one more entry without removing the existing permitted subnets, the correct command is:

modify /sys httpd allow add { 172.28.32.22 }

This appends the new host to the existing list while preserving the previously configured networks.

Why the other options are incorrect:

Option A (replace-all-with)would overwrite the entire allow list, removing existing permitted subnets-- unacceptable.

Option B (delete)would remove the existing networks and not add the required host.

Therefore, the correct administrative action is to add the jump host's IP.

To identify which boot volume is currently active on a BIG-IP system, the correct command is:
tmsh show sys software status

This command displays:

All installed boot volumes (HD1.1, HD1.2, HD1.3, etc.)

The BIG-IP software version installed on each volume

The Active field, indicating which volume the system is currently booted from The installation status ("complete", "in-progress", "allowed")

This is the standard and authoritative way to determine the active boot location.

Why the other options are incorrect:

A. tmsh show sys version

Displays OS version, build, and date.

Does not show boot locations or which volume is active.

C. tmsh list sys software update

Shows software update configurations, not boot volume status.

Does not display which volume is active.

By default, management-plane traffic uses the management routing table , while data-plane traffic uses the
TMM routing table .

Remote Syslog traffic is management-plane traffic unless a management route exists.

If no Management Route matches the Syslog server's destination IP, the BIG-IP will instead:

Use TMM routes , and Source the packets from aSelf IP

This is exactly what the administrator is observing.

To force Syslog traffic out the management port:

You must create a Management Route , which is configured using:

tmsh create /sys management-route <name> gateway <ip> network <syslog subnet> This sends syslog
traffic:

Out of themanagement interface

Using the Management IP as the source

Thus, Option B is correct.

Why the other options are incorrect:

A. Set the Management IP as the source address

Source address selection is overridden by routing.

Without a management route, traffic still goes out the data plane.

C. Create a new Self IP using a route domain

Unnecessary and not related to management-plane routing.

Syslog traffic should not rely on data-plane Self IPs.

D. Modify port lockdown on Self IP to allow UDP/514

This would allow Syslog traffic into the BIG-IP over a Self IP, not force outbound traffic via management.

When installing a BIG-IP software version with a HotFix on a new boot volume , F5 requires that both the base TMOS image and the HotFix image be installed together as part of the same installation workflow.

The correct process is:

Specify thebase TMOS ISO

Specify the HotFix ISO that corresponds to that base version

Instruct the system tocreate a new boot volume

Install both images into that new volume

This is achieved with the following tmsh syntax:

tmsh install /sys software BIGIP-<version>.iso hotfix Hotfix-BIGIP-<version>-ENG.iso create-volume
HD1.2

This command:

Installs the base image first

Applies the HotFix on top of the base image

Creates and installs everything onHD1.2

Leaves the currently active volume untouched for rollback

Why the other options are incorrect

A. Installing only the hotfix

A HotFix cannot be installed by itself on a new volume. A base image must already be present.

C. Using create instead of install

The create keyword is not valid for software installation operations.

D. Using copy

The copy command does not install software images or hotfixes.

Module provisioning controls how system resources are allocated.

Setting a module to:

None disables the module entirely and ensures it consumes zero CPU, memory, or disk resources.
Minimal and Nominal still allocate resources, and Dedicated allocates all resources to a single module, which is not appropriate for unused modules.

When installing a software upgrade with a HotFix on BIG-IP, the correct workflow requires:

Install the base TMOS imageon an unused boot volume

Install the corresponding HotFixonto that same boot volume

Activate the updated boot volumeto boot into the new software

This method ensures:

The existing active system (HD1.1) is untouched

The upgrade occurs in a new, clean volume (HD1.2)

The HotFix applies properly to the same base image

The administrator can revert to HD1.1 if issues occur

Option matches the correct F5 upgrade sequence: C

1. Install base image on HD1.2

2. Install HotFix on HD1.2

3. Activate HD1.2

Why the other options are incorrect:

A. Install HotFix before base image

HotFixes must be applied after the base image; not valid.

B. Installing a HotFix on the active boot location (HD1.1)

Not recommended and does not use a clean new volume.

Also does not involve installing the base image.

D. Activating HD1.2 before installing anything

Cannot activate an empty or invalid boot volume.

Thus, Option C is the correct sequence.

The exhibit shows the Current Resource Allocation for:

CPU

Disk

Memory

In particular, the Memory Allocation bar displays the modules that are currently provisioned.

Memory is the most reliable indicator because BIG-IP allocates memory only to modules that are actively provisioned.

From the exhibit:

MGMT(Management) always present

TMM(Traffic Management Microkernel) indicatesLTM is provisioned

GTM this label indicates that the DNS module is provisioned (GTM = Global Traffic Manager, now called
DNS)

APM explicitly shown, indicating Access Policy Manager is provisioned

Therefore, the provisioned modules are:

LTM(implied by TMM allocation)

DNS/GTM

APM

This matches Option C: LTM, DNS, APM .

The Service Check Date determines whether a particular software version is allowed to run under the device's license.

When installing or upgrading TMOS, the installer checks the Service Check Date stored in the BIG-IP license file.

If the license date is older than the minimum required for the target version, the software installation is blocked .

This check happens specifically during a software install , not during routine device operations.

Editing virtual servers or system startup do not trigger this validation.

Thus, the enforcement happens during software installation .