F5 Networks BIG-IP Administration Install, Initial Configuration, and Upgrade F5CAB1 Exam Questions

Page: 1 / 14
Total 49 questions
Question 1

modification]

The Service Check Date on the license matches the date that the BIG-IP was installed two years ago. Which of the following activities would require the BIG-IP Administrator to renew the license and update the Service Check Date for it to work?



Answer : B

Comprehensive and Detailed Explanation From BIG-IP Administration --- Install, Initial Configuration, and Upgrade:

The Service Check Date embedded in the BIG-IP license acts as a gating mechanism that determines eligibility for software updates. F5 enforces that the Service Check Date must be equal to or newer than the software release date of any BIG-IP version being installed. If the installed license carries a Service Check Date from two years ago, attempting to upgrade to a newly released BIG-IP software version --- whose release date post-dates that Service Check Date --- will fail, as the system validates this date during the upgrade process.

Option A is incorrect --- generating and uploading a QkView to F5 iHealth is a diagnostic activity that requires no license validation or Service Check Date verification whatsoever.

Option C is incorrect --- ASM signature and threat campaign updates are content updates, not platform software upgrades. These updates are independent of the Service Check Date requirement and do not trigger license validation checks during installation.

Only a platform software upgrade to a newly released BIG-IP version directly invokes the Service Check Date validation, mandating license renewal prior to the upgrade proceeding successfully.

Reference Topics: License Service Check Date, Software Upgrade Prerequisites, License Reactivation --- BIG-IP Administration Study Guide.


Question 2

A BIG-IP Administrator needs to purchase new licenses for a BIG-IP appliance.

The administrator needs to know:

Whether a module is licensed

The memory requirement for that module

Where should the administrator view this information in the System menu?



Answer : D

To understand:

Which modules are licensed

Which modules are provisioned

The resource requirements (CPU / RAM) of each module

The administrator uses:

System Resource Provisioning

This page displays:

All modules present in the license

Whether they are enabled or disabled

Required memory to activate each module

CPU and disk allocation information

Provisioning level options (None / Minimal / Nominal / Dedicated)

This is the exact location where BIG-IP administrators evaluate module capacity before enabling or purchasing licensing upgrades.

Why the other options are incorrect:

A . Configuration OVSDB

Used for network virtualization integrations, not licenses or modules.

B . Software Management

Used for software image installation, not licensing.

C . Configuration Device

Displays hostname, failover settings, device properties --- not module resource requirements.

Thus, module licensing and memory requirement data are found under Resource Provisioning.


Question 3

A BIG-IP Administrator discovers malicious brute-force attempts to access the BIG-IP device on the management interface via SSH.

The administrator needs to restrict SSH access to the management interface.

Where should this be accomplished?



Answer : C

The BIG-IP management interface (MGMT port) is controlled through System settings, not through the Network menu.

SSH access on the management interface is configured here:

System Configuration Device General SSH Access / SSH IP Allow

This section allows the administrator to:

Enable or disable SSH service

Restrict SSH access to specific IP addresses or subnets

Apply security policies to the management interface

Why the other options are incorrect:

A . Network > Interfaces

Used for data-plane physical interface settings, not management plane SSH restrictions.

B . Network > Self IPs

Controls in-band management or data-plane access, not the dedicated management port.

D . System > Platform

Used for hostname, time zone, LCD contrast, hardware settings --- not SSH security on the management port.

Therefore, restricting SSH access to the management interface must be done under:

System Configuration Device General

Which corresponds to Option C.


Question 4

An F5 VE has been deployed into a VMware environment via an OVF file.

An administrator wants to configure the management IP address so the VE can be accessed for further setup.

Which two are valid methods for configuring the management-ip address? (Choose two.)



Answer : A, B

A newly deployed BIG-IP Virtual Edition (VE) in VMware requires initial configuration of its management-ip address so it can be accessed over the network. F5 provides several valid mechanisms during initial console access:

A . Running the config utility

The config script is available on new BIG-IP installations and VE deployments.

It launches a guided text-based wizard allowing configuration of:

Management IP

Netmask

Default route

This is a standard and recommended method during first-time setup.

B . Using TMSH with create sys management-ip

Administrators can enter TMSH directly from the console and run:

create sys management-ip <ip>/<mask>

The management-ip object resides under sys, not under ltm or any other module.

This is the correct tmsh method for defining the management interface address.

Why the other options are incorrect:

C . create ltm management-ip

There is no such object under /ltm.

LTM handles traffic objects (virtual servers, pools), not system management interfaces.

D . Running the setup command

The setup command is used for general system configuration but does not configure the management-ip.

It is not the supported method for initial management IP assignment on VE deployments.

Therefore, the valid methods are running the config utility and using the sys management-ip command within TMSH.


Question 5

How should the BIG-IP Administrator block connections to a Self IP on port 443 while allowing connections to other ports?



Answer : C

Comprehensive and Detailed Explanation From BIG-IP Administration --- Install, Initial Configuration, and Upgrade:

BIG-IP Self IP addresses have an associated Port Lockdown feature that governs which protocols and services are permitted to communicate directly with that Self IP. By default, Self IPs may allow broader access than desired, making Port Lockdown a critical hardening control.

The Allow Custom option under Port Lockdown is the precise mechanism for administrators who need granular, port-specific filtering. When selected, only the explicitly listed TCP/UDP ports are permitted --- all others, including port 443 (HTTPS), are implicitly denied. This satisfies the requirement of blocking 443 specifically while preserving access on other required ports.

The remaining options are incorrect for this scenario:

Option A references SSH access control under System Platform, which governs management-plane SSH --- not Self IP service filtering.

Option B disables the entire Self IP, removing all traffic handling, which is operationally disruptive.

Option D --- Allow None --- blocks all traffic to the Self IP, not selectively port 443.

The Allow Custom approach provides the surgical precision required: administrators enumerate permitted ports, and everything outside that list --- including 443 --- is dropped.

Reference Topics: Self IP Port Lockdown, Network Security Hardening, Self IP Configuration --- BIG-IP Administration Study Guide.


Question 6

A BIG-IP Administrator needs to install a HotFix on a standalone BIG-IP device.

The device currently has HD1.1 as the Active Boot Location.

The administrator has already reactivated the license and created a UCS archive.

In which sequence should the administrator perform the remaining steps?



Answer : C

When installing a software upgrade with a HotFix on BIG-IP, the correct workflow requires:

Install the base TMOS image on an unused boot volume

Install the corresponding HotFix onto that same boot volume

Activate the updated boot volume to boot into the new software

This method ensures:

The existing active system (HD1.1) is untouched

The upgrade occurs in a new, clean volume (HD1.2)

The HotFix applies properly to the same base image

The administrator can revert to HD1.1 if issues occur

Option C matches the correct F5 upgrade sequence:

1. Install base image on HD1.2

2. Install HotFix on HD1.2

3. Activate HD1.2

Why the other options are incorrect:

A . Install HotFix before base image

HotFixes must be applied after the base image; not valid.

B . Installing a HotFix on the active boot location (HD1.1)

Not recommended and does not use a clean new volume.

Also does not involve installing the base image.

D . Activating HD1.2 before installing anything

Cannot activate an empty or invalid boot volume.

Thus, Option C is the correct sequence.


Question 7

A BIG-IP device will be dedicated to functioning as a WAF, requiring only the ASM module to be provisioned.

What provisioning level will ensure that the system allocates all CPU, memory, and disk resources to this module exclusively?



Answer : A

Provisioning defines how BIG-IP allocates system resources to modules. The provisioning levels include:

Dedicated -- allocates all CPU, memory, and disk resources to a single module

Nominal -- standard resource allocation balanced with other modules

Minimal -- lowest level, used for basic utility needs

None -- module disabled

Comprehensive / Maximal -- not valid TMOS provisioning levels

Why ''Dedicated'' is correct

When a BIG-IP device is intended to run only ASM (Web Application Firewall), the recommended way to maximize performance is to provision the module at Dedicated level.

With ASM: Dedicated:

ASM receives the entire hardware capacity

No other modules can or should be provisioned

This is explicitly recommended when a device is used solely as a WAF platform

Why other options are incorrect

B . Comprehensive / C. Maximal

These are not valid provisioning modes in BIG-IP.

TMOS supports: Nominal, Minimal, Large (module-specific), and Dedicated.

D . Nominal

Shares resources with other modules

Does not provide full system performance

Not suitable when exclusive resource allocation is required

Thus, Dedicated is the correct provisioning choice.


Page:    1 / 14   
Total 49 questions