Latest [Oct 14, 2026] F5 F5CAB1 Exam Practice Test To Gain Brilliante Result
Take a Leap Forward in Your Career by Earning F5 F5CAB1
NEW QUESTION # 29
The Configuration Utility of a BIG-IP device is currently accessible via its management IP10.53.1.245from all VLANs.
The BIG-IP Administrator needs to restrict access so only hosts from the10.0.0.0/24subnet can access the Configuration Utility.
Which TMSH command accomplishes this?
- A. (tmos)# modify /sys httpd allow replace-all-with {10.0.0.0/24}
- B. (tmos)# create /net acl MGMT.HTTP rule add { (permit tcp 10.0.0.0/24 10.53.1.245 http) (deny ip any any http) }
- C. (tmos)# create /net acl MGMT.HTTP rule add { (permit tcp 10.0.0.0 0.0.0.255 host 10.53.1.245 http) }
- D. (tmos)# modify /ltm httpd allow replace-all-with {10.0.0.0/24}
Answer: A
Explanation:
BIG-IP controls access to the web-based Configuration Utility (TMUI) through the/sys httpd allowlist. This parameter specifies which client IPs or subnets may initiate HTTP/HTTPS connections to the management interface.
To restrict TMUI access toonlythe 10.0.0.0/24 subnet:
* The correct method is tomodify the HTTPD allow listso that it contains only this subnet.
* This requires replacing the entire current list with the new subnet using:
modify /sys httpd allow replace-all-with {10.0.0.0/24}
This ensures thatonlyclients within 10.0.0.0/24 can reach the Configuration Utility.
Why the other options are incorrect:
* Options A and Ccreate network ACL objects under /net acl, which apply to data-plane traffic, not management-plane TMUI access. TMUI access is not controlled by LTM ACLs but by the HTTPD allow directive.
* Option Bis incorrect syntax and references /ltm httpd, which is not the proper object; the correct hierarchy is /sys httpd.
Thus, only modifying the/sys httpd allowlist achieves the required restriction.
NEW QUESTION # 30
Which of the following should you do to enable SSL offloading on a BIG-IP system?
- A. Enable SSL through the System > Security settings
- B. Set up a VLAN for SSL offloading
- C. Configure an SSL profile and associate it with the virtual server
- D. Configure the SSL profile on the backend servers
Answer: C
Explanation:
To enable SSL offloading, you need to configure an SSL profile and link it to a virtual server to handle SSL termination.
NEW QUESTION # 31
When is theLicense Service Check Dateenforced on a BIG-IP system?
- A. During system startup
- B. During a software install
- C. After editing a virtual server
Answer: B
Explanation:
TheService Check Datedetermines whether a particular software version is allowed to run under the device's license.
* When installing or upgrading TMOS, the installer checks theService Check Datestored in the BIG-IP license file.
* If the license date isolderthan the minimum required for the target version, the software installation is blocked.
* This check happensspecifically during a software install, not during routine device operations.
Editing virtual servers or system startup do not trigger this validation.
Thus, the enforcement happensduring software installation.
NEW QUESTION # 32
How should the BIG-IP Administrator block connections to a Self IP on port 443 while allowing connections to other ports?
- A. In the Configuration Utility, select System > Platform > SSH Allow. Enter the IP addresses of the clients allowed to connect to the Self IPs.
- B. In the Configuration Utility, select Network > Self IPs. Select the Self IP in question, then select ' Disable ' .
- C. In the Configuration Utility, go to Network > Self IPs. Select the Self IP in question, then select ' Port Lockdown ' and ' Allow None ' .
- D. In the Configuration Utility, go to Network > Self IPs. Select the Self IP in question, then select ' Port Lockdown ' and ' Allow Custom ' . Enter in only the allowed ports to that Self IP address.
Answer: D
Explanation:
Comprehensive and Detailed Explanation From BIG-IP Administration - Install, Initial Configuration, and Upgrade:
BIG-IP Self IP addresses have an associated Port Lockdown feature that governs which protocols and services are permitted to communicate directly with that Self IP. By default, Self IPs may allow broader access than desired, making Port Lockdown a critical hardening control.
The Allow Custom option under Port Lockdown is the precise mechanism for administrators who need granular, port-specific filtering. When selected, only the explicitly listed TCP/UDP ports are permitted - all others, including port 443 (HTTPS), are implicitly denied. This satisfies the requirement of blocking 443 specifically while preserving access on other required ports.
The remaining options are incorrect for this scenario:
* Option A references SSH access control under System > Platform, which governs management-plane SSH - not Self IP service filtering.
* Option B disables the entire Self IP, removing all traffic handling, which is operationally disruptive.
* Option D - Allow None - blocks all traffic to the Self IP, not selectively port 443.
The Allow Custom approach provides the surgical precision required: administrators enumerate permitted ports, and everything outside that list - including 443 - is dropped.
Reference Topics: Self IP Port Lockdown, Network Security Hardening, Self IP Configuration - BIG-IP Administration Study Guide.
NEW QUESTION # 33
A new logging solution is being implemented on the network. Policy requires keeping management traffic sent from the BIG-IP out of the management interface. After configuring the BIG-IP to forward messages to the new Syslog server, the BIG-IP Administrator notices that packets are being sent from a numbered data-plane Self IP. What should the BIG-IP Administrator change to send the traffic out of the correct interface?
- A. Create a Management Route for the specific address/subnet of the syslog service via TMSH.
- B. Create a new Self IP in the same subnet as the management IP address using a route domain.
- C. Set the Management IP as the source address when configuring a Remote Syslog destination.
- D. Modify the port lockdown settings on the Self IP address to allow UDP port 514 traffic.
Answer: A
Explanation:
By default, management-plane traffic uses the management routing table, while data-plane traffic uses the TMM routing table.
Remote Syslog traffic is management-plane traffic unless a management route exists.
If no Management Route matches the Syslog server's destination IP, the BIG-IP will instead:
Use TMM routes, and
Source the packets from a Self IP
This is exactly what the administrator is observing.
To force Syslog traffic out the management port:
You must create a Management Route, which is configured using:
tmsh create /sys management-route <name> gateway <ip> network <syslog subnet> This sends syslog traffic:
Out of the management interface
Using the Management IP as the source
Thus, Option B is correct.
NEW QUESTION # 34
When using the tmsh shell of a BIG-IP system, which command will display the management-ip address?
- A. run /util bash ifconfig mgmt
- B. list /sys management-ip
- C. show /sys management-ip
Answer: B
Explanation:
Within the BIG-IP Traffic Management Shell (tmsh), system configuration objects--including the management IP--are organized under the /sys hierarchy. The management IP address is a configurable property stored in the system configuration and can be viewed using the tmsh list command, which displays configuration objects and their currently assigned values.
Why "list /sys management-ip" is correct
The list command in tmsh is used to display configured system values, not runtime statistics.
The object that holds the management IP settings on BIG-IP systems is located at:
/sys management-ip
Running the command:
list /sys management-ip
will reveal the settings for the management IP interface, including the address, netmask, and any associated attributes.
This is the standard method used during system setup and verification to confirm the management IP configuration.
This behavior aligns with BIG-IP administration procedures, where configuration information is retrieved using list, while operational data is retrieved using show.
NEW QUESTION # 35
What is required when setting up an HA (High Availability) pair of BIG-IP devices?
- A. Configuration of load balancing on both devices
- B. Same IP address on both devices
- C. Same hardware model and version of software
- D. Different software versions on each device
Answer: C
Explanation:
For HA to function correctly, both devices need to be running the same software version and have the same hardware model to ensure compatibility and synchronization.
NEW QUESTION # 36
The BIG-IP Administrator needs to update access to the Configuration Utility to include the172.28.31.0/24and
172.28.65.0/24networks.
From the TMOS Shell (tmsh), which command should the BIG-IP Administrator use to complete this task?
- A. modify /sys httpd allow add { 172.28.31.0/255.255.255.0 172.28.65.0/255.255.255.0 }
- B. modify /sys httpd permit add { 172.28.31.0/255.255.255.0 172.28.65.0/255.255.255.0 }
- C. modify /sys httpd allow add { 172.28.31.0 172.28.65.0 }
Answer: A
Explanation:
Access to the BIG-IP Configuration Utility (TMUI) is controlled through the/sys httpd allowlist.
This list defines which IP addresses or subnets are allowed to connect to the management web interface.
To allow two new subnets-172.28.31.0/24and172.28.65.0/24-the administrator mustaddboth subnets to the existing list without removing current entries.
In tmsh, subnet entries must be specified innetwork/netmask format, for example:
172.28.31.0/255.255.255.0
The correct tmsh command to append these networks is:
modify /sys httpd allow add { 172.28.31.0/255.255.255.0 172.28.65.0/255.255.255.0 } Why the other options are incorrect:
Option B:
* IPs are listed without masks, which is invalid for subnet-based access control.
* The system requiresnetwork/netmaskformat.
Option C:
* The command uses permit instead of allow, which is not a valid attribute of /sys httpd.
* The correct keyword must beallow.
Thus, onlyOption Acorrectly adds both permitted subnets in the proper tmsh format.
NEW QUESTION # 37
When logged into the bash shell of a BIG-IP system, which of the following commands will display the management-ip address? (Choose two.)
- A. tmsh list /sys management-ip
- B. ifconfig mgmt
- C. show mgmt ip
- D. list / sys management-ip
Answer: A,B
Explanation:
When logged into the bash shell of a BIG-IP system, there are two valid ways to view the management-ip address:
A). tmsh list /sys management-ip
Even from the bash shell, the administrator can enter a tmsh command by typing:
tmsh list /sys management-ip
This displays:
Management IP address
Netmask
Any configured management routes
This is the official tmsh method for viewing the management-ip configuration.
C). ifconfig mgmt
In the underlying Linux OS, the management interface maps to the mgmt interface.
Running:
ifconfig mgmt
displays:
Assigned management IP
Netmask
Link-level status
This is a valid Linux-level method used frequently for troubleshooting.
NEW QUESTION # 38
How can the BIG-IP Administrator tell when an unlicensed module has been provisioned?
- A. When provisioning an unlicensed module, a warning will appear.
- B. A Provisioning Warning will be displayed in the GUI in the upper left corner.
- C. A BIG-IP does not allow unlicensed modules to be provisioned.
Answer: B
Explanation:
The BIG-IP system has built-in licensing enforcement.
If an administrator provisions a module that the device is not licensed to run, the system will still allow the provisioning action to occur initially, but the system detects the mismatch and displays an alert.
What actually happens:
The GUI places a warning banner in the upper-left corner labeled something similar to:
"Provisioning Warning"
This appears immediately after provisioning a module that is not included in the active license.
The system remains in an "inconsistent state" until the module is disabled again or the license is updated.
This is the visual cue BIG-IP uses to indicate that a module was provisioned without valid licensing.
NEW QUESTION # 39
Which port is an exception to the Port Lockdown function of Self-IPs if a device-group synchronization cluster is configured?
- A. TCP 4353
- B. TCP 443
- C. UDP 53
Answer: A
Explanation:
Self-IPs implement a security feature known asPort Lockdown, which limits which services are reachable on a Self-IP.
However, certain services required for BIG-IP device-to-device communication bypass Port Lockdown to ensure cluster and HA functionality.
TCP 4353
* TCP port4353is used byDevice Service Clustering (DSC)for:
* Device trust establishment
* Configuration synchronization
* Failover communication
* Because BIG-IP devices must always be able to communicate for HA functions to remain operational, port 4353 isexempt from Port Lockdown rules.
Why the other options are incorrect
A). TCP 443
* Not required for device trust or synchronization.
* HTTPS access is fully controlled by Port Lockdown.
C). UDP 53
* DNS traffic is not required for synchronization and has no exemption under Port Lockdown.
NEW QUESTION # 40
The BIG-IP Administrator uses Secure Copy Protocol (SCP) to upload a TMOS image to the
/shared/images/ directory in preparation for a TMOS upgrade.
After the upload is completed, what will the system do before the image is shown in the GUI under:
System > Software Management > Image List?
- A. The system verifies the internal checksum
- B. The system copies the image to /var/local/images/
- C. The system performs a reboot into a new partition
Answer: A
Explanation:
When a TMOS image (.iso file) is uploaded into the /shared/images/ directory, the BIG-IP performs an internal validation step before the ISO appears in the GUI.
1. The system verifies the internal checksum
BIG-IP automatically reads the embedded checksum inside the ISO file
Verifies integrity of the uploaded image
Confirms the file is not corrupted or incomplete
Ensures the image is a valid F5 TMOS software image
Only after this checksum verification succeeds does the image appear under:
System -> Software Management -> Image List
NEW QUESTION # 41
The monitoring team reports that the SNMP server is unable to poll data from a BIG-IP device.
What information will help the BIG-IP Administrator determine whether the issue originates from the BIG-IP system?
- A. The "Port Lockdown" setting is preventing the SNMP server from polling data from the BIG-IP.
- B. The "VLAN / Tunnel" setting must allow All Vlans.
- C. The "Traffic Group" setting must use a floating Traffic Group.
- D. The configuration on the exhibit is correct and other options should be explored.
Answer: A
Explanation:
The exhibit shows a Self IP with:
VLAN: Data
Port Lockdown: Allow None
Impact of "Allow None" on SNMP
When a Self IP is configured with:
Port Lockdown: Allow None
the BIG-IP blocks all services and ports except a few hardcoded HA communication ports.
This means:
UDP/161 (SNMP) is blocked
UDP/162 (SNMP traps) is blocked
The SNMP server cannot poll or receive data from the BIG-IP through this Self IP SNMP relies on access through the Self IP if out-of-band (mgmt interface) is not used.
Thus, the issue is directly caused by Port Lockdown = Allow None, which prevents SNMP communication.
NEW QUESTION # 42
The BIG-IP Administrator uses Secure Copy Protocol (SCP) to upload a TMOS image to the /shared/images/ directory in preparation for an upgrade.
After the upload is complete, what will the system do before the image appears in the GUI under:
System > Software Management > Image List ?
- A. The system verifies the internal checksum
- B. The system copies the image to /var/local/images/
- C. The system performs a reboot into the new partition
Answer: A
Explanation:
When a TMOS ISO file is transferred to /shared/images/ , the BIG-IP automatically performs a validation step:
Checksum Verification
* Before the image becomes visible in the GUI, the system verifies the internal checksum embedded inside the ISO.
* This ensures:
* The file was fully transferred
* The image is not corrupted
* It matches the official F5 release signature
* Only after passing this verification does the GUI display the ISO under "Available Images." Why the other options are incorrect:
A). Reboot into a new partition
* No reboot occurs simply from uploading an image.
C). Copying into /var/local/images/
* This directory is not used for ISO storage.
* All valid images remain in /shared/images/ .
Thus, the correct system action is checksum verification .
NEW QUESTION # 43
A BIG-IP Administrator is using Secure Copy Protocol (SCP) to transfer a TMOS image to the BIG-IP system in preparation for an upgrade. To what directory should the file be transferred?
- A. /var/images/
- B. /shared/images/
- C. /local/images/
Answer: B
Explanation:
BIG-IP systems require all ISO images (base TMOS images and HotFix images) to be stored in a specific directory used for software installation:
/shared/images/
This directory:
Is the only supported location from which the BIG-IP software installation system validates and installs ISO files Is accessible by both the GUI and TMSH installers Has adequate storage space allocated specifically for images Is part of the shared partition that persists across reboots When transferring images via SCP, the administrator must copy them directly into
/shared/images/ so that:
The GUI (System Software Management Available Images) can detect the image TMSH install software image commands can reference it Other directories such as /local/images/ or /var/images/ are not valid storage paths for software images.
NEW QUESTION # 44
An F5 BIG-IP Administrator is asked to report which modules are provisioned on the BIG-IP. In which two ways can this be done? (Choose two.)
- A. Via the GUI at Statistics -> Module Statistics -> System
- B. Via the GUI at System -> Resource Provisioning -> Module Allocation
- C. Via TMSH with show /sys provision
- D. Via TMSH with list /sys provision
Answer: B,D
Explanation:
Provisioning determines:
Which BIG-IP modules are enabled (LTM, ASM, APM, AFM, DNS, etc.)
Their provisioning levels (None, Minimal, Nominal, Dedicated)
Two accurate ways to view provisioning settings are:
A). GUI -- System -> Resource Provisioning -> Module Allocation
This is the primary GUI screen showing:
All modules
Their provisioning level
System resource distribution impact
Administrators commonly use this page to confirm or change module provisioning.
D). TMSH -- list /sys provision
This tmsh command displays each module and its provisioning level:
sys provision ltm { level nominal }
sys provision asm { level none }
...
This is the authoritative CLI method for checking module provisioning configurations.
NEW QUESTION # 45
For security reasons, a BIG-IP Administrator needs to specify allowable IP ranges for access to the Configuration Utility (WebUI).
The exhibit shows the User Administration section of the Configuration Utility.
The administrator could not find any setting that explicitly restricts access to the Configuration Utility.
Which one of the following is a reason for that?
- A. The administrator must restrict access by IP address for SSH, which will implicitly restrict access to the Configuration Utility
- B. The administrator needs to switch to the "Advanced" view mode in order to display the relevant setting
- C. To avoid locking out the administrator, recent versions of BIG-IP no longer allow restricting administrator access to the Configuration Utility by source IP address
- D. Restricting access to the Configuration Utility can only be done from the Command Line Interface
Answer: D
Explanation:
The screenshot shown is from theUser Administrationsection of the BIG-IP GUI.
This section controls:
* Root and Admin passwords
* SSH Access
* SSH IP Allow settings
However,it does not contain any controls for restricting access to the WebUI (TMUI).
BIG-IP does not provide TMUI access restrictions from this part of the GUI.
Access to the web-based Configuration Utility is controlled by thehttpd allow list, configured through TMSH:
tmsh modify /sys httpd allow { <IP/subnet> }
This setting is not displayed in the User Administration panel, and in many BIG-IP versions, the httpd allow list isonly configurable from the CLI, not the GUI.
Therefore, the administrator cannot find the setting in the screen shown because:
* TMUI access restriction isnotlocated in this GUI section
* It must be configured usingtmshunder/sys httpd allow
This is whyOption Ais correct.
NEW QUESTION # 46
......
F5 F5CAB1 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
Authentic Best resources for F5CAB1 Online Practice Exam: https://www.examcost.com/F5CAB1-practice-exam.html
Updates Up to 365 days On Developing F5CAB1 Braindumps: https://drive.google.com/open?id=1LI931YhacQTnV6b8VfhpAlJy7S_v_JjD
