F5CAB1 Practice Exam 2 — 20 Questions

Question 1

After a fresh installation of BIG-IP, which task is considered a 'Day 0' security hardening requirement?

Accepted Answer

Change default administrative passwords.. Changing default passwords for the root and admin accounts is the most fundamental security step. F5 appliances come with well-known default credentials; leaving these unchanged allows anyone with network access to gain administrative control. This is the first action an administrator should take to secure the management plane and prevent unauthorized access before any other network configuration or traffic management policies are implemented.

Answer

Configure an NTP server.

Answer

Enable the 'bigdb' security variable.

Answer

Assign a management VLAN ID.

Question 2

An administrator needs to deploy a new BIG-IP physical appliance and perform the initial network configuration. Which interface is specifically dedicated out-of-band for initial management access and configuration tasks?

Accepted Answer

The dedicated management network port labeled MGMT.. The Management port on a BIG-IP physical appliance is an out-of-band network interface isolated from the traffic management microkernel. It is explicitly designed for administrative access via SSH, HTTPS, and the Configuration utility, ensuring that management traffic does not interfere with client-facing application data flows.

Answer

The serial console port using a rollover cable and terminal emulation software.

Answer

The first high-speed data port configured as part of the default internal VLAN.

Answer

The high-availability serial failover cable connection between the redundant appliances.

Question 3

An administrator is upgrading a BIG-IP from v13.1.1 to v16.1.0. During the upgrade, the administrator receives an error that the disk space is insufficient to install the new image. The administrator checks and finds that the `/var` partition is nearly full. What is the most appropriate action to resolve this issue?

Accepted Answer

Delete old UCS backup files and logs from `/var` to free up space.. Freeing up space on the `/var` partition by deleting old UCS backups and logs is the correct action. This safely reclaims space needed for the new image. Other options involve invalid commands, incorrect installation locations, or deleting critical system files. The administrator should also ensure that other partitions have sufficient space.

Answer

Resize the `/var` partition using the `tmsh modify sys disk` command.

Answer

Install the new image to the `/shared` partition instead of the inactive volume.

Answer

Use the `tmsh delete sys software image` command to remove the current active image and free space.

Question 4

When configuring a new BIG-IP VE, which TWO network settings are required to ensure the device can communicate with external licensing servers?

Accepted Answer

A valid default gateway in the management network.. Network connectivity is the prerequisite for all licensing. BIG-IP Virtual Editions must reach the F5 activation servers to validate their registration keys. Without correct routing and DNS, the license state will remain 'unlicensed', preventing the activation of any modules. This is a common failure point for new VE deployments, and mastering these requirements is essential for ensuring a smooth, successful provisioning of virtual infrastructure.

Answer

A static IP address on the data plane.

Answer

An SNMP community string.

Answer

A secondary management interface.

Question 5

An administrator is performing an initial setup on a newly deployed BIG-IP VE appliance in a cloud environment. After accessing the Configuration utility, the administrator needs to license the system using a registration key. Which workflow must be completed to successfully provision and license the device?

Accepted Answer

Submit the registration key to generate a dossier, activate it online or offline to retrieve the license, install the license, and then provision modules.. Licensing a BIG-IP VE requires the registration key to be submitted to the F5 activation server either directly through the system or via a dossier. This generates a valid license file containing the feature modules, which must be installed before provisioning resources. Provisioning allocates CPU and memory based on the licensed modules, ensuring the appliance operates stably within cloud capacity constraints.

Answer

Provision the desired modules first, upload the raw license text file, and then reboot the management daemon to apply changes.

Answer

Run the configuration utility setup wizard, bypass the licensing step by using trial mode, and provision all available modules simultaneously.

Answer

Connect via serial console, execute the default setup script, assign a management IP, and automatically trigger the cloud marketplace auto-licensing daemon.

Question 6

Which TWO of the following are mandatory requirements when setting up a BIG-IP license via the 'Base Registration Key' method?

Accepted Answer

The management interface must have outbound internet access.. The base registration key method requires the BIG-IP to reach the F5 licensing servers to exchange the key for a license file. This process necessitates both outbound internet access for the device and a valid registration key provided by F5. Without these, the device cannot validate its entitlement, and the licensing process will fail, leaving the system in an unlicensed state where traffic processing is effectively disabled.

Answer

The device must be part of an HA cluster.

Answer

The device must be running in FIPS-compliant mode.

Answer

The user must have a physical smart card.

Question 7

An administrator is performing a fresh installation of BIG-IP VE on a hypervisor. After booting the ISO, the system fails to reach the Configuration Utility. Which initial task must be completed via the serial console to enable network access?

Accepted Answer

Execute the 'config' utility via the CLI.. Before the Configuration Utility is accessible, the BIG-IP system requires a base network configuration, including the management IP address, netmask, and default gateway. Without these parameters, the system cannot route traffic to the management interface. Performing this via the console is essential because the GUI is inactive until the management IP is routable, ensuring secure initial connectivity for subsequent administrative tasks.

Answer

Run the 'tmsh install software' command.

Answer

Enable the 'bigdb' variable for GUI access.

Answer

Format the primary partition using 'fdisk'.

Question 8

Refer to the exhibit. An administrator receives this error after a fresh installation and reboot. What must be done to resolve this?

Accepted Answer

Perform a manual license re-activation.. A fresh BIG-IP installation requires license activation to enable the system's licensed features. Without a valid license, the configuration daemon (mcpd) will refuse to load the configuration, as it cannot verify which modules are authorized for use. This is a common occurrence in new deployments and is resolved by contacting the F5 licensing server to register the system's base registration key.

Answer

Reboot the device into the previous boot slot.

Answer

Delete the current configuration files.

Answer

Check the physical license dongle on the chassis.

Question 9

Refer to the exhibit. An administrator reviews the system status after an upgrade attempt on a high-availability BIG-IP pair. The command output indicates a critical service failure. Which immediate diagnostic step should the administrator take?

Accepted Answer

Access the command line interface to examine /var/log/ltm for initialization errors and verify license validity for the newly installed software version.. The command output highlights that the Traffic Management Microkernel is suppressed, indicating a critical hardware or software initialization failure following an upgrade. Investigating log files such as /var/log/ltm and /var/log/boot.log helps isolate whether the issue stems from corrupted configuration syntax, license mismatches, or incompatible software images during the boot process.

Answer

Reboot the active device immediately into the previous boot location and initiate a configuration sync across the high-availability peer.

Answer

Modify the BIG-IP platform properties file to disable hardware acceleration and restart the master control program daemon using bigstart restart.

Answer

Run a complete factory default reset via the command line and restore the configuration from a UCS archive generated prior to the upgrade.

Question 10

Which THREE components are verified during the installation process of a new BIG-IP software version?

Accepted Answer

Software image integrity checksum.. During installation, the BIG-IP system validates the integrity of the software image to prevent corrupted installations. It also checks for sufficient disk space in the target volume to ensure the system can successfully extract all files. Finally, the system confirms hardware compatibility, ensuring the specific platform model supports the software version being installed, which is crucial for preventing kernel panic or driver mismatch issues after the first boot.

Answer

Local client user session count.

Answer

External DNS server latency.

Question 11

An administrator accidentally deleted a configuration file. Which action would be the most efficient way to restore the system configuration to its previous state?

Accepted Answer

Restore from a UCS file.. Restoring a previously created UCS (User Configuration Set) archive is the fastest and most reliable way to recover from an accidental configuration loss. The UCS file contains all the necessary data to rebuild the system configuration. This standard recovery procedure minimizes downtime and human error, providing a clean and predictable path back to the last known working state of the BIG-IP device.

Answer

Perform a factory reset.

Answer

Re-install the TMOS software.

Answer

Use the 'tmsh load config' command.

Question 12

Refer to the exhibit. An administrator receives this error while running a TMSH script to provision modules. What is the likely cause?

Accepted Answer

The provisioning level is set to an unsupported value.. Provisioning errors often stem from invalid resource levels being assigned to a module. Each module has specific requirements and allowed values (e.g., nominal, dedicated, none). When an invalid setting is provided, the system rejects the command to prevent system instability. Understanding the resource allocation model is essential to ensure that the BIG-IP appliance operates within its performance limits while enabling the required application delivery services for the enterprise environment.

Answer

Insufficient physical memory is installed.

Answer

The license does not support this module.

Answer

The management interface is down.

Question 13

An administrator needs to verify the current software version running on both boot partitions. Which command provides this information?

Accepted Answer

tmsh show sys software. Knowing the version on each boot slot is vital for planning upgrades and verifying the current state of the device. The 'show sys software' command provides a clear view of all installed versions and their corresponding locations. This information is essential for managing multiple boot partitions and ensuring that the correct software is targeted for the next maintenance activity or system failover event.

Answer

uname -a

Answer

cat /etc/version

Answer

tmsh list sys hardware

Question 14

An administrator is upgrading a BIG-IP system and receives a warning that the 'config sync' state is 'Not Fully Synchronized'. What is the correct action to take before proceeding with the upgrade?

Accepted Answer

Force a configuration sync from the active to the standby unit.. Proceeding with an upgrade while the sync state is not 'In Sync' is dangerous because the devices in the HA pair may have different configurations. This inconsistency can lead to unexpected behavior after the upgrade, such as traffic outages or corrupted data, as the system tries to merge or reconcile conflicting configurations during the reboot. Always synchronize the configuration before changing the software version to ensure a stable, predictable transition.

Answer

Ignore the warning; the upgrade will force a synchronization.

Answer

Delete the standby unit from the device group.

Answer

Perform a factory reset on both devices.

Question 15

An administrator is installing a new BIG-IP version via the command line using the 'tmsh' utility. Which command is used to verify that the installation has successfully completed and that the new boot slot is ready to be made active?

Accepted Answer

tmsh show sys software. Verifying the installation status is a vital step before attempting to switch boot partitions. The 'show sys software' command provides the current status of all boot volumes, showing whether the install finished successfully or encountered errors. This allows the administrator to confirm the build version is correctly extracted before proceeding with the switch, preventing the risk of booting into a corrupted or incomplete installation that would cause downtime.

Answer

tmsh list sys software

Answer

tmsh check sys software

Answer

tmsh verify sys software

Question 16

An administrator is configuring a new BIG-IP high-availability (HA) pair. The administrator has already configured the management IPs and licensed both devices. Which additional step is required to ensure the devices can communicate for config sync and failover?

Accepted Answer

Configure a self IP on a dedicated VLAN for failover and config sync traffic.. To enable config sync and failover, the BIG-IP devices must have self IP addresses on a common VLAN. These self IPs are used for heartbeat and synchronization traffic. The management interface is not used for this purpose. Configuring a dedicated self IP on each device ensures reliable HA communication.

Answer

Set up a default route on the management interface to the peer's management IP.

Answer

Configure a static ARP entry for the peer's management IP on both devices.

Answer

Enable spanning tree protocol on all VLANs to prevent loops between the devices.

Question 17

An administrator is performing an initial setup of a new BIG-IP appliance via the Configuration Utility. After setting the management IP address, they are unable to reach the device from their workstation. Which factor is most likely responsible for this connectivity failure?

Accepted Answer

The management default gateway route was not defined in the initial network setup.. Initial configuration requires that the management interface is physically connected to the management network and that the management route is properly configured. If the default gateway is missing or incorrect, the BIG-IP cannot route packets back to the administrator's workstation, even if the IP assignment was successful. Verifying routing tables is a critical troubleshooting step during deployment to ensure bidirectional traffic flow between the management console and the BIG-IP management port.

Answer

The license has not been activated, disabling all management plane access.

Answer

The port lockdown setting on the management interface is set to 'Allow None'.

Answer

The appliance is running a different software version than the browser supports.

Question 18

An administrator is upgrading a BIG-IP pair. After upgrading the standby unit, which step should be performed before upgrading the active unit?

Accepted Answer

Force the standby unit to become active.. The standard high-availability upgrade path involves upgrading the standby unit first to verify the new software version's stability. By failing over traffic to the newly upgraded unit, the administrator validates that the application services function as expected. If issues arise, the administrator can fail back to the original active unit, minimizing downtime and ensuring a controlled transition during the maintenance window for the entire cluster.

Answer

Delete the sync-failover device group.

Answer

Reboot the active unit immediately.

Answer

Change the management IP address of the active unit.

Question 19

What is the primary benefit of performing a clean installation of BIG-IP software on a new boot volume?

Accepted Answer

It ensures the system is free from previous software corruption.. A clean installation allows the system to start with a fresh OS and core binaries, significantly reducing the risk of carrying over corrupted files or incompatible settings from a legacy version. This method is the safest way to ensure system stability and performance in a production environment, as it eliminates the 'baggage' of previous configurations and system states that could potentially cause instability when running newer software versions on the BIG-IP appliance.

Answer

It automatically migrates all custom scripts.

Answer

It is the only way to upgrade the license key.

Answer

It increases the speed of traffic processing.

Question 20

An administrator is performing an initial configuration on a new BIG-IP appliance using the Setup Utility via the management port. After completing the network and IP settings, the administrator loses management connectivity. Which action should the administrator take first to resolve the issue?

Accepted Answer

Connect via serial console, verify the management route table, and ensure the correct default gateway is assigned.. Losing management connectivity after running the Setup Utility typically happens because the default gateway was misconfigured or omitted, preventing routing back to the administrator subnet. Verifying and correcting the gateway via the serial console restores layer 3 communication without needing a full factory reset. This ensures the initial provisioning workflow can proceed smoothly in accordance with F5 deployment best practices.

Answer

Perform a factory reset using the LCD panel to restart the initial setup wizard from the beginning.

Answer

Unplug the management cable for thirty seconds and plug it back into a different switch port to force DHCP discovery.

Answer

Reboot the appliance using the physical power switch to reload the factory default IP configuration.