F5CAB4 Practice Exam 2 — 20 Questions

Question 1

An administrator is managing multiple BIG-IP devices using a centralized management tool. Which protocol is most commonly used for secure, automated control plane configuration updates?

Accepted Answer

iControl REST. iControl REST is the industry-standard API for programmatic BIG-IP configuration. It provides a RESTful interface that allows administrators to push configuration changes, query device status, and automate routine tasks. Its usage is critical in modern DevOps and CI/CD environments, as it offers a scalable and efficient alternative to manual TMSH commands, allowing for consistent configuration across large device fleets while reducing the risk of human error in complex deployments.

Answer

FTP

Answer

Telnet

Answer

ICMP

Question 2

Which THREE services are categorized as control plane services that can be managed via TMSH?

Accepted Answer

snmpd. TMSH provides a unified interface for managing various control plane services. These services are essential for system-wide operations, including platform monitoring (SNMP), time synchronization (NTP), and DNS resolution. Managing these through TMSH ensures that changes are validated, logged, and synchronized across high-availability pairs. This consistency is vital for maintaining a stable infrastructure, as incorrectly configured time or DNS settings can lead to certificate validation errors, log timestamp discrepancies, and failure of remote authentication systems.

Answer

tmm

Answer

httpd

Question 3

Refer to the exhibit. The cluster status is 'Offline'. What is the most likely reason for this state?

Accepted Answer

Network connectivity for heartbeats is down.. A missing heartbeat is the primary cause of a cluster becoming offline. Heartbeats are the mechanism through which peer devices verify each other's operational status. If the network path for heartbeats is interrupted, the devices cannot verify the health of the peer, leading to an offline state to prevent conflicting traffic processing configurations from being active simultaneously in the network.

Answer

The license is invalid.

Answer

The configuration sync has timed out.

Answer

The management plane is overloaded.

Question 4

An administrator needs to add a new VLAN to a BIG-IP device using TMSH. The administrator wants to ensure the change is immediately active and persisted across reboots. Which command sequence should the administrator use?

Accepted Answer

tmsh create net vlan vlan10 tag 10; tmsh save sys config. To add a VLAN and ensure it persists, the administrator must create it and then save the configuration. The 'create net vlan' command makes the VLAN active immediately, and 'save sys config' writes the running configuration to the configuration files, ensuring it survives a reboot. Other commands either do not save or would revert the change.

Answer

tmsh create net vlan vlan10 tag 10; tmsh load sys config

Answer

tmsh create net vlan vlan10 tag 10

Answer

tmsh edit net vlan vlan10 tag 10; tmsh save sys config

Question 5

An administrator needs to restrict administrative access to the BIG-IP system so that only specific management workstations can reach the Configuration Utility. Which method is the most secure and appropriate control plane configuration?

Accepted Answer

Define specific management IP addresses and masks in the Management IP Allow list.. Restricting access via the management IP and specific source subnets is critical for hardening the control plane. By utilizing the 'Allow' list under System > Configuration > Device > Management, administrators enforce a network-level security boundary that prevents unauthorized brute-force attempts from reaching the GUI or SSH services. This configuration effectively isolates management traffic from the data plane, ensuring that administrative tasks are performed only from trusted, hardened jump hosts.

Answer

Configure a SNAT pool on the management interface to mask source IP addresses.

Answer

Implement a self-IP address with a port lockdown setting of 'Allow None'.

Answer

Use an iRule on the external VLAN to redirect traffic away from the management interface.

Question 6

An administrator is unable to access the GUI, but SSH access is still functioning. What is the most appropriate next step for diagnosing the issue?

Accepted Answer

Check the status of the httpd service using tmsh.. When SSH is available but the GUI is not, it indicates that the underlying operating system and management network are functional, but the specific web server (httpd) or management service is failing. Using SSH to check the status of the 'httpd' service is the most direct way to isolate the problem. This is a common control plane troubleshooting scenario requiring knowledge of how F5 manages services.

Answer

Reboot the entire BIG-IP system.

Answer

Fail over the BIG-IP unit immediately.

Answer

Re-license the BIG-IP device.

Question 7

An administrator notices that the BIG-IP system time is drifting. Why is this critical for control plane stability in an HA configuration?

Accepted Answer

It impacts the validity of heartbeat timers.. Time synchronization is vital for HA, as it ensures that logs, audit trails, and, most importantly, certificate validity checks and heartbeat monitoring are synchronized. When clocks drift, HA heartbeat packets may be rejected or ignored, potentially causing 'split-brain' scenarios. Maintaining accurate time via NTP is essential for the reliability of the control plane and the overall synchronization state between cluster members.

Answer

The GUI will be unable to render charts.

Answer

It causes the TMM process to restart.

Answer

SNMP traps will stop functioning.

Question 8

Refer to the exhibit. An administrator is troubleshooting a failed configuration sync. The log shows a bad argument error related to the management IP. What is the most likely cause?

Accepted Answer

The peer management IP is not reachable for ConfigSync.. The error indicates that the peer device configuration contains a reference to an unreachable or misconfigured management IP address during the sync process. ConfigSync relies on stable connectivity between peer management interfaces. Validating the self-IP and management network routing is essential to ensure that the synchronization process can successfully exchange configuration data without encountering reachability timeouts or illegal argument exceptions in the underlying management process.

Answer

The TMM process has crashed on the peer.

Answer

The license on the peer has expired.

Answer

The NTP server is unreachable.

Question 9

Refer to the exhibit. An administrator notices the BIG-IP VE is experiencing high control plane CPU utilization and slow GUI response. Based on the hardware output, what is the most likely cause if the system is properly sized?

Accepted Answer

The management plane is overwhelmed by excessive logging or API queries.. High control plane utilization in a VE environment often stems from resource exhaustion or misconfiguration of management tasks. Since the hardware shows sufficient memory and CPU, the administrator should investigate runaway processes, excessive logging, or high-frequency API calls. This is essential for maintaining control plane stability, as the GUI and management processes share the limited CPU resources allocated to the Linux management partition, directly impacting responsiveness.

Answer

The TMM is starved of CPU due to high data plane traffic.

Answer

The disk space is full preventing log rotations.

Answer

The license is expired, forcing the system into a restricted mode.

Question 10

Which protocol is recommended for secure administrative access to the BIG-IP command line interface?

Accepted Answer

SSH. SSH is the industry standard for secure, encrypted remote command-line access. By using SSH, administrators ensure that credentials and commands are protected from interception during transit. Relying on legacy, unencrypted protocols like Telnet would expose the management credentials and administrative traffic to any attacker on the local network, making SSH an absolute requirement for any secure control plane administration strategy in a production environment.

Answer

Telnet

Answer

HTTP

Answer

FTP

Question 11

An administrator needs to perform a massive configuration update. Which command should be used in TMSH to ensure the change is validated before application?

Accepted Answer

tmsh load sys config verify. Using the 'verify' option in TMSH allows the system to parse configuration changes and check for syntax or logical errors without actually applying them to the running configuration. This is essential for large updates because it prevents partial or broken configurations from being committed, which could lead to system instability, unintended traffic outages, or loss of management access, ensuring that updates are applied cleanly and safely.

Answer

tmsh save sys config

Answer

tmsh run util bash

Answer

tmsh edit sys config

Question 12

An administrator is preparing to upgrade the BIG-IP software on a device that is part of a high-availability pair. Before the upgrade, the administrator needs to ensure that the control plane configuration is backed up and can be restored if necessary. Which command should the administrator use to create a full configuration backup that includes both the configuration files and the license?

Accepted Answer

tmsh save sys ucs /var/local/ucs/backup.ucs. To create a full configuration backup on a BIG-IP, the administrator should use 'tmsh save sys ucs <filename>'. This command generates a UCS archive that contains the configuration, license, and other critical files. It is the standard method for backup and restore, especially before major changes like software upgrades. Other commands like 'save sys config' only save the running configuration to text files and do not include the license.

Answer

tmsh save sys config

Answer

tmsh backup sys config /var/local/backup.tgz

Answer

tmsh create sys backup

Question 13

An administrator is troubleshooting a BIG-IP device that is failing to synchronize configuration changes with its peer. The administrator runs 'tmsh show cm sync-status' and sees 'Changes Pending'. Which action should the administrator take first to identify the cause?

Accepted Answer

Run 'tmsh show cm device' to check the device group and trust status.. When synchronization fails with 'Changes Pending', the first step is to verify that the device is trusted and properly configured in the device group. The 'show cm device' command provides this information. If trust is broken or the device is not in the correct group, synchronization cannot occur. Once trust and group membership are confirmed, further troubleshooting can focus on specific configuration differences or network connectivity.

Answer

Run 'tmsh show sys mcp-state' to verify the mcpd daemon is running.

Answer

Run 'tmsh show cm sync-status' with the 'verbose' option to see detailed differences.

Answer

Run 'tmsh show sys config' to compare the running configuration with the saved configuration.

Question 14

Refer to the exhibit. What is the impact of changing this DB variable on the control plane?

Accepted Answer

It modifies internal system configuration parsing rules.. Modifying DB variables (also known as 'hidden' or advanced settings) directly affects the behavior of the BIG-IP system. In this case, enabling RFC3986 compliance for the configuration parser alters how the system handles certain characters. These settings are powerful tools in control plane administration for resolving edge-case issues, but they must be used carefully, as they can lead to unexpected behavior if not properly understood or documented.

Answer

It restarts the TMM process immediately.

Answer

It resets the system license to a trial state.

Answer

It upgrades the BIG-IP software version.

Question 15

An administrator needs to back up the current BIG-IP configuration to a UCS archive on the local device. Which command should the administrator use?

Accepted Answer

tmsh save sys ucs /var/local/ucs/backup.ucs. The correct command to create a UCS archive is 'tmsh save sys ucs <path>'. This command captures the entire configuration, including licenses and network settings, into a single file. It is the standard backup method for BIG-IP devices. Other commands either save only the running configuration or perform a restore, not a backup.

Answer

tmsh create sys ucs /var/local/ucs/backup.ucs

Answer

tmsh save sys config /var/local/ucs/backup.ucs

Answer

tmsh load sys ucs /var/local/ucs/backup.ucs

Question 16

An administrator needs to add a new VLAN to a BIG-IP device. They want to ensure that the change is saved to the configuration files immediately. Which sequence of TMSH commands should they use?

Accepted Answer

tmsh create net vlan vlan10 tag 10; tmsh save sys config. Creating a VLAN in TMSH modifies the running configuration. To make it persistent, the administrator must run 'save sys config', which writes the running configuration to the stored files. Creating a UCS archive does not update the stored configuration, and loading configuration would overwrite changes.

Answer

tmsh create net vlan vlan10 tag 10; tmsh load sys config

Answer

tmsh create net vlan vlan10 tag 10; tmsh save sys ucs

Answer

tmsh create net vlan vlan10 tag 10; tmsh save sys config all

Question 17

When modifying the control plane configuration, which action ensures that the changes persist after a system reboot?

Accepted Answer

tmsh save sys config. Changes made via TMSH are held in memory by mcpd until an explicit save command is issued. The 'save sys config' command writes the in-memory configuration to the /config/bigip.conf file on disk. Failing to perform this save operation will result in the loss of all configuration changes upon the next system reboot, which is a common error that can lead to catastrophic downtime if a device unexpectedly restarts.

Answer

tmsh reload sys config

Answer

tmsh commit sys config

Answer

exit

Question 18

An administrator is troubleshooting an issue where changes made through the BIG-IP Configuration utility (GUI) are not appearing in the tmsh configuration. The administrator suspects that the GUI and tmsh are using different configuration sources. Which statement correctly describes how the GUI and tmsh interact with the BIG-IP configuration?

Accepted Answer

Both the GUI and tmsh modify the configuration through the mcpd daemon, which updates the configuration files.. The GUI and tmsh are both front-ends to the same configuration management system, centered on the mcpd daemon. When a change is made in either interface, it is sent to mcpd, which updates the in-memory configuration and eventually writes it to the configuration files. This design ensures that changes made in one interface are reflected in the other, provided they are saved.

Answer

The GUI uses a proprietary protocol to communicate with the configuration, while tmsh uses SNMP.

Answer

The GUI writes directly to the bigip.conf file, while tmsh reads from a separate database.

Answer

tmsh reads the configuration from the bigip.conf file every time a command is entered, while the GUI caches settings in memory.

Question 19

Which file path contains the primary BIG-IP configuration file that the mcpd daemon loads at startup?

Accepted Answer

/config/bigip.conf. The BIG-IP configuration is stored in /config/bigip.conf. This file represents the system's defined state. During boot, mcpd parses this file and loads the configuration into memory. Understanding this location is fundamental for administrators, as it is the target for manual backups, configuration audits, and troubleshooting issues where the configuration fails to load or requires manual restoration from a known good state.

Answer

/var/tmp/bigip.conf

Answer

/etc/bigip.conf

Answer

/var/lib/bigip.conf

Question 20

Which utility should an administrator use to monitor real-time resource consumption on the BIG-IP control plane, specifically for identifying processes consuming high CPU?

Accepted Answer

top. The 'top' utility is a standard Linux command used to monitor system processes in real-time. Since the F5 BIG-IP control plane runs on a Linux-based OS, using standard Linux tools is a fundamental skill for administrators. This tool helps identify rogue or high-load processes that might be impacting the Configuration Utility or system responsiveness, which is vital for effective troubleshooting and maintaining overall system performance.

Answer

tmsh show sys performance

Answer

bigtop

Answer

tmsh show sys connection