F5CAB4 Practice Test 1 — 25 Questions

Question 1

An administrator is troubleshooting a BIG-IP device that is not responding to configuration changes made via the GUI. The administrator suspects that a control plane service is not running properly. Which two control plane services should the administrator check to ensure that the GUI and configuration management are operational? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

mcpd. The GUI and configuration management rely on httpd and mcpd. httpd serves the web interface and REST API, while mcpd processes configuration changes. If either service is not running, the administrator may experience an unresponsive GUI or failure to apply changes. Checking these services with 'tmsh show sys service' or 'bigstart status' is a key troubleshooting step.

Answer

bigd

Answer

tmm

Answer

named

Question 2

An administrator needs to restrict administrative access to the BIG-IP system so that only specific management workstations can reach the Configuration Utility and SSH. Which control plane mechanism should be configured to implement this access control?

Accepted Answer

Define a management packet filter policy on the management interface.. Implementing packet filters on the management interface is the standard security practice to harden the control plane. By defining an Allow rule for authorized subnets and a Drop rule for all other traffic, you prevent unauthorized reconnaissance and brute-force attempts. This is critical for maintaining the integrity of the administrative plane, ensuring that management access remains restricted to secure, trusted administrative jump hosts or network segments.

Answer

Configure an iRule on the Management Virtual Server.

Answer

Enable the 'Allow All' policy in the Device Service Group.

Answer

Modify the global db variable 'httpd.allowed.ips'.

Question 3

An administrator wants to restrict the types of ciphers used for SSH access to the BIG-IP system. Which configuration file or tool should be modified?

Accepted Answer

Modify the sshd_config file.. SSH access is governed by the 'sshd' service configuration. Modifying the configuration to limit ciphers is a standard task for hardening the management plane. By enforcing stronger ciphers, the administrator protects administrative sessions from potential cryptographic attacks, ensuring that only secure, modern encryption methods are used when managing the BIG-IP, which is essential for maintaining a secure and compliant control plane environment.

Answer

Update the global firewall policy.

Answer

Change the system time settings.

Answer

Modify the iRule settings.

Question 4

A BIG-IP device has lost synchronization with its peer. Which control plane component is responsible for detecting this state and reporting it?

Accepted Answer

mcpd. The 'mcpd' process relies on the 'configsync' functionality, which monitors the checksums of the configuration files across peers. When a mismatch is detected, mcpd triggers alerts and updates the system status. This is critical for maintaining high availability, as configuration drift between peers can lead to asymmetric traffic behavior or unpredictable failover results, making it vital for administrators to promptly resolve sync issues to ensure operational consistency.

Answer

TMM

Answer

bigd

Answer

snmpd

Question 5

Which TWO of the following tasks are performed by the BIG-IP control plane rather than the data plane?

Accepted Answer

Synchronizing configuration changes between high-availability peers.. The control plane manages the system's configuration, authentication, and administrative interactions. Tasks like updating the device configuration via TMSH or processing SSH/GUI logins occur in the control plane environment (Linux OS). Conversely, traffic steering and packet manipulation occur within the TMM, which is the data plane. Distinguishing these domains is vital for performance tuning, resource allocation, and troubleshooting connectivity issues, as control plane exhaustion often differs significantly from data plane resource depletion.

Answer

Processing SSL handshakes for high-volume application traffic.

Answer

Executing iRules for Layer 7 load balancing decisions.

Answer

Forwarding packets based on the virtual server routing table.

Question 6

Which utility is primarily used for command-line administrative control plane management on a BIG-IP system?

Accepted Answer

tmsh. TMSH (Traffic Management Shell) is the primary CLI interface for BIG-IP control plane administration. It provides a standardized environment for configuring objects, managing system settings, and viewing status. Familiarity with TMSH is essential for F5 administrators because it offers granular control over the system, allows for scriptable automation, and serves as the bridge between the administrative user and the underlying mcpd configuration daemon, which ultimately implements the desired state.

Answer

bash

Answer

tcpdump

Answer

tshark

Question 7

An administrator is planning to upgrade the BIG-IP software. What is the recommended first step to ensure control plane recovery in case of an upgrade failure?

Accepted Answer

Generate a UCS archive.. Creating a User Configuration Set (UCS) archive is the standard method for backing up the BIG-IP configuration. Having a valid UCS file allows an administrator to restore the complete system state, including certificates and licenses, to a previous working version. This is the most crucial step in any control plane administration task involving significant configuration changes or software upgrades, as it provides a safety net for rapid disaster recovery.

Answer

Perform a full system snapshot via the hypervisor.

Answer

Export the device certificate bundle.

Answer

Copy the /config directory to a remote server.

Question 8

When managing multiple BIG-IP devices, why is it recommended to use a centralized NTP server for all devices?

Accepted Answer

To ensure accurate log correlation and certificate validity.. Time synchronization is vital for distributed systems, especially those performing SSL/TLS handshakes and logging. If clocks are out of sync, log entries become difficult to correlate during forensic analysis, and certificate validation can fail. Centralizing NTP ensures consistency across the entire environment, which is a foundational requirement for both security compliance and effective troubleshooting of the control plane across multiple devices.

Answer

To increase the throughput of the BIG-IP system.

Answer

To reduce the CPU utilization of the management plane.

Answer

To automate the software upgrade process across devices.

Question 9

An administrator needs to back up the full control-plane configuration of a BIG-IP device, but the security policy forbids storing user password hashes in the archive. The administrator wants a single archive that can later be restored with 'tmsh load sys ucs'. Which action should be performed?

Accepted Answer

Run 'tmsh save sys ucs /var/local/ucs/backup.ucs no-passwords' to create a UCS archive that excludes password information.. A UCS archive created with the 'no-passwords' modifier omits credential hashes while still capturing the full control-plane configuration, so it satisfies the no-password-storage policy and remains restorable. Other approaches either produce a different file type, require unsupported manual editing, or fail to remove the sensitive password data from the archive.

Answer

Run 'tmsh save sys ucs /var/local/ucs/backup.ucs' from the bash shell using the '--master-key' flag to encrypt all credentials.

Answer

Run 'tmsh save sys ucs /var/local/ucs/backup.ucs' and then manually delete the /config/bigip.conf file inside the archive before restoring.

Answer

Run 'tmsh save sys config file /var/local/ucs/backup.scf' to export a flat configuration file that can be restored with 'tmsh load sys ucs'.

Question 10

When a BIG-IP system is in a High Availability (HA) pair, which component is primarily responsible for ensuring that the control plane configuration remains synchronized between devices?

Accepted Answer

The ConfigSync process.. The ConfigSync feature is dedicated to synchronizing the configuration state between BIG-IP units in an HA group. It ensures that the standby unit maintains a mirrors-image of the active unit's settings. Understanding the role of ConfigSync is essential for administrators, as it guarantees that failover events are seamless and that the standby device is always prepared to assume the traffic processing role with identical configuration parameters.

Answer

The Traffic Management Microkernel (TMM).

Answer

The Configuration Utility (GUI).

Answer

The Linux kernel.

Question 11

An administrator needs to restrict administrative access to the BIG-IP system so that only specific source IP addresses can reach the Configuration Utility. Which feature should be configured to ensure this security requirement?

Accepted Answer

Update the Management IP Allow list in System Configuration.. Restricting management access via the Management IP allows administrators to define a whitelist of trusted networks. This is a critical security practice in F5 Control Plane Administration to prevent unauthorized access to the management plane from untrusted segments. By using the 'Allow' list under System > Configuration > Device > Management IP, the BIG-IP will drop any packets originating from non-authorized IPs, effectively securing the administrative interface from external threats.

Answer

Enable Packet Filtering on the external VLAN.

Answer

Configure an iRule to drop traffic on the management port.

Answer

Modify the global Firewall policy for the Data Plane.

Question 12

Refer to the exhibit. Why is it important for the administrator to review the 'show sys hardware' output when troubleshooting a control plane issue?

Accepted Answer

It verifies that the control plane has access to sufficient physical resources.. Hardware status directly informs the administrator about resource capacity, such as CPU cores or memory, which are critical for the control plane. If hardware components are failing (e.g., memory errors, fan failure), it can manifest as sluggish GUI response or mcpd instability. Reviewing this output helps differentiate between software configuration issues and underlying hardware stress, which is essential for accurate diagnostics and determining whether an RMA or physical maintenance is required.

Answer

It displays the current traffic throughput of all virtual servers.

Answer

It lists the active users currently logged into the device.

Answer

It is required to update the system's licensing information.

Question 13

Which log file is most useful for troubleshooting administrative login attempts and authentication failures on the BIG-IP control plane?

Accepted Answer

/var/log/secure. The /var/log/secure log file is the standard Linux repository for authentication-related events. On a BIG-IP, this includes SSH access, GUI login attempts, and PAM-related authentication activities. Monitoring this file is essential for F5 administrators to detect brute-force attacks, troubleshoot credential issues, and maintain a secure control plane by keeping track of who is accessing the device and when.

Answer

/var/log/ltm

Answer

/var/log/messages

Answer

/var/log/audit

Question 14

A BIG-IP administrator is preparing to upgrade the TMOS software on a device. Before the upgrade, the administrator must ensure that the current configuration is backed up and that the device can be restored if the upgrade fails. Which tmsh command creates a full configuration backup archive that can be used for restoration?

Accepted Answer

save sys ucs /var/local/ucs/backup.ucs. A UCS archive is the standard full backup format on BIG-IP, containing configuration, licenses, and certificates. The save sys ucs command creates this archive and can be directed to a specific path. Other commands either save only the running configuration to standard files or are not valid tmsh commands for creating backups.

Answer

create sys backup /var/local/ucs/backup.ucs

Answer

export sys config /var/local/ucs/backup.ucs

Answer

save sys config /var/local/ucs/backup.ucs

Question 15

A BIG-IP administrator is configuring a new device and needs to set up the control plane to allow remote management via SSH and HTTPS. The administrator wants to ensure that only secure protocols are used and that access is restricted to specific management IP addresses. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Enable SSH and disable Telnet access on the management interface.. To secure remote management, the administrator should enable SSH and disable Telnet, and configure a management port lockdown to restrict access to specific IP addresses. These actions ensure that only secure protocols are used and that access is limited to authorized addresses, meeting the security requirements.

Answer

Enable HTTP access and disable HTTPS access to improve performance.

Answer

Configure the management IP address and management route using tmsh.

Answer

Set up a default route for the management interface.

Question 16

An administrator needs to securely transfer a large UCS file from the BIG-IP management plane to a remote backup server. Which method is most secure and appropriate for this control plane task?

Accepted Answer

SCP. Using SCP or SFTP over SSH provides an encrypted channel for file transfer, ensuring that the configuration archive, which may contain sensitive keys and passwords, is not exposed in cleartext. This is standard procedure for maintaining secure control plane operations, preventing potential data leaks when moving sensitive configuration backups across the management network to an off-site or secure central storage location.

Answer

FTP

Answer

HTTP

Answer

TFTP

Question 17

An F5 administrator is tasked with updating the BIG-IP software version. Which pre-update control plane check is the most critical for ensuring a successful deployment?

Accepted Answer

Verify sufficient disk space on all partitions.. Verifying the health of the control plane before an upgrade is essential to prevent bricking the system. Checking disk space, running process health, and ensuring configuration integrity ensures that the upgrade process has the necessary resources and can properly migrate existing settings. This is a vital step because an upgrade failure can lead to an extended outage and complicated recovery scenarios, making thorough validation an absolute requirement for stable operations.

Answer

Clear the browser cache on the management PC.

Answer

Restart all virtual servers.

Answer

Rename the default 'admin' account.

Question 18

An administrator observes that the BIG-IP system's management interface is experiencing high CPU utilization. Which process should the administrator investigate first to determine if control plane operations are impacting system performance?

Accepted Answer

mcpd. The 'mcpd' (Master Configuration Program Daemon) is the central authority for all BIG-IP configuration. High CPU usage in mcpd typically indicates massive configuration changes, sync operations, or excessive API calls. Monitoring mcpd is essential because it manages the transition of configuration data to TMM; performance issues here suggest that the control plane is struggling to process administrative updates or communicate with the data plane components effectively.

Answer

TMM

Answer

sshd

Answer

bigd

Question 19

Refer to the exhibit. The administrator encounters a 'database is locked' error while attempting to push a configuration change. What is the most likely cause?

Accepted Answer

Another administrative task is currently modifying the configuration database.. The 'database is locked' error in mcpd typically occurs when another administrative process, such as a concurrent TMSH transaction, a scheduled sync, or an automated API task, currently holds a write lock on the configuration database. Since mcpd requires exclusive access to apply changes, any competing operation prevents new writes. This matters because it highlights the necessity of managing concurrent control plane tasks to prevent configuration corruption and ensure atomic updates.

Answer

The TMM process has crashed and is holding a mutex on the mcpd socket.

Answer

The disk partition hosting /var/config is full, preventing write operations.

Answer

The SSH daemon has been compromised, leading to unauthorized file locks.

Question 20

Which user role provides the highest level of access within the BIG-IP system, allowing full control over all modules and the underlying Linux operating system?

Accepted Answer

Administrator. The 'Administrator' role is the top-tier access level, granting full control over every aspect of the system. This level of access is necessary for performing system-wide updates, changing core configurations, and managing other users. Understanding the scope of this role is crucial, as it entails significant responsibility for system stability and security, and it must be managed carefully by authorized personnel to prevent accidental or malicious system-wide changes.

Answer

Operator

Answer

Manager

Answer

Resource Administrator