F5CAB4 Practice Test 3 — 10 Questions

Question 1

An administrator is managing multiple BIG-IP devices using a centralized management tool. Which protocol is most commonly used for secure, automated control plane configuration updates?

Accepted Answer

iControl REST. iControl REST is the industry-standard API for programmatic BIG-IP configuration. It provides a RESTful interface that allows administrators to push configuration changes, query device status, and automate routine tasks. Its usage is critical in modern DevOps and CI/CD environments, as it offers a scalable and efficient alternative to manual TMSH commands, allowing for consistent configuration across large device fleets while reducing the risk of human error in complex deployments.

Answer

FTP

Answer

Telnet

Answer

ICMP

Question 2

Which THREE services are categorized as control plane services that can be managed via TMSH?

Accepted Answer

snmpd. TMSH provides a unified interface for managing various control plane services. These services are essential for system-wide operations, including platform monitoring (SNMP), time synchronization (NTP), and DNS resolution. Managing these through TMSH ensures that changes are validated, logged, and synchronized across high-availability pairs. This consistency is vital for maintaining a stable infrastructure, as incorrectly configured time or DNS settings can lead to certificate validation errors, log timestamp discrepancies, and failure of remote authentication systems.

Answer

tmm

Answer

httpd

Question 3

Refer to the exhibit. The cluster status is 'Offline'. What is the most likely reason for this state?

Accepted Answer

Network connectivity for heartbeats is down.. A missing heartbeat is the primary cause of a cluster becoming offline. Heartbeats are the mechanism through which peer devices verify each other's operational status. If the network path for heartbeats is interrupted, the devices cannot verify the health of the peer, leading to an offline state to prevent conflicting traffic processing configurations from being active simultaneously in the network.

Answer

The license is invalid.

Answer

The configuration sync has timed out.

Answer

The management plane is overloaded.

Question 4

An administrator needs to add a new VLAN to a BIG-IP device using TMSH. The administrator wants to ensure the change is immediately active and persisted across reboots. Which command sequence should the administrator use?

Accepted Answer

tmsh create net vlan vlan10 tag 10; tmsh save sys config. To add a VLAN and ensure it persists, the administrator must create it and then save the configuration. The 'create net vlan' command makes the VLAN active immediately, and 'save sys config' writes the running configuration to the configuration files, ensuring it survives a reboot. Other commands either do not save or would revert the change.

Answer

tmsh create net vlan vlan10 tag 10; tmsh load sys config

Answer

tmsh create net vlan vlan10 tag 10

Answer

tmsh edit net vlan vlan10 tag 10; tmsh save sys config

Question 5

An administrator needs to restrict administrative access to the BIG-IP system so that only specific management workstations can reach the Configuration Utility. Which method is the most secure and appropriate control plane configuration?

Accepted Answer

Define specific management IP addresses and masks in the Management IP Allow list.. Restricting access via the management IP and specific source subnets is critical for hardening the control plane. By utilizing the 'Allow' list under System > Configuration > Device > Management, administrators enforce a network-level security boundary that prevents unauthorized brute-force attempts from reaching the GUI or SSH services. This configuration effectively isolates management traffic from the data plane, ensuring that administrative tasks are performed only from trusted, hardened jump hosts.

Answer

Configure a SNAT pool on the management interface to mask source IP addresses.

Answer

Implement a self-IP address with a port lockdown setting of 'Allow None'.

Answer

Use an iRule on the external VLAN to redirect traffic away from the management interface.

Question 6

An administrator is unable to access the GUI, but SSH access is still functioning. What is the most appropriate next step for diagnosing the issue?

Accepted Answer

Check the status of the httpd service using tmsh.. When SSH is available but the GUI is not, it indicates that the underlying operating system and management network are functional, but the specific web server (httpd) or management service is failing. Using SSH to check the status of the 'httpd' service is the most direct way to isolate the problem. This is a common control plane troubleshooting scenario requiring knowledge of how F5 manages services.

Answer

Reboot the entire BIG-IP system.

Answer

Fail over the BIG-IP unit immediately.

Answer

Re-license the BIG-IP device.

Question 7

An administrator notices that the BIG-IP system time is drifting. Why is this critical for control plane stability in an HA configuration?

Accepted Answer

It impacts the validity of heartbeat timers.. Time synchronization is vital for HA, as it ensures that logs, audit trails, and, most importantly, certificate validity checks and heartbeat monitoring are synchronized. When clocks drift, HA heartbeat packets may be rejected or ignored, potentially causing 'split-brain' scenarios. Maintaining accurate time via NTP is essential for the reliability of the control plane and the overall synchronization state between cluster members.

Answer

The GUI will be unable to render charts.

Answer

It causes the TMM process to restart.

Answer

SNMP traps will stop functioning.

Question 8

Refer to the exhibit. An administrator is troubleshooting a failed configuration sync. The log shows a bad argument error related to the management IP. What is the most likely cause?

Accepted Answer

The peer management IP is not reachable for ConfigSync.. The error indicates that the peer device configuration contains a reference to an unreachable or misconfigured management IP address during the sync process. ConfigSync relies on stable connectivity between peer management interfaces. Validating the self-IP and management network routing is essential to ensure that the synchronization process can successfully exchange configuration data without encountering reachability timeouts or illegal argument exceptions in the underlying management process.

Answer

The TMM process has crashed on the peer.

Answer

The license on the peer has expired.

Answer

The NTP server is unreachable.

Question 9

Refer to the exhibit. An administrator notices the BIG-IP VE is experiencing high control plane CPU utilization and slow GUI response. Based on the hardware output, what is the most likely cause if the system is properly sized?

Accepted Answer

The management plane is overwhelmed by excessive logging or API queries.. High control plane utilization in a VE environment often stems from resource exhaustion or misconfiguration of management tasks. Since the hardware shows sufficient memory and CPU, the administrator should investigate runaway processes, excessive logging, or high-frequency API calls. This is essential for maintaining control plane stability, as the GUI and management processes share the limited CPU resources allocated to the Linux management partition, directly impacting responsiveness.

Answer

The TMM is starved of CPU due to high data plane traffic.

Answer

The disk space is full preventing log rotations.

Answer

The license is expired, forcing the system into a restricted mode.

Question 10

Which protocol is recommended for secure administrative access to the BIG-IP command line interface?

Accepted Answer

SSH. SSH is the industry standard for secure, encrypted remote command-line access. By using SSH, administrators ensure that credentials and commands are protected from interception during transit. Relying on legacy, unencrypted protocols like Telnet would expose the management credentials and administrative traffic to any attacker on the local network, making SSH an absolute requirement for any secure control plane administration strategy in a production environment.

Answer

Telnet

Answer

HTTP

Answer

FTP