F5CAB4 Control Plane Administration Practice Test 2 — 15 Questions

Question 1

Which THREE actions should be performed during a control plane hardening process?

Accepted Answer

Disable the default 'admin' account and create a custom administrative user.. Hardening the control plane reduces the attack surface of the BIG-IP device. By disabling unused services, limiting management access, and enforcing strong authentication, an administrator prevents unauthorized access to the configuration database. These steps are vital because the control plane is the 'brain' of the appliance; if compromised, an attacker can manipulate traffic flows, steal cryptographic keys, or disable security policies, leading to a complete compromise of the application delivery infrastructure.

Answer

Enable shell access for all administrative users by default.

Answer

Allow anonymous SSH access to facilitate rapid troubleshooting.

Question 2

An administrator needs to modify the Master Key Encryption Password on an active BIG-system without disrupting active user traffic passing through the virtual servers. Which procedure ensures successful master key rotation while maintaining high availability operations?

Accepted Answer

Run the prompt-based utility 'f5mku -r' on the active unit, enter the existing master key, supply the new passphrase, and subsequently execute a manual configuration sync to push the updated master key file to the peer device.. Rotating the master key requires specific administrative commands that re-encrypt the master key file using the new passphrase while keeping active daemons running. Doing this correctly prevents decryption failures during configuration reloads and ensures persistent storage remains synchronized across high availability sync-failover peer devices without triggering unexpected failover events.

Answer

Modify the mcpd configuration file directly using a text editor to update the hashed password string, then restart the management daemon using the command 'tmsh restart /sys service mcpd'.

Answer

Execute the UCS archive generation command including the private keys flag, decrypt the archive offline using third-party tools, inject the new master key string, and restore the UCS archive.

Answer

Perform a forced failover to the standby unit, apply the new master key on the newly active device using the tmsh utility, and wait for automatic synchronization to propagate the keys.

Question 3

An administrator is planning to upgrade the BIG-IP software on a production device. As part of the pre-upgrade checklist, the administrator must ensure that the control plane configuration is properly backed up and that the upgrade process will not be disrupted by configuration issues. Which two actions should the administrator take before starting the upgrade? (Choose two.)

Accepted Answer

Verify that the running configuration is saved with 'save sys config'.. The correct answers are A and C. Creating a UCS archive provides a full backup of the configuration, and saving the running configuration ensures that all changes are persisted. Together, these actions protect the control plane configuration and ensure a smooth upgrade process. The other options are either not required or could introduce risk.

Answer

Disable the mcpd daemon to prevent configuration changes during the upgrade.

Answer

Delete all unused configuration objects to reduce the configuration size.

Answer

Run 'tmsh load sys config verify' to check for configuration errors.

Question 4

A BIG-IP administrator needs to back up the current configuration before applying a major change. The administrator runs the command 'tmsh save sys config partitions all' from the command line. Where is the resulting configuration file stored by default?

Accepted Answer

/config/bigip.conf. The command 'tmsh save sys config partitions all' saves the current running configuration to the SCF files in /config, with /config/bigip.conf being the primary file. This is the standard location for the BIG-IP configuration that mcpd loads at startup. Understanding this default path is essential for backup and recovery procedures.

Answer

/var/log/ltm

Answer

/shared/tmp

Answer

/var/local/ucs

Question 5

A BIG-IP administrator is troubleshooting a configuration sync issue between two devices in a device group. The administrator suspects that the configuration on one device has not been fully synchronized because the change was made directly to the configuration file instead of through the traffic management shell (TMSH). Which control plane component is responsible for validating and distributing configuration changes across the device group?

Accepted Answer

cbrd. cbrd is responsible for synchronizing configuration data between BIG-IP devices in a device group. It receives validated configuration changes from mcpd and distributes them to peer devices. The other options are either client tools (tmsh) or daemons with different roles (mcpd, devd), so cbrd is the correct answer.

Answer

mcpd

Answer

tmsh

Answer

devd

Question 6

An administrator must update the management IP address on a BIG-IP device that is managed by an F5 BIG-IQ central manager. The administrator changes the management IP via the BIG-IP Configuration utility and reboots the device. After the reboot, the BIG-IQ cannot reach the BIG-IP. Which control plane component on the BIG-IP is responsible for the trust relationship with BIG-IQ, and what must be updated?

Accepted Answer

The restjavad service; the BIG-IP's device certificate and the trusted device group must be updated with the new management IP.. The trust relationship between BIG-IP and BIG-IQ relies on the restjavad service and device certificates. Changing the management IP invalidates the existing certificate binding, so the certificate and trusted device group must be updated on both systems. Without this, TLS authentication fails and BIG-IQ cannot manage the device.

Answer

The icrd daemon; it automatically detects the new management IP and re-registers with BIG-IQ without further action.

Answer

The tmm process; it must be restarted to re-establish the control plane connection to BIG-IQ.

Answer

The mcpd daemon; its configuration file /config/bigip.conf must be manually edited to reflect the new IP.

Question 7

An administrator is troubleshooting slow GUI response on a BIG-IP device. Running 'top' shows that the 'httpd' process is consuming excessive CPU. The administrator suspects that a specific management session is generating a large number of requests. Which action should the administrator take to identify the source of the load?

Accepted Answer

Review /var/log/httpd/httpd_access.log for repeated requests from a single IP address.. The httpd_access.log is specifically designed to record HTTP requests to the management GUI, including client IPs and URLs. By examining this log, the administrator can quickly identify a misbehaving client or script. Options B, C, and D do not provide the granular session-level detail needed to isolate the source of the httpd CPU load.

Answer

Run 'tmsh show sys process' to display CPU usage per process.

Answer

Use 'tcpdump' on the management interface to capture HTTP traffic.

Answer

Check /var/log/ltm for HTTP request entries.

Question 8

A BIG-IP administrator runs 'tmsh load sys config' after editing the bigip.conf file manually. The command returns an error about a missing closing brace in a virtual server definition. The administrator wants to avoid service disruption while correcting the syntax. Which action should the administrator take next?

Accepted Answer

Run 'tmsh load sys config verify' to validate the syntax without applying the configuration.. 'tmsh load sys config verify' performs a dry-run syntax check and reports errors without applying changes, which is the safest way to validate a manually edited configuration. The other options either do not validate syntax, risk partial application, or reset the system, all of which are inappropriate for this scenario.

Answer

Run 'tmsh save sys config' to merge the changes into the running configuration.

Answer

Run 'tmsh load sys config default' to restore the default configuration before reapplying changes.

Answer

Run 'tmsh load sys config merge' to combine the edited file with the running configuration.

Question 9

An administrator needs to back up the BIG-IP configuration before an upgrade. The administrator runs 'tmsh save sys config' and receives the error 'mcpd is not running'. Which action should the administrator take first?

Accepted Answer

Check the status of the mcpd process and review /var/log/mcpd.log for errors.. The first step in troubleshooting a stopped critical process is to gather information: check if the process is truly down and review its log for errors. This guides the next action. Options A, C, and D are premature or ineffective without understanding why mcpd stopped, and some may worsen the situation.

Answer

Reboot the BIG-IP device to restore normal operation.

Answer

Restart the mcpd process using 'bigstart restart mcpd'.

Answer

Run 'tmsh load sys config' to reload the configuration.

Question 10

A BIG-IP administrator is preparing to apply a configuration change that involves modifying several virtual servers and pools. Before committing the change, the administrator wants to validate the new configuration without affecting the running system. Which TMSH command should the administrator use?

Accepted Answer

tmsh load sys config verify. To validate configuration changes without applying them, the administrator should use 'tmsh load sys config verify'. This command checks the syntax and consistency of the configuration files in /config, ensuring that any errors are caught before a live load. The other options either save the current config, apply changes, or are invalid commands.

Answer

tmsh load sys config merge

Answer

tmsh save sys config

Answer

tmsh run sys config check

Question 11

A BIG-IP administrator is reviewing the control plane architecture to prepare for a disaster recovery plan. The administrator needs to identify which control plane components are responsible for maintaining the configuration database and ensuring its integrity. (Choose two.)

Accepted Answer

mcpd. mcpd and icrd are both control plane components that directly interact with the configuration database. mcpd manages and validates configuration objects, while icrd provides the REST API interface for configuration changes. Together, they ensure the database is maintained and its integrity is preserved, making them the correct choices.

Answer

bigd

Answer

tmm

Answer

snmpd

Question 12

An administrator is planning to upgrade the TMOS software on a BIG-IP device. Before the upgrade, the administrator must ensure the control plane is healthy and the configuration is backed up. Which two actions should the administrator perform? (Choose two.)

Accepted Answer

Run 'tmsh show sys service' to verify all control plane daemons are running.. The correct answers are A and B because verifying control plane service health with 'tmsh show sys service' and creating a UCS backup with 'save sys ucs' are both essential pre-upgrade steps. They ensure the system is stable and provide a rollback point, minimizing risk during the TMOS software upgrade.

Answer

Disable the management interface to prevent external access during the upgrade.

Answer

Delete old log files in /var/log to free up disk space.

Answer

Restart the tmm process to clear any data plane errors before the upgrade.

Question 13

A BIG-IP administrator notices that the management interface is unreachable, but traffic through the data plane is still flowing. The administrator suspects a control plane issue. Which daemon is responsible for managing the configuration and should be checked first?

Accepted Answer

mcpd. Mcpd is the central control plane daemon that manages configuration and inter-process communication. If mcpd fails, the management interface may become unresponsive, and configuration changes cannot be processed. The other daemons serve different roles: httpd for the GUI, tmm for data plane traffic, and bigd for health monitoring.

Answer

bigd

Answer

tmm

Answer

httpd

Question 14

An administrator is configuring a BIG-IP device to send control plane logs to a remote syslog server. The administrator wants to ensure that only messages from the control plane are sent, not data plane logs. Which configuration element should be modified?

Accepted Answer

The 'sys syslog' configuration in tmsh, setting the remote server and specifying the appropriate facility.. The 'sys syslog' configuration in tmsh is the supported method for configuring remote syslog and allows selection of facilities to separate control plane from data plane logs. The other options either use unsupported methods, non-existent objects, or data plane logging profiles, which do not meet the requirement.

Answer

The /etc/syslog-ng/syslog-ng.conf file, adding a filter for facility 'local0'.

Answer

The 'sys log-ng' configuration in tmsh, enabling the 'control-plane' filter.

Answer

The 'ltm log profile' configuration, setting the destination to the remote syslog server.

Question 15

An administrator needs to modify a control plane configuration setting that is not exposed in the BIG-IP Configuration utility. The administrator decides to use TMSH. Which command should be used to change the setting and ensure it is saved to the configuration database?

Accepted Answer

tmsh modify sys

Answer

tmsh set sys

Answer

tmsh edit sys <object>

Answer

tmsh modify sys global-settings <setting>