F5CAB4 Quick Quiz — 10 Questions

Question 1

An administrator is troubleshooting a BIG-IP device that is not responding to configuration changes made via the GUI. The administrator suspects that a control plane service is not running properly. Which two control plane services should the administrator check to ensure that the GUI and configuration management are operational? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

mcpd. The GUI and configuration management rely on httpd and mcpd. httpd serves the web interface and REST API, while mcpd processes configuration changes. If either service is not running, the administrator may experience an unresponsive GUI or failure to apply changes. Checking these services with 'tmsh show sys service' or 'bigstart status' is a key troubleshooting step.

Answer

bigd

Answer

tmm

Answer

named

Question 2

An administrator needs to restrict administrative access to the BIG-IP system so that only specific management workstations can reach the Configuration Utility and SSH. Which control plane mechanism should be configured to implement this access control?

Accepted Answer

Define a management packet filter policy on the management interface.. Implementing packet filters on the management interface is the standard security practice to harden the control plane. By defining an Allow rule for authorized subnets and a Drop rule for all other traffic, you prevent unauthorized reconnaissance and brute-force attempts. This is critical for maintaining the integrity of the administrative plane, ensuring that management access remains restricted to secure, trusted administrative jump hosts or network segments.

Answer

Configure an iRule on the Management Virtual Server.

Answer

Enable the 'Allow All' policy in the Device Service Group.

Answer

Modify the global db variable 'httpd.allowed.ips'.

Question 3

An administrator wants to restrict the types of ciphers used for SSH access to the BIG-IP system. Which configuration file or tool should be modified?

Accepted Answer

Modify the sshd_config file.. SSH access is governed by the 'sshd' service configuration. Modifying the configuration to limit ciphers is a standard task for hardening the management plane. By enforcing stronger ciphers, the administrator protects administrative sessions from potential cryptographic attacks, ensuring that only secure, modern encryption methods are used when managing the BIG-IP, which is essential for maintaining a secure and compliant control plane environment.

Answer

Update the global firewall policy.

Answer

Change the system time settings.

Answer

Modify the iRule settings.

Question 4

A BIG-IP device has lost synchronization with its peer. Which control plane component is responsible for detecting this state and reporting it?

Accepted Answer

mcpd. The 'mcpd' process relies on the 'configsync' functionality, which monitors the checksums of the configuration files across peers. When a mismatch is detected, mcpd triggers alerts and updates the system status. This is critical for maintaining high availability, as configuration drift between peers can lead to asymmetric traffic behavior or unpredictable failover results, making it vital for administrators to promptly resolve sync issues to ensure operational consistency.

Answer

TMM

Answer

bigd

Answer

snmpd

Question 5

Which TWO of the following tasks are performed by the BIG-IP control plane rather than the data plane?

Accepted Answer

Synchronizing configuration changes between high-availability peers.. The control plane manages the system's configuration, authentication, and administrative interactions. Tasks like updating the device configuration via TMSH or processing SSH/GUI logins occur in the control plane environment (Linux OS). Conversely, traffic steering and packet manipulation occur within the TMM, which is the data plane. Distinguishing these domains is vital for performance tuning, resource allocation, and troubleshooting connectivity issues, as control plane exhaustion often differs significantly from data plane resource depletion.

Answer

Processing SSL handshakes for high-volume application traffic.

Answer

Executing iRules for Layer 7 load balancing decisions.

Answer

Forwarding packets based on the virtual server routing table.

Question 6

Which utility is primarily used for command-line administrative control plane management on a BIG-IP system?

Accepted Answer

tmsh. TMSH (Traffic Management Shell) is the primary CLI interface for BIG-IP control plane administration. It provides a standardized environment for configuring objects, managing system settings, and viewing status. Familiarity with TMSH is essential for F5 administrators because it offers granular control over the system, allows for scriptable automation, and serves as the bridge between the administrative user and the underlying mcpd configuration daemon, which ultimately implements the desired state.

Answer

bash

Answer

tcpdump

Answer

tshark

Question 7

An administrator is planning to upgrade the BIG-IP software. What is the recommended first step to ensure control plane recovery in case of an upgrade failure?

Accepted Answer

Generate a UCS archive.. Creating a User Configuration Set (UCS) archive is the standard method for backing up the BIG-IP configuration. Having a valid UCS file allows an administrator to restore the complete system state, including certificates and licenses, to a previous working version. This is the most crucial step in any control plane administration task involving significant configuration changes or software upgrades, as it provides a safety net for rapid disaster recovery.

Answer

Perform a full system snapshot via the hypervisor.

Answer

Export the device certificate bundle.

Answer

Copy the /config directory to a remote server.

Question 8

When managing multiple BIG-IP devices, why is it recommended to use a centralized NTP server for all devices?

Accepted Answer

To ensure accurate log correlation and certificate validity.. Time synchronization is vital for distributed systems, especially those performing SSL/TLS handshakes and logging. If clocks are out of sync, log entries become difficult to correlate during forensic analysis, and certificate validation can fail. Centralizing NTP ensures consistency across the entire environment, which is a foundational requirement for both security compliance and effective troubleshooting of the control plane across multiple devices.

Answer

To increase the throughput of the BIG-IP system.

Answer

To reduce the CPU utilization of the management plane.

Answer

To automate the software upgrade process across devices.

Question 9

An administrator needs to back up the full control-plane configuration of a BIG-IP device, but the security policy forbids storing user password hashes in the archive. The administrator wants a single archive that can later be restored with 'tmsh load sys ucs'. Which action should be performed?

Accepted Answer

Run 'tmsh save sys ucs /var/local/ucs/backup.ucs no-passwords' to create a UCS archive that excludes password information.. A UCS archive created with the 'no-passwords' modifier omits credential hashes while still capturing the full control-plane configuration, so it satisfies the no-password-storage policy and remains restorable. Other approaches either produce a different file type, require unsupported manual editing, or fail to remove the sensitive password data from the archive.

Answer

Run 'tmsh save sys ucs /var/local/ucs/backup.ucs' from the bash shell using the '--master-key' flag to encrypt all credentials.

Answer

Run 'tmsh save sys ucs /var/local/ucs/backup.ucs' and then manually delete the /config/bigip.conf file inside the archive before restoring.

Answer

Run 'tmsh save sys config file /var/local/ucs/backup.scf' to export a flat configuration file that can be restored with 'tmsh load sys ucs'.

Question 10

When a BIG-IP system is in a High Availability (HA) pair, which component is primarily responsible for ensuring that the control plane configuration remains synchronized between devices?

Accepted Answer

The ConfigSync process.. The ConfigSync feature is dedicated to synchronizing the configuration state between BIG-IP units in an HA group. It ensures that the standby unit maintains a mirrors-image of the active unit's settings. Understanding the role of ConfigSync is essential for administrators, as it guarantees that failover events are seamless and that the standby device is always prepared to assume the traffic processing role with identical configuration parameters.

Answer

The Traffic Management Microkernel (TMM).

Answer

The Configuration Utility (GUI).

Answer

The Linux kernel.