How many Select Two (Multi-Select) Questions questions are on this page?

This page has 9 Select Two (Multi-Select) Questions scenario questions for the F5CAB1 exam, each with detailed explanations and wrong-answer analysis.

How should I approach F5CAB1 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to F5 Certified Administrator: Install, Initial Configuration, and Upgrade questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise F5 Certified Administrator: Install, Initial Configuration, and Upgrade practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

F5CAB1

exam code

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummulti select

Full question →

An administrator is upgrading a BIG-IP system. Which THREE tasks should be part of the pre-upgrade checklist to minimize risk?

A
Create a UCS archive of the current configuration.
The UCS file is the standard backup format for BIG-IP. It includes the configuration, license, and user data. Having a verified, off-box backup is the primary safety net, allowing the administrator to revert to a known working state if the installation process encounters unforeseen issues or post-upgrade failures.
B
Install the latest iApps templates.
Why it fails: While keeping templates updated is good practice, it is not a prerequisite for the core software upgrade. Upgrading the underlying TMOS is independent of iApps templates. Mixing these maintenance tasks increases the variables during the upgrade, making it harder to troubleshoot if a problem occurs post-installation.
C
Review release notes for known issues.
Release notes contain critical information regarding bugs, behavior changes, and hardware requirements for the target version. Ignoring these can lead to unexpected service outages or security vulnerabilities. Reviewing them allows the administrator to plan for mitigation strategies before the upgrade begins, ensuring a smoother transition to the new software.
D
Run 'tmsh verify load' on the configuration.
Validating the configuration using 'tmsh verify load' ensures that there are no syntax errors that would prevent the configuration from loading after the upgrade. If the current configuration is invalid, the upgrade process might result in a system that boots but fails to load the services correctly.
E
Change the root password to a new value.
Why it fails: Changing authentication credentials during an upgrade is not recommended. It introduces an unnecessary change and could lead to lockout if the password is forgotten or does not update correctly during the migration. Security changes should be handled as separate, planned administrative events, not during a major software upgrade.

Full breakdown with real-world context →

Question 2mediummulti select

Full question →

An administrator is preparing to install a new version of BIG-IP software. Which TWO steps are considered best practices to perform before initiating the installation?

A
Create a full User Configuration Set (UCS) archive.
A UCS archive contains the entire configuration, including certificates, keys, and base system settings. It is the only reliable way to recover the device to its exact state if an upgrade fails or causes configuration errors. Always perform this backup before attempting any major software changes or system installations.
B
Disable all Virtual Servers to prevent traffic.
Why it fails: Disabling virtual servers is not a requirement for a standard software upgrade. The system upgrade process handles traffic management services by transitioning between boot locations. Disabling virtual servers would cause unnecessary service outages without providing any tangible benefit to the integrity of the software installation or configuration migration process.
C
Review the release notes for the target version.
Release notes are essential for identifying required intermediate versions, hardware support limitations, and known bugs that might affect the new installation. Ignoring these notes can lead to failed upgrades or post-installation issues that could have been avoided by verifying compatibility and upgrade path constraints before starting the installation process.
D
Reset the management interface to factory defaults.
Why it fails: Resetting the management interface to factory defaults is not required and would likely disrupt connectivity during the upgrade process. The system retains network configuration across upgrades; interfering with it manually adds unnecessary complexity and potential for error without helping the underlying software installation reach a successful completion state.
E
Delete all existing SSL certificates.
Why it fails: Deleting SSL certificates would result in massive service disruption and security failures. Certificates are preserved during the upgrade process. Removing them is entirely unnecessary and counter-productive, as they are required for the BIG-IP to perform its traffic management functions immediately after the reboot into the newly installed software version.

Full breakdown with real-world context →

Question 3hardmulti select

Full question →

When configuring a new BIG-IP VE, which TWO network settings are required to ensure the device can communicate with external licensing servers?

A
A valid default gateway in the management network.
The default gateway is required for the BIG-IP to communicate outside its local subnet to reach the internet. Without this path, the device cannot reach the F5 activation servers, causing the license request to time out and preventing the initial setup from completing.
B
A static IP address on the data plane.
Why it fails: Data plane interfaces are used for traffic load balancing, not for management or licensing communication. Licensing is strictly a management-plane activity. Configuring data plane interfaces is secondary and has no impact on the ability of the BIG-IP to contact F5 for license activation.
C
Configured DNS servers that can resolve f5.com.
BIG-IP contacts licensing servers using fully qualified domain names. If the system cannot resolve these names via DNS, the activation request will fail immediately. Proper DNS configuration ensures the BIG-IP can reach the correct activation endpoints required for a successful license check.
D
An SNMP community string.
Why it fails: SNMP is used for external monitoring of the device's health. It is not involved in the licensing process. Setting an SNMP community string will not help the device reach the F5 servers or resolve domains, making it irrelevant to the specific task of activating the license.
E
A secondary management interface.
Why it fails: The BIG-IP management plane uses a single primary management IP for all administrative tasks. A secondary interface is not required for licensing or basic configuration. Adding unneeded interfaces increases complexity and the potential for routing conflicts within the management network.

Full breakdown with real-world context →

Question 4hardmulti select

Full question →

Which TWO of the following are mandatory requirements when setting up a BIG-IP license via the 'Base Registration Key' method?

A
The device must be part of an HA cluster.
Why it fails: Licensing a BIG-IP is independent of HA configuration. A standalone unit can and often is licensed before being joined to a cluster. HA status is a secondary configuration step, and requiring it for licensing would prevent the initial setup of any standalone F5 appliance, which is a common deployment scenario.
B
The management interface must have outbound internet access.
The activation process involves an automated call-home to F5's activation servers to verify the key and generate the license. If the management interface lacks a route to the internet, this communication is blocked, and the system cannot complete the automated activation process, requiring manual offline activation instead.
C
A valid base registration key must be provided.
The base registration key is the unique identifier for the customer's entitlement. It is mandatory for the system to identify which features and throughput levels should be enabled. Without this key, the system has no reference to pull the correct license file, making it impossible to perform automated activation.
D
The device must be running in FIPS-compliant mode.
Why it fails: FIPS compliance is an optional security enhancement and is not a requirement for standard licensing. Most F5 deployments do not require FIPS mode, and enabling it adds significant configuration overhead. It has no bearing on the ability of the system to activate its license via the base registration key.
E
The user must have a physical smart card.
Why it fails: Smart cards are used for physical authentication in specific high-security environments, not for the standard licensing process. Licensing is based on the registration key and the device identity, which does not involve smart card authentication. Including this as a requirement is incorrect and irrelevant to standard F5 BIG-IP administration.

Full breakdown with real-world context →

Question 5hardmulti select

Full question →

Which THREE components are verified during the installation process of a new BIG-IP software version?

A
Software image integrity checksum.
Verifying the integrity of the ISO image via MD5 or SHA checksums is a standard step in the installation process. This ensures that the file was downloaded without corruption and is safe to write to the storage partition, preventing system failure caused by incomplete or altered installation files.
B
Available disk space in the target volume.
The installer checks the destination partition to ensure enough capacity exists for the new operating system files. If disk space is insufficient, the installation will abort to prevent a partial write, which would otherwise result in an unbootable system and require manual intervention via the serial console.
C
Local client user session count.
Why it fails: The count of active client user sessions is irrelevant to the system upgrade process. The upgrade logic focuses on the health of the hardware, the integrity of the binary images, and the configuration migration path. User sessions are terminated regardless during the reboot phase, so they are not checked.
D
Platform hardware compatibility.
The installation process validates that the hardware platform is supported by the target software version. This is critical because certain software releases drop support for older hardware models, and installing incompatible firmware could lead to hardware failure, driver crashes, or an inability to boot the device effectively.
E
External DNS server latency.
Why it fails: DNS latency is not a factor in the software installation process. The installation is performed locally from the image stored on the device or a mounted media. Network reachability to external servers is not required during the actual installation steps, making DNS performance irrelevant to the success of the upgrade.

Full breakdown with real-world context →

Question 6hardmulti select

Full question →

An administrator is setting up a new BIG-IP appliance. Which TWO steps are mandatory for the device to process application traffic?

A
Create a VLAN and assign interfaces.
A VLAN provides the L2 broadcast domain for the BIG-IP to communicate on the network. Without defining a VLAN and assigning the appropriate physical interfaces, the device has no path to receive packets from the network, making it impossible to perform any traffic management or load balancing functions.
B
Enable the 'Route Domains' feature.
Why it fails: Route Domains are an advanced feature used for multi-tenancy and overlapping IP address spaces. They are not required for a standard, simple configuration. Most basic deployments run in the default route domain (0), so enabling this feature is not a mandatory step for standard application traffic processing.
C
Define a Self-IP on the VLAN.
The self-IP is the IP address that the BIG-IP uses as its gateway or interface address for a specific VLAN. Traffic cannot be routed into or out of the VLAN without a self-IP assigned to it, which acts as the L3 endpoint for the traffic management plane.
D
Install the Advanced WAF module.
Why it fails: Advanced WAF is an optional licensed module. While it provides security, it is not required for the basic functionality of a BIG-IP to process application traffic. Basic load balancing, such as LTM functionality, works perfectly without WAF, making this an optional rather than a mandatory configuration step.
E
Configure a default gateway in the GUI.
Why it fails: A default gateway is required for traffic destined for remote networks, but it is not mandatory for all traffic processing. If the BIG-IP is on the same segment as the clients and servers, traffic can flow without a default gateway. It is important but not strictly required for every deployment.

Full breakdown with real-world context →

Question 7hardmulti select

Full question →

Which THREE steps are essential during the initial configuration of a high-availability (HA) pair after the base software is installed?

A
Synchronize the license keys across all cluster members.
Why it fails: License keys are specific to each hardware serial number or virtual device ID. They cannot be shared or synchronized across devices. Attempting to apply the same license key to multiple BIG-IP devices will lead to licensing errors and non-compliance, as each device requires its own unique entitlement.
B
Establish a device trust between the two BIG-IP devices.
Device trust is the foundation for HA. It uses SSL certificates to ensure that only authorized devices can join the device group. Without establishing trust, the units cannot communicate securely, making it impossible to synchronize configurations or share failover status between the cluster members.
C
Configure a dedicated failover network interface.
A dedicated failover link is necessary to provide a reliable path for heartbeats and sync traffic. Relying on production networks for this communication can lead to split-brain scenarios if the network becomes congested, potentially causing both devices to attempt to become active simultaneously, disrupting traffic.
D
Create a Sync-Failover device group for the units.
The Sync-Failover device group is the mechanism that allows the BIG-IP units to share configuration data and manage failover state changes. Creating this group is mandatory for any HA setup, as it defines the scope of what is synchronized and how the units behave during failover.
E
Assign the same IP address to the management interfaces of both units.
Why it fails: Management interfaces must have unique IP addresses to be accessible on the network. Assigning the same IP to both would cause an IP conflict, preventing management access to the devices and causing routing issues on the network segment. Each device must maintain its own unique identity.

Full breakdown with real-world context →

Question 8hardmulti select

Full question →

When upgrading a BIG-IP system using the Software Management utility, which TWO of the following tasks are strictly required to ensure a successful transition between major software versions?

A
Install all hotfixes available on the F5 Downloads site before the major upgrade.
Why it fails: Installing every hotfix is unnecessary and can complicate the upgrade process. Only the target version and its required base ISO are needed. Unnecessary hotfixes increase the surface area for errors and consume valuable storage space on the boot volume without providing any tangible benefit to the upgrade.
B
Validate the configuration using the 'tmsh load sys config verify' command.
This command checks the configuration file for syntax errors and compatibility issues against the current binary. Failing to verify the config before an upgrade can result in the system failing to load the configuration after rebooting into the new version, leading to an unusable state.
C
Delete all existing snapshots to free up space in the /var partition.
Why it fails: Snapshots are stored in /var, but the upgrade happens in the boot volume partition. Deleting snapshots does not provide the space required for the ISO installation on the boot volume. This action is unrelated to the software upgrade installation space requirements and risks losing valuable configuration history.
D
Confirm sufficient free space on the target boot location partition.
The BIG-IP installation process requires adequate space on the destination partition to extract the ISO image. Insufficient space will cause the installation to fail, potentially leaving the boot volume in a corrupted state. Always verify available volume capacity before initiating the install process for any new version.
E
Reboot the unit into the current version to clear RAM cache.
Why it fails: Rebooting into the current version does not impact the installation process for a different boot slot. RAM is cleared upon any reboot regardless of the target slot. This step provides no functional benefit for the software upgrade process and simply adds unnecessary downtime to the maintenance window.

Full breakdown with real-world context →

Question 9mediummulti select

Full question →

An administrator is preparing to install a new BIG-IP virtual edition (VE) license using the command line interface. Which TWO files or parameters are strictly required to complete a manual activation when the device lacks direct internet access? (Choose two.)

A
The unique Dossier generated from the unactivated BIG-IP VE instance.
The dossier is an encrypted string containing hardware fingerprint data unique to the BIG-IP VE instance that must be provided to the F5 licensing server to generate a valid, cryptographically signed license file. Without this exact dossier, the licensing portal cannot bind the entitlement.
B
The signed License text file obtained from the F5 activation portal.
The signed license file returned by the F5 portal contains the explicit feature entitlements and duration parameters authorized for the deployment. Pasting or uploading this text file directly into the BIG-IP system activates the provisioned modules and operational capabilities.
C
The root administrator password hash exported from the configuration utility.
Why it fails: The root password hash is irrelevant to licensing; manual activation needs the licence text and the BIG-IP VE dossier (registration key), which are matched to the device. It tempts because root credentials are required for administrative CLI access, but that scenario is device administration, not licence fulfilment.
D
The enterprise registration key provided in the F5 software purchase order email.
Why it fails: While the registration key is necessary to generate the dossier on the F5 portal, the dossier itself and the resulting license file are the direct operational artifacts required on the BIG-IP CLI during an offline manual activation session. The raw key alone cannot activate the uninitialized VE.
E
The private SSL certificate used for securing administrative web management traffic.
Why it fails: Administrative SSL certificates secure HTTPS access to the Configuration Utility but play no role in licensing validation or module provisioning. The system generates default self-signed certificates for initial management access before custom PKI materials are imported.

Full breakdown with real-world context →

Study guide

F5CAB1 study guide

Read the full exam guide to reinforce the concepts behind these scenario questions.

Read now

Scored practice sessions

Quick scored rounds with instant marking and a written explanation per question.

F5CAB1 Practice Test 1 — 25 Questions→F5CAB1 Practice Test 2 — 25 Questions→F5CAB1 Practice Test 3 — 25 Questions→F5CAB1 Practice Exam 1 — 20 Questions→F5CAB1 Practice Exam 2 — 20 Questions→F5CAB1 Practice Exam 3 — 20 Questions→F5CAB1 Practice Exam 4 — 20 Questions→Free F5CAB1 Practice Test 1 — 30 Questions→Free F5CAB1 Practice Test 2 — 30 Questions→

Exam simulator

Take a full practice exam

75–120 questions · 120-min timer · PBQs first · Pearson VUE–style score (300–1000)

Start exam

Domain-focused practice

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

Install, Initial Configuration, and Upgrade

Practice by scenario

Practise one question format at a time: exhibits, multi-select, drag-and-drop, troubleshooting.

Browse scenarios

Topic-level practice

Each topic page collects the questions that test one concept, plus the theory behind it.

Install, Initial Configuration, and Upgrade practice questions F5CAB1 fundamentals practice questions F5CAB1 scenario practice questions F5CAB1 troubleshooting practice questions

Common exam traps

•Answering from memory before reading the full scenario.
•Missing a constraint such as cost, availability, security, scope or command context.
•Choosing a broad answer when the question asks for the most specific fix.
•Ignoring why the wrong options are tempting.

Where to go next

F5 Certified Administrator: Install, Initial Configuration, and Upgrade exam guide All F5CAB1 questions All practice sets

These F5CAB1 practice questions are part of Courseiva's free F5 certification practice question bank. Courseiva provides original exam-style F5CAB1 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related F5CAB1 topic practice pages

Install, Initial Configuration, and Upgrade practice questions

F5CAB1 fundamentals practice questions

F5CAB1 scenario practice questions

F5CAB1 troubleshooting practice questions

Practice scenarios

An administrator is upgrading a BIG-IP system. Which THREE tasks should be part of the pre-upgrade checklist to minimize risk?

An administrator is preparing to install a new version of BIG-IP software. Which TWO steps are considered best practices to perform before initiating the installation?

When configuring a new BIG-IP VE, which TWO network settings are required to ensure the device can communicate with external licensing servers?

Which TWO of the following are mandatory requirements when setting up a BIG-IP license via the 'Base Registration Key' method?

Which THREE components are verified during the installation process of a new BIG-IP software version?

An administrator is setting up a new BIG-IP appliance. Which TWO steps are mandatory for the device to process application traffic?

Which THREE steps are essential during the initial configuration of a high-availability (HA) pair after the base software is installed?

When upgrading a BIG-IP system using the Software Management utility, which TWO of the following tasks are strictly required to ensure a successful transition between major software versions?

An administrator is preparing to install a new BIG-IP virtual edition (VE) license using the command line interface. Which TWO files or parameters are strictly required to complete a manual activation when the device lacks direct internet access? (Choose two.)