F5CAB4 Practice Questions

Question 1

An administrator is troubleshooting a BIG-IP device that is not responding to configuration changes made via the GUI. The administrator suspects that a control plane service is not running properly. Which two control plane services should the administrator check to ensure that the GUI and configuration management are operational? (Choose two.)

Accepted Answer

mcpd. The GUI and configuration management rely on httpd and mcpd. httpd serves the web interface and REST API, while mcpd processes configuration changes. If either service is not running, the administrator may experience an unresponsive GUI or failure to apply changes. Checking these services with 'tmsh show sys service' or 'bigstart status' is a key troubleshooting step.

Answer

bigd

Answer

tmm

Answer

named

Question 2

An administrator needs to restrict administrative access to the BIG-IP system so that only specific management workstations can reach the Configuration Utility and SSH. Which control plane mechanism should be configured to implement this access control?

Accepted Answer

Define a management packet filter policy on the management interface.. Implementing packet filters on the management interface is the standard security practice to harden the control plane. By defining an Allow rule for authorized subnets and a Drop rule for all other traffic, you prevent unauthorized reconnaissance and brute-force attempts. This is critical for maintaining the integrity of the administrative plane, ensuring that management access remains restricted to secure, trusted administrative jump hosts or network segments.

Answer

Configure an iRule on the Management Virtual Server.

Answer

Enable the 'Allow All' policy in the Device Service Group.

Answer

Modify the global db variable 'httpd.allowed.ips'.

Question 3

An administrator wants to restrict the types of ciphers used for SSH access to the BIG-IP system. Which configuration file or tool should be modified?

Accepted Answer

Modify the sshd_config file.. SSH access is governed by the 'sshd' service configuration. Modifying the configuration to limit ciphers is a standard task for hardening the management plane. By enforcing stronger ciphers, the administrator protects administrative sessions from potential cryptographic attacks, ensuring that only secure, modern encryption methods are used when managing the BIG-IP, which is essential for maintaining a secure and compliant control plane environment.

Answer

Update the global firewall policy.

Answer

Change the system time settings.

Answer

Modify the iRule settings.

Question 4

A BIG-IP device has lost synchronization with its peer. Which control plane component is responsible for detecting this state and reporting it?

Accepted Answer

mcpd. The 'mcpd' process relies on the 'configsync' functionality, which monitors the checksums of the configuration files across peers. When a mismatch is detected, mcpd triggers alerts and updates the system status. This is critical for maintaining high availability, as configuration drift between peers can lead to asymmetric traffic behavior or unpredictable failover results, making it vital for administrators to promptly resolve sync issues to ensure operational consistency.

Answer

TMM

Answer

bigd

Answer

snmpd

Question 5

Which TWO of the following tasks are performed by the BIG-IP control plane rather than the data plane?

Accepted Answer

Synchronizing configuration changes between high-availability peers.. The control plane manages the system's configuration, authentication, and administrative interactions. Tasks like updating the device configuration via TMSH or processing SSH/GUI logins occur in the control plane environment (Linux OS). Conversely, traffic steering and packet manipulation occur within the TMM, which is the data plane. Distinguishing these domains is vital for performance tuning, resource allocation, and troubleshooting connectivity issues, as control plane exhaustion often differs significantly from data plane resource depletion.

Answer

Processing SSL handshakes for high-volume application traffic.

Answer

Executing iRules for Layer 7 load balancing decisions.

Answer

Forwarding packets based on the virtual server routing table.

Question 6

Which utility is primarily used for command-line administrative control plane management on a BIG-IP system?

Accepted Answer

tmsh. TMSH (Traffic Management Shell) is the primary CLI interface for BIG-IP control plane administration. It provides a standardized environment for configuring objects, managing system settings, and viewing status. Familiarity with TMSH is essential for F5 administrators because it offers granular control over the system, allows for scriptable automation, and serves as the bridge between the administrative user and the underlying mcpd configuration daemon, which ultimately implements the desired state.

Answer

bash

Answer

tcpdump

Answer

tshark

Question 7

An administrator is planning to upgrade the BIG-IP software. What is the recommended first step to ensure control plane recovery in case of an upgrade failure?

Accepted Answer

Generate a UCS archive.. Creating a User Configuration Set (UCS) archive is the standard method for backing up the BIG-IP configuration. Having a valid UCS file allows an administrator to restore the complete system state, including certificates and licenses, to a previous working version. This is the most crucial step in any control plane administration task involving significant configuration changes or software upgrades, as it provides a safety net for rapid disaster recovery.

Answer

Perform a full system snapshot via the hypervisor.

Answer

Export the device certificate bundle.

Answer

Copy the /config directory to a remote server.

Question 8

When managing multiple BIG-IP devices, why is it recommended to use a centralized NTP server for all devices?

Accepted Answer

To ensure accurate log correlation and certificate validity.. Time synchronization is vital for distributed systems, especially those performing SSL/TLS handshakes and logging. If clocks are out of sync, log entries become difficult to correlate during forensic analysis, and certificate validation can fail. Centralizing NTP ensures consistency across the entire environment, which is a foundational requirement for both security compliance and effective troubleshooting of the control plane across multiple devices.

Answer

To increase the throughput of the BIG-IP system.

Answer

To reduce the CPU utilization of the management plane.

Answer

To automate the software upgrade process across devices.

Question 9

An administrator needs to back up the full control-plane configuration of a BIG-IP device, but the security policy forbids storing user password hashes in the archive. The administrator wants a single archive that can later be restored with 'tmsh load sys ucs'. Which action should be performed?

Accepted Answer

Run 'tmsh save sys ucs /var/local/ucs/backup.ucs no-passwords' to create a UCS archive that excludes password information.. A UCS archive created with the 'no-passwords' modifier omits credential hashes while still capturing the full control-plane configuration, so it satisfies the no-password-storage policy and remains restorable. Other approaches either produce a different file type, require unsupported manual editing, or fail to remove the sensitive password data from the archive.

Answer

Run 'tmsh save sys ucs /var/local/ucs/backup.ucs' from the bash shell using the '--master-key' flag to encrypt all credentials.

Answer

Run 'tmsh save sys ucs /var/local/ucs/backup.ucs' and then manually delete the /config/bigip.conf file inside the archive before restoring.

Answer

Run 'tmsh save sys config file /var/local/ucs/backup.scf' to export a flat configuration file that can be restored with 'tmsh load sys ucs'.

Question 10

When a BIG-IP system is in a High Availability (HA) pair, which component is primarily responsible for ensuring that the control plane configuration remains synchronized between devices?

Accepted Answer

The ConfigSync process.. The ConfigSync feature is dedicated to synchronizing the configuration state between BIG-IP units in an HA group. It ensures that the standby unit maintains a mirrors-image of the active unit's settings. Understanding the role of ConfigSync is essential for administrators, as it guarantees that failover events are seamless and that the standby device is always prepared to assume the traffic processing role with identical configuration parameters.

Answer

The Traffic Management Microkernel (TMM).

Answer

The Configuration Utility (GUI).

Answer

The Linux kernel.

Question 11

An administrator needs to restrict administrative access to the BIG-IP system so that only specific source IP addresses can reach the Configuration Utility. Which feature should be configured to ensure this security requirement?

Accepted Answer

Update the Management IP Allow list in System Configuration.. Restricting management access via the Management IP allows administrators to define a whitelist of trusted networks. This is a critical security practice in F5 Control Plane Administration to prevent unauthorized access to the management plane from untrusted segments. By using the 'Allow' list under System > Configuration > Device > Management IP, the BIG-IP will drop any packets originating from non-authorized IPs, effectively securing the administrative interface from external threats.

Answer

Enable Packet Filtering on the external VLAN.

Answer

Configure an iRule to drop traffic on the management port.

Answer

Modify the global Firewall policy for the Data Plane.

Question 12

Refer to the exhibit. Why is it important for the administrator to review the 'show sys hardware' output when troubleshooting a control plane issue?

Accepted Answer

It verifies that the control plane has access to sufficient physical resources.. Hardware status directly informs the administrator about resource capacity, such as CPU cores or memory, which are critical for the control plane. If hardware components are failing (e.g., memory errors, fan failure), it can manifest as sluggish GUI response or mcpd instability. Reviewing this output helps differentiate between software configuration issues and underlying hardware stress, which is essential for accurate diagnostics and determining whether an RMA or physical maintenance is required.

Answer

It displays the current traffic throughput of all virtual servers.

Answer

It lists the active users currently logged into the device.

Answer

It is required to update the system's licensing information.

Question 13

Which log file is most useful for troubleshooting administrative login attempts and authentication failures on the BIG-IP control plane?

Accepted Answer

/var/log/secure. The /var/log/secure log file is the standard Linux repository for authentication-related events. On a BIG-IP, this includes SSH access, GUI login attempts, and PAM-related authentication activities. Monitoring this file is essential for F5 administrators to detect brute-force attacks, troubleshoot credential issues, and maintain a secure control plane by keeping track of who is accessing the device and when.

Answer

/var/log/ltm

Answer

/var/log/messages

Answer

/var/log/audit

Question 14

A BIG-IP administrator is preparing to upgrade the TMOS software on a device. Before the upgrade, the administrator must ensure that the current configuration is backed up and that the device can be restored if the upgrade fails. Which tmsh command creates a full configuration backup archive that can be used for restoration?

Accepted Answer

save sys ucs /var/local/ucs/backup.ucs. A UCS archive is the standard full backup format on BIG-IP, containing configuration, licenses, and certificates. The save sys ucs command creates this archive and can be directed to a specific path. Other commands either save only the running configuration to standard files or are not valid tmsh commands for creating backups.

Answer

create sys backup /var/local/ucs/backup.ucs

Answer

export sys config /var/local/ucs/backup.ucs

Answer

save sys config /var/local/ucs/backup.ucs

Question 15

A BIG-IP administrator is configuring a new device and needs to set up the control plane to allow remote management via SSH and HTTPS. The administrator wants to ensure that only secure protocols are used and that access is restricted to specific management IP addresses. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Enable SSH and disable Telnet access on the management interface.. To secure remote management, the administrator should enable SSH and disable Telnet, and configure a management port lockdown to restrict access to specific IP addresses. These actions ensure that only secure protocols are used and that access is limited to authorized addresses, meeting the security requirements.

Answer

Enable HTTP access and disable HTTPS access to improve performance.

Answer

Configure the management IP address and management route using tmsh.

Answer

Set up a default route for the management interface.

F5 Certified Administrator: Control Plane Administration F5CAB4 practice test

Three ways to study

Study F5CAB4 by domain

Study F5CAB4 by topic

Control Plane Administration practice questions

F5CAB4 fundamentals practice questions

F5CAB4 scenario practice questions

F5CAB4 troubleshooting practice questions

F5 Certified Administrator: Control Plane Administration practice questions