Dependable F5CAB1 Exam Dumps to Become F5 Certified
Get Ready with F5CAB1 Exam Dumps (2026)
F5 F5CAB1 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 15
How can the BIG-IP Administrator tell when anunlicensed modulehas been provisioned?
- A. A BIG-IP does not allow unlicensed modules to be provisioned.
- B. When provisioning an unlicensed module, a warning will appear.
- C. AProvisioning Warningwill be displayed in the GUI in the upper left corner.
Answer: C
Explanation:
The BIG-IP system has built-in licensing enforcement.
If an administrator provisions a module that the device isnot licensedto run, the system will still allow the provisioning action to occurinitially, but the system detects the mismatch and displays an alert.
What actually happens:
* The GUI places awarning bannerin theupper-left cornerlabeled something similar to:"Provisioning Warning"
* This appears immediately after provisioning a module that is not included in the active license.
* The system remains in an "inconsistent state" until the module is disabled again or the license is updated.
This is the visual cue BIG-IP uses to indicate that a module was provisioned without valid licensing.
Why the other options are incorrect:
A). "A BIG-IP does not allow unlicensed modules to be provisioned."
* Not true. BIG-IPdoesallow provisioning, but warns afterward.
B). "A warning will appear when provisioning an unlicensed module."
* The warning doesnotappear during the provisioning step itself.
* It appearsafter provisioning, in the main GUI, as a system banner.
NEW QUESTION # 16
The Configuration Utility of a BIG-IP device is currently accessible via its management IP10.53.1.245from all VLANs.
The BIG-IP Administrator needs to restrict access so only hosts from the10.0.0.0/24subnet can access the Configuration Utility.
Which TMSH command accomplishes this?
- A. (tmos)# create /net acl MGMT.HTTP rule add { (permit tcp 10.0.0.0 0.0.0.255 host 10.53.1.245 http) }
- B. (tmos)# create /net acl MGMT.HTTP rule add { (permit tcp 10.0.0.0/24 10.53.1.245 http) (deny ip any any http) }
- C. (tmos)# modify /sys httpd allow replace-all-with {10.0.0.0/24}
- D. (tmos)# modify /ltm httpd allow replace-all-with {10.0.0.0/24}
Answer: C
Explanation:
BIG-IP controls access to the web-based Configuration Utility (TMUI) through the/sys httpd allowlist. This parameter specifies which client IPs or subnets may initiate HTTP/HTTPS connections to the management interface.
To restrict TMUI access toonlythe 10.0.0.0/24 subnet:
* The correct method is tomodify the HTTPD allow listso that it contains only this subnet.
* This requires replacing the entire current list with the new subnet using:
modify /sys httpd allow replace-all-with {10.0.0.0/24}
This ensures thatonlyclients within 10.0.0.0/24 can reach the Configuration Utility.
Why the other options are incorrect:
* Options A and Ccreate network ACL objects under /net acl, which apply to data-plane traffic, not management-plane TMUI access. TMUI access is not controlled by LTM ACLs but by the HTTPD allow directive.
* Option Bis incorrect syntax and references /ltm httpd, which is not the proper object; the correct hierarchy is /sys httpd.
Thus, only modifying the/sys httpd allowlist achieves the required restriction.
NEW QUESTION # 17
When is theLicense Service Check Dateenforced on a BIG-IP system?
- A. After editing a virtual server
- B. During system startup
- C. During a software install
Answer: C
Explanation:
TheService Check Datedetermines whether a particular software version is allowed to run under the device's license.
* When installing or upgrading TMOS, the installer checks theService Check Datestored in the BIG-IP license file.
* If the license date isolderthan the minimum required for the target version, the software installation is blocked.
* This check happensspecifically during a software install, not during routine device operations.
Editing virtual servers or system startup do not trigger this validation.
Thus, the enforcement happensduring software installation.
NEW QUESTION # 18
For security reasons, a BIG-IP Administrator needs to specify allowable IP ranges for access to the Configuration Utility (WebUI).
The exhibit shows the User Administration section of the Configuration Utility.
The administrator could not find any setting that explicitly restricts access to the Configuration Utility.
Which one of the following is a reason for that?
- A. The administrator needs to switch to the "Advanced" view mode in order to display the relevant setting
- B. Restricting access to the Configuration Utility can only be done from the Command Line Interface
- C. To avoid locking out the administrator, recent versions of BIG-IP no longer allow restricting administrator access to the Configuration Utility by source IP address
- D. The administrator must restrict access by IP address for SSH, which will implicitly restrict access to the Configuration Utility
Answer: B
Explanation:
The screenshot shown is from the User Administration section of the BIG-IP GUI.
This section controls:
Root and Admin passwords
SSH Access
SSH IP Allow settings
However, it does not contain any controls for restricting access to the WebUI (TMUI). BIG-IP does not provide TMUI access restrictions from this part of the GUI.
Access to the web-based Configuration Utility is controlled by the httpd allow list, configured through TMSH:
tmsh modify /sys httpd allow { <IP/subnet> }
This setting is not displayed in the User Administration panel, and in many BIG-IP versions, the
httpd allow list is only configurable from the CLI, not the GUI.
Therefore, the administrator cannot find the setting in the screen shown because:
TMUI access restriction is not located in this GUI section
It must be configured using tmsh under /sys httpd allow
This is why Option A is correct.
NEW QUESTION # 19
Which one of the following is a port and protocol combination allowed by the Allow Default setting for Port Lockdown?
- A. TCP 80
- B. UDP 8443
- C. TCP 443
Answer: C
Explanation:
Port Lockdown controls which ports and protocols a Self IP will respond to.
The Allow Default setting permits only a predefined set of BIG-IP internal and required service ports.
The Allow Default list includes:
TCP 443 HTTPS (Management/TMUI access via Self-IP)
TCP 4353 CMI (device sync)
TCP/UDP ports related to HA communication
Other essential internal F5 ports
Why TCP 443 is correct:
It is one of the officially allowed ports under Allow Default.
It enables HTTPS/TMUI access through a Self IP.
NEW QUESTION # 20
A BIG-IP Administrator plans to upgrade a BIG-IP device to the latest TMOS version. Which two tools could the administrator leverage to verify known issues for the target versions? (Choose two.)
- A. F5 Bug Tracker
- B. F5 iHealth
- C. F5 Downloads
- D. F5 End User Diagnostics (EUD)
- E. F5 University
Answer: A,B
Explanation:
When performing a TMOS upgrade, F5 recommends validating the target software version to ensure that the release does not contain defects that may impact system behavior. The upgrade preparation process includes checking for known issues, validating compatibility, and reviewing advisory information for the intended version. Two primary F5 tools serve this purpose:
B). F5 iHealth
iHealth is a cloud-based diagnostic and analysis platform used to evaluate the operational state of a BIG-IP system.
Administrators upload a QKView file to iHealth to receive an automated assessment of the system.
As part of upgrade planning, iHealth provides:
Version-specific issue analysis, comparing the system's configuration and hardware against F5's internal catalog of published issues.
Upgrade advisories, identifying potential risks such as deprecated features, module compatibility concerns, or changes in behavior between TMOS versions.
Checks against known defects, allowing administrators to determine whether the target TMOS version contains issues relevant to their deployment.
This aligns with F5's recommended upgrade workflow, where iHealth is used before upgrading to confirm system readiness and detect software-level concerns.
D). F5 Bug Tracker
The Bug Tracker is F5's dedicated interface for reviewing software defects across TMOS releases.
It enables administrators to:
Search for known bugs by TMOS version, module, severity, or defect ID.
Review the status of defects (open, resolved, fixed in later releases).
Identify whether high-impact or security-related issues are associated with the target upgrade version.
F5 documentation emphasizes reviewing known defects prior to installation of new software images, making the Bug Tracker a critical resource for upgrade validation.
NEW QUESTION # 21
For security reasons, a BIG-IP Administrator needs to specify allowable IP ranges for access to the Configuration Utility (WebUI).
The exhibit shows the User Administration section of the Configuration Utility.
The administrator could not find any setting that explicitly restricts access to the Configuration Utility.
Which one of the following is a reason for that?
- A. The administrator needs to switch to the "Advanced" view mode in order to display the relevant setting
- B. Restricting access to the Configuration Utility can only be done from the Command Line Interface
- C. To avoid locking out the administrator, recent versions of BIG-IP no longer allow restricting administrator access to the Configuration Utility by source IP address
- D. The administrator must restrict access by IP address for SSH, which will implicitly restrict access to the Configuration Utility
Answer: B
Explanation:
The screenshot shown is from theUser Administrationsection of the BIG-IP GUI.
This section controls:
* Root and Admin passwords
* SSH Access
* SSH IP Allow settings
However,it does not contain any controls for restricting access to the WebUI (TMUI).
BIG-IP does not provide TMUI access restrictions from this part of the GUI.
Access to the web-based Configuration Utility is controlled by thehttpd allow list, configured through TMSH:
tmsh modify /sys httpd allow { <IP/subnet> }
This setting is not displayed in the User Administration panel, and in many BIG-IP versions, the httpd allow list isonly configurable from the CLI, not the GUI.
Therefore, the administrator cannot find the setting in the screen shown because:
* TMUI access restriction isnotlocated in this GUI section
* It must be configured usingtmshunder/sys httpd allow
This is whyOption Ais correct.
NEW QUESTION # 22
Which BIG-IP feature allows you to customize traffic management?
- A. Route
- B. Pool
- C. iRule
- D. SSL Profile
Answer: C
Explanation:
iRules are used to define custom traffic management behavior based on user-defined conditions and actions.
NEW QUESTION # 23
The device is currently onv15.1.2.1.
The BIG-IP Administrator needs to boot the device back tov13.1.0.6to gather data for troubleshooting.
The system shows:
Sys::Software Status
Volume Product Version Build Active Status Allowed
HD1.1 BIG-IP 15.1.2.1 0.0.10 yes complete yes
HD1.2 BIG-IP 13.1.0.6 0.0.3 no complete yes
Which is the correct command-line sequence to boot the device to version13.1.0.6?
- A. Use tmsh to select a new boot volume, tmsh reboot HD1.2
- B. switchboot -I HD1.2, then reboot
- C. Use tmsh to select a new boot volume, tmsh switchboot HD1.2
- D. switchboot -b HD1.2, then reboot
Answer: D
Explanation:
To change the boot volume on a BIG-IP system from one installed TMOS version to another, the correct CLI tool is:
switchboot
The correct syntax uses the-bflag:
switchboot -b <volume>
This command marks the specified boot location as the one to be used on the next reboot.
Thus, to boot intoHD1.2which contains13.1.0.6, the sequence is:
* Mark HD1.2 as the next boot location:
* switchboot -b HD1.2
* Reboot the system:
* reboot
This is the standard and officially supported method for selecting a different installed volume.
Why the other options are incorrect:
A). "tmsh reboot HD1.2"
* There is no such tmsh syntax.
* Boot volume cannot be selected by adding a parameter to reboot.
C). switchboot -I HD1.2
* The -I flag is invalid. Only -b is used.
D). "tmsh switchboot HD1.2"
* switchboot isnota tmsh command; it is a system-level shell utility.
Therefore,Option Bis the correct and valid command sequence.
NEW QUESTION # 24
Which of the following are resource allocation settings for modules? (Pick the 2 correct responses below)
- A. Dedicated
- B. Maximum
- C. Limited
- D. Nominal
Answer: A,D
Explanation:
Comprehensive and Detailed Explanation From BIG-IP Administration - Install, Initial Configuration, and Upgrade:
When provisioning modules on a BIG-IP system, F5 provides specific resource allocation settings that define how system resources - CPU, memory, and disk - are distributed to each licensed module. The two valid and officially recognised allocation settings are Nominal and Dedicated .
Nominal instructs the system to allocate a moderate, balanced share of resources to the module. It allows the module to function effectively while sharing system resources with other provisioned modules. This is the most commonly used setting in multi-module deployments.
Dedicated allocates the maximum available system resources exclusively to a single module. When this setting is applied, it is typically the only module provisioned, as it consumes resources at a level that prevents other modules from operating concurrently in a meaningful capacity.
Option A - Maximum is not a valid BIG-IP provisioning allocation level; it does not appear in the official provisioning interface or documentation as a selectable resource tier.
Option C - Limited similarly does not exist as a defined resource allocation setting within BIG-IP module provisioning. It may superficially resemble valid terminology but has no standing in the official provisioning framework.
Administrators access these settings via System > Resource Provisioning in the Configuration Utility, where each licensed module displays its available allocation options.
Reference Topics: Module Resource Provisioning, Nominal vs. Dedicated Allocation, System Resource Management - BIG-IP Administration Study Guide.
NEW QUESTION # 25
An organization is planning to upgrade a BIG-IP system from 16.1.x to 17.1.x.
For a successful upgrade, the Service Check Date must be equal to or newer than the License Check Date required for 17.1.x.
Which command will show the Service Check Date on the BIG-IP system being upgraded?
- A. grep "Service check date" /config/svc_chk_date.dat
- B. grep "Service check date" /config/bigip.conf
- C. grep "Service check date" /config/BigDB.dat
- D. grep "Service check date" /config/bigip.license
Answer: D
Explanation:
BIG-IP licensing information, including the Service Check Date, is stored in the file:
/config/bigip.license
This file contains all license attributes downloaded from the F5 licensing server, including:
License key
Licensed modules
Useful life date
Service check date
The Service Check Date determines whether the system is eligible for upgrades to specific TMOS versions. When reviewing upgrade readiness, administrators extract this value directly from the license file with:
grep "Service check date" /config/bigip.license
Why the other options are incorrect:
/config/bigip.conf stores BIG-IP configuration objects, not license metadata.
/config/svc_chk_date.dat is not a valid file in the licensing system; it does not contain license parameters.
/config/BigDB.dat stores internal database values, not licensing attributes.
Thus, only the bigip.license file contains the correct licensing information required for verifying upgrade eligibility.
NEW QUESTION # 26
Which port is an exception to the Port Lockdown function of Self-IPs if a device-group synchronization cluster is configured?
- A. TCP 443
- B. UDP 53
- C. TCP 4353
Answer: C
Explanation:
Self-IPs implement a security feature known asPort Lockdown, which limits which services are reachable on a Self-IP.
However, certain services required for BIG-IP device-to-device communication bypass Port Lockdown to ensure cluster and HA functionality.
TCP 4353
* TCP port4353is used byDevice Service Clustering (DSC)for:
* Device trust establishment
* Configuration synchronization
* Failover communication
* Because BIG-IP devices must always be able to communicate for HA functions to remain operational, port 4353 isexempt from Port Lockdown rules.
Why the other options are incorrect
A). TCP 443
* Not required for device trust or synchronization.
* HTTPS access is fully controlled by Port Lockdown.
C). UDP 53
* DNS traffic is not required for synchronization and has no exemption under Port Lockdown.
NEW QUESTION # 27
Which of the following actions is NOT required during the initial setup of a BIG-IP system?
- A. Set up SSL certificates
- B. Set up self-IPs
- C. Install a software license
- D. Assign an administrative password
Answer: A
Explanation:
Setting up SSL certificates is typically done after the initial setup, not during it. The main tasks during initial setup involve network configuration and licensing.
NEW QUESTION # 28
The monitoring team reports that the SNMP server is unable to poll data from a BIG-IP device.
What information will help the BIG-IP Administrator determine whether the issue originates from the BIG-IP system?
- A. The "Traffic Group" setting must use a floating Traffic Group.
- B. The "VLAN / Tunnel" setting must allow All Vlans.
- C. The "Port Lockdown" setting is preventing the SNMP server from polling data from the BIG-IP.
- D. The configuration on the exhibit is correct and other options should be explored.
Answer: C
Explanation:
The exhibit shows aSelf IPwith:
* VLAN:Data
* Port Lockdown:Allow None
Impact of "Allow None" on SNMP
When a Self IP is configured with:
Port Lockdown: Allow None
the BIG-IP blocksallservices and ports except a few hardcoded HA communication ports.
This means:
* UDP/161 (SNMP)is blocked
* UDP/162 (SNMP traps)is blocked
* The SNMP server cannot poll or receive data from the BIG-IP through this Self IP SNMP relies on access through the Self IP if out-of-band (mgmt interface) is not used.
Thus, the issue is directly caused byPort Lockdown = Allow None, which prevents SNMP communication.
Why the other options are incorrect:
B). Traffic Group must use a floating Traffic Group
* SNMP polling doesnotrequire floating Self IPs.
* Floating groups apply to HA failover IPs, not SNMP functionality.
C). VLAN/Tunnel must allow All VLANs
* Self IPs are always bound to a VLAN; SNMP doesnotrequire All VLANs.
* As long as the Self IP belongs to a reachable VLAN, SNMP can work.
D). Configuration is correct
* It is not correct:Allow Noneblocks SNMP and is the problem.
NEW QUESTION # 29
An F5 BIG-IP Administrator is asked to report which modules areprovisionedon the BIG-IP.
In which two ways can this be done?
(Choose two.)
- A. Via the GUI atStatistics # Module Statistics # System
- B. Via TMSH withlist /sys provision
- C. Via TMSH withshow /sys provision
- D. Via the GUI atSystem # Resource Provisioning # Module Allocation
Answer: B,D
Explanation:
Provisioning determines:
* Which BIG-IP modules are enabled (LTM, ASM, APM, AFM, DNS, etc.)
* Their provisioning levels (None, Minimal, Nominal, Dedicated)
Two accurate ways to view provisioning settings are:
A). GUI - System # Resource Provisioning # Module Allocation
This is the primary GUI screen showing:
* All modules
* Their provisioning level
* System resource distribution impact
Administrators commonly use this page to confirm or change module provisioning.
D). TMSH - list /sys provision
This tmsh command displays each module and its provisioning level:
sys provision ltm { level nominal }
sys provision asm { level none }
This is the authoritative CLI method for checking module provisioning configurations.
Why the other options are incorrect:
B). show /sys provision
* Showsruntimeinformation butnot the actual configuration levels.
* list is the correct command for configuration details.
C). Statistics # Module Statistics
* Shows performance statistics, NOT provisioning status.
Therefore, the correct responses areAandD.
NEW QUESTION # 30
What command will allow the BIG-IP Administrator to view theconfigured management IPof a BIG-IP system?
(Choose one.)
- A. tmsh show sys management-ip
- B. tmsh list sys management-route
- C. tmsh list sys management-ip
- D. tmsh list net self
Answer: C
Explanation:
Comprehensive and Detailed Explanation (Paraphrased)
The BIG-IP stores the configured management IP address as asystem configuration objectunder the/sys hierarchy.
To display configured (persistent) values, BIG-IP uses thetmsh list command, not show.
Why tmsh list sys management-ip is correct
* The management IP configuration is defined under:
* /sys management-ip
* Running:
* tmsh list sys management-ip
displays:
* The configured management IP address
* Netmask
* Associated attributes
This command shows theactual configured management IP, which is what the question asks for.
Why the other options are incorrect
A). tmsh show sys management-ip
* The show command is used for runtime statistics and status.
* management-ip is a configuration object, not a statistics object.
C). tmsh list sys management-route
* Displays management routing information, not the management IP address itself.
D). tmsh list net self
* Displays Self IPs used on the data plane.
* Does not show the management interface IP.
NEW QUESTION # 31
What does SSL offloading on F5 BIG-IP do?
- A. Prevents SSL from being used in the network
- B. Provides an SSL connection to backend servers
- C. Encrypts data between the client and server
- D. Terminates SSL connections on the BIG-IP system to free up resources on the backend servers
Answer: D
Explanation:
SSL offloading moves the computationally expensive SSL decryption process to the BIG-IP system, improving performance by reducing the load on backend servers.
NEW QUESTION # 32
What is the primary function of the Traffic Management Operating System (TMOS) in F5 BIG-IP?
- A. It allows for traffic routing between the Internet and data center
- B. It provides the hardware resources for the system
- C. It is responsible for system management and operations
- D. It encrypts data between servers
Answer: C
Explanation:
TMOS is the core operating system that powers F5 BIG-IP, managing traffic, security, and system functions.
NEW QUESTION # 33
Given thatBIGIP-<version>.isoandHotfix-BIGIP-<version>-ENG.isohave been uploaded to/shared/images on an F5 device, what is the appropriatetmshcommand to prepare and update the BIG-IP device with the hotfixof a software version on anew volume HD1.2?
(Choose one.)
- A. tmsh create /sys software hotfix Hotfix-BIGIP-<version>-ENG.iso volume HD1.2
- B. tmsh install /sys software hotfix Hotfix-BIGIP-<version>-ENG.iso create-volume HD1.2
- C. tmsh install /sys software BIGIP-<version>.iso hotfix Hotfix-BIGIP-<version>-ENG.iso create-volume HD1.2
- D. tmsh copy /sys software hotfix Hotfix-BIGIP-<version>-ENG.iso volume HD1.2
Answer: C
Explanation:
When installing a BIG-IP software versionwith a HotFixon anew boot volume, F5 requires that both thebase TMOS imageand theHotFix imagebe installed together as part of the same installation workflow.
The correct process is:
* Specify thebase TMOS ISO
* Specify theHotFix ISOthat corresponds to that base version
* Instruct the system tocreate a new boot volume
* Install both images into that new volume
This is achieved with the following tmsh syntax:
tmsh install /sys software BIGIP-<version>.iso hotfix Hotfix-BIGIP-<version>-ENG.iso create-volume HD1.2 This command:
* Installs the base image first
* Applies the HotFix on top of the base image
* Creates and installs everything onHD1.2
* Leaves the currently active volume untouched for rollback
Why the other options are incorrect
A). Installing only the hotfix
A HotFix cannot be installed by itself on a new volume. A base image must already be present.
C). Using create instead of install
The create keyword is not valid for software installation operations.
D). Using copy
The copy command does not install software images or hotfixes.
NEW QUESTION # 34
A BIG-IP Administrator discovers malicious brute-force attempts to access the BIG-IP device on the management interfacevia SSH.
The administrator needs to restrict SSH access to the management interface.
Where should this be accomplished?
- A. System > Platform
- B. Network > Interfaces
- C. Network > Self IPs
- D. System > Configuration
Answer: D
Explanation:
The BIG-IPmanagement interface (MGMT port)is controlled throughSystem settings, not through the Network menu.
SSH access on the management interface is configured here:
System # Configuration # Device # General # SSH Access / SSH IP Allow
This section allows the administrator to:
* Enable or disable SSH service
* Restrict SSH access to specific IP addresses or subnets
* Apply security policies to the management interface
Why the other options are incorrect:
A). Network > Interfaces
* Used for data-plane physical interface settings, not management plane SSH restrictions.
B). Network > Self IPs
* Controls in-band management or data-plane access, not the dedicated management port.
D). System > Platform
* Used for hostname, time zone, LCD contrast, hardware settings - not SSH security on the management port.
Therefore, restricting SSH access to themanagement interfacemust be done under:
#System # Configuration # Device # General
Which corresponds toOption C.
NEW QUESTION # 35
......
Download Exam F5CAB1 Practice Test Questions with 100% Verified Answers: https://examdumps.passcollection.com/F5CAB1-valid-vce-dumps.html
