An F5 VE has been deployed into a VMware environment via an OVF file.An administrator wants to configure the management IP address so the VE can be accessed for further setup.Which two are valid methods for configuring the management-ip address? (Choose two.)
Answer(s): A,B
A newly deployed BIG-IP Virtual Edition (VE) in VMware requires initial configuration of its management-ip address so it can be accessed over the network. F5 provides several valid mechanisms during initial console access:A . Running the config utilityThe config script is available on new BIG-IP installations and VE deployments.It launches a guided text-based wizard allowing configuration of:Management IPNetmaskDefault routeThis is a standard and recommended method during first-time setup.B . Using TMSH with create sys management-ipAdministrators can enter TMSH directly from the console and run:create sys management-ip <ip>/<mask>The management-ip object resides under sys, not under ltm or any other module.This is the correct tmsh method for defining the management interface address.Why the other options are incorrect:C . create ltm management-ipThere is no such object under /ltm.LTM handles traffic objects (virtual servers, pools), not system management interfaces.D . Running the setup commandThe setup command is used for general system configuration but does not configure the management-ip.It is not the supported method for initial management IP assignment on VE deployments.Therefore, the valid methods are running the config utility and using the sys management-ip command within TMSH.
The BIG-IP Administrator needs to update access to the Configuration Utility to include the 172.28.31.0/24 and 172.28.65.0/24 networks.From the TMOS Shell (tmsh), which command should the BIG-IP Administrator use to complete this task?
Answer(s): A
Access to the BIG-IP Configuration Utility (TMUI) is controlled through the /sys httpd allow list.This list defines which IP addresses or subnets are allowed to connect to the management web interface.To allow two new subnets--172.28.31.0/24 and 172.28.65.0/24--the administrator must add both subnets to the existing list without removing current entries.In tmsh, subnet entries must be specified in network/netmask format, for example:172.28.31.0/255.255.255.0The correct tmsh command to append these networks is:modify /sys httpd allow add { 172.28.31.0/255.255.255.0 172.28.65.0/255.255.255.0 }Why the other options are incorrect:Option B:IPs are listed without masks, which is invalid for subnet-based access control.The system requires network/netmask format.Option C:The command uses permit instead of allow, which is not a valid attribute of /sys httpd.The correct keyword must be allow.Thus, only Option A correctly adds both permitted subnets in the proper tmsh format.
A BIG-IP Administrator is responsible for deploying a new software image on an F5 BIG-IP HA pair and has scheduled a one-hour maintenance window.With a focus on minimizing service disruption, which of the following strategies is the most appropriate?
Answer(s): C
For BIG-IP high-availability (HA) pairs, F5's recommended upgrade workflow prioritizes service continuity, predictable failover, and minimal downtime. The established best-practice sequence is:Upgrade the standby unit firstBecause the standby device is not passing traffic, upgrading and rebooting it does not impact production.Boot the standby unit into the newly installed versionOnce online, the administrator verifies basic health, device sync status, cluster communication, and module functionality.Perform a controlled failover to the upgraded unitTraffic shifts to the newly upgraded device, allowing validation of the configuration and operational behavior under real traffic loads.Upgrade the second device (now standby)The previously active device becomes standby after failover, allowing it to be safely upgraded and rebooted without interruption.This phased approach ensures only one device is unavailable at a time, allowing continuous traffic flow throughout the upgrade process.Why the Correct Answer is COption C exactly matches F5's documented production-safe upgrade method:Upgrade the standby node firstReboot into new imageFailover to upgraded deviceValidateUpgrade the remaining (now-standby) deviceThis procedure minimizes risk and traffic disruption.Why the other options are incorrect:A . Upgrade the active node firstUpgrading the active device requires removing it from service and failing over abruptly. This is not recommended and increases service disruption risk.B . Resetting device trustResetting trust is unnecessary and can disrupt configuration sync, peer communication, and cluster operation. It is not part of any standard upgrade workflow.D . Upgrading and rebooting both nodes simultaneouslyThis would cause total outage, because both HA members would be unavailable at the same time.
What are the two options for securing a BIG-IP's management interface?(Choose two.)
Answer(s): A,D
Securing the BIG-IP management interface is a fundamental administrative responsibility. F5 best practices emphasize restricting who can reach the management port and ensuring that only authorized systems are allowed access.A . Limiting management access to trusted network segmentsF5 recommends placing the management interface on a dedicated, isolated, and secured management network or VLAN, rather than exposing it to production or untrusted networks.This reduces the attack surface by ensuring only trusted segments have visibility to administrative interfaces.D . Restricting management access by IP or subnetF5 BIG-IP uses the /sys httpd allow list (for HTTPS) and configuration options in sshd (for SSH) to control which IP addresses or subnets can access the device.By specifying only known administrative IPs or ranges, unauthorized users cannot reach the login services.Why the other options are incorrectB . Blocking all management HTTPS/SSH portsThis would prevent any administrative access and is not a viable security practice.C . Using Self-IP addresses for administrative accessF5 explicitly warns against using Self-IPs for management access unless strictly necessary.Self-IPs are exposed to the data plane and should not be used as the primary administrative interface.
Which port is an exception to the Port Lockdown function of Self-IPs if a device-group synchronization cluster is configured?
Answer(s): B
Self-IPs implement a security feature known as Port Lockdown, which limits which services are reachable on a Self-IP.However, certain services required for BIG-IP device-to-device communication bypass Port Lockdown to ensure cluster and HA functionality.TCP 4353TCP port 4353 is used by Device Service Clustering (DSC) for:Device trust establishmentConfiguration synchronizationFailover communicationBecause BIG-IP devices must always be able to communicate for HA functions to remain operational, port 4353 is exempt from Port Lockdown rules.Why the other options are incorrectA . TCP 443Not required for device trust or synchronization.HTTPS access is fully controlled by Port Lockdown.C . UDP 53DNS traffic is not required for synchronization and has no exemption under Port Lockdown.
Post your Comments and Discuss F5 F5CAB1 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the F5CAB1 content, but please register or login to continue.