시험덤프
매달, 우리는 1000명 이상의 사람들이 시험 준비를 잘하고 시험을 잘 통과할 수 있도록 도와줍니다.
 홈 / F5CAB1 덤프  / F5CAB1 문제 연습

F5 F5CAB1 시험

BIG-IP Administration Install, Initial Configuration, and Upgrade 온라인 연습

최종 업데이트 시간: 2026년06월04일

당신은 온라인 연습 문제를 통해 F5 F5CAB1 시험지식에 대해 자신이 어떻게 알고 있는지 파악한 후 시험 참가 신청 여부를 결정할 수 있다.

시험을 100% 합격하고 시험 준비 시간을 35% 절약하기를 바라며 F5CAB1 덤프 (최신 실제 시험 문제)를 사용 선택하여 현재 최신 42개의 시험 문제와 답을 포함하십시오.

 / 1

Question No : 1


For an upgrade of a standalone BIG-IP, a maintenance window is available in which brief interruptions are allowed.
Actions with no impact can be done outside the maintenance window.
When should a license reactivation be performed?

정답:
Explanation:
License reactivation updates the BIG-IP device’s license file to ensure:
The Service Check Date is current
The device is eligible to install the intended TMOS version
Any module entitlement updates are received
Reactivation does not interrupt traffic and does not require a reboot, making it safe to perform before the maintenance window.
F5 best practices state:
Perform all non-impact tasks prior to the scheduled maintenance window
Leave the window available for activities that require rebooting, such as the software installation itself
Since license reactivation is non-disruptive, it should be done before the upgrade window starts.

Question No : 2


Which two items demonstrate the creation of a new volume for software images? (Choose two.)

정답:
Explanation:
In BIG-IP, software images are installed on boot volumes (for example, HD1.1, HD1.2, HD1.3, etc.).
To install software on a new volume, the administrator must instruct the system to create a new boot location before installation.
There are two correct ways to create a new volume:
A. tmsh command (with correct syntax)
tmsh install software image /shared/images/BIGIP-<version>.iso volume HD1.5 create-volume
This syntax correctly includes:
install software image
full path to ISO (/shared/images/...)
volume name (HD1.5)
create-volume keyword
This instructs BIG-IP to create the new boot volume as part of the installation.
C. Using the GUI → System > Disk Management
From the Disk Management menu, the administrator can:
Select “New Volume”
Enter the volume identifier (e.g., HD1.5)
Apply changes
This GUI method is officially supported and explicitly creates a new boot volume before installing the software.
Why the other options are incorrect:
B. Incorrect tmsh syntax
Missing /shared/images/ path
Incorrect command structure
D. Incorrect command structure
Missing required keywords and correct command hierarchy
E. Software Management → Install does NOT create volumes
This installs to an existing volume only
The GUI install dialog does not create new boot volumes
Thus, only Option A and Option C properly create a new software volume.

Question No : 3


The BIG-IP Administrator wants to manage the newly built F5 system through an in-band Self-IP.
The administrator has configured a VLAN and Self-IP and can ping the IP from their workstation, but cannot access the system via SSH or HTTPS.
What port lockdown settings should the BIG-IP Administrator use to allow management access on the Self-IP? (Choose two.)

정답:
Explanation:
Self-IPs include a security feature called Port Lockdown, which restricts which services respond on that Self-IP.
By default, Self-IPs block management access (SSH and HTTPS/TMUI), meaning an administrator cannot manage the device through in-band Self-IPs unless explicitly allowed.
Allow Mgmt / Allow Management
These settings enable only the management services required for administrative access, specifically:
SSH (22)
HTTPS/TMUI (443)
These options allow secure administration without opening unnecessary ports.
Why these are correct:
They provide only the essential access for management.
They follow F5 security best practices when using in-band admin access.
They do not expose all services, reducing the attack surface.
Why the other options are incorrect:
A. Allow Default
This allows only a minimal set of system-required ports (e.g., failover, config sync), not SSH or HTTPS.
Administrator access would still fail.
B. Allow All
Opens all ports on the Self-IP, which is not secure.
Exposes services that should remain restricted.
Therefore, Allow Mgmt / Allow Management are the correct choices.

Question No : 4


A BIG-IP device will be dedicated to functioning as a WAF, requiring only the ASM module to be provisioned.
What provisioning level will ensure that the system allocates all CPU, memory, and disk resources to this module exclusively?

정답:
Explanation:
Provisioning defines how BIG-IP allocates system resources to modules. The provisioning levels include:
Dedicated C allocates all CPU, memory, and disk resources to a single module Nominal C standard resource allocation balanced with other modules
Minimal C lowest level, used for basic utility needs
None C module disabled
Comprehensive / Maximal C not valid TMOS provisioning levels Why “Dedicated” is correct
When a BIG-IP device is intended to run only ASM (Web Application Firewall), the recommended way to maximize performance is to provision the module at Dedicated level.
With ASM: Dedicated:
ASM receives the entire hardware capacity
No other modules can or should be provisioned
This is explicitly recommended when a device is used solely as a WAF platform
Why other options are incorrect
B. Comprehensive /
C. Maximal
These are not valid provisioning modes in BIG-IP.
TMOS supports: Nominal, Minimal, Large (module-specific), and Dedicated.
D. Nominal
Shares resources with other modules
Does not provide full system performance
Not suitable when exclusive resource allocation is required Thus, Dedicated is the correct provisioning choice.

Question No : 5


A BIG-IP device is licensed for LTM, ASM, APM, and AFM.
Currently, it will only be used for load balancing and web application firewalling.
To ensure optimal performance and efficient resource utilization, which of the following module provisioning combinations is the best choice?

정답:
Explanation:
BIG-IP provisioning determines how CPU, memory, and disk resources are allocated to each module. The goal is to provision only the modules required and at levels appropriate to their performance needs.
Requirements in the question
The device will be used for:
LTM (Local Traffic Manager) → load balancing
ASM (Application Security Manager) → WAF
No functions require:
APM (Access Policy Manager)
AFM (Advanced Firewall Manager)
Why Option C is correct
Provisioning both LTM and ASM at Nominal level provides:
Adequate performance for production load
Plentiful system resources while avoiding dedicating the entire system to a single module Balanced allocation without starving memory or CPU
Setting APM: None and AFM: None ensures unused modules consume zero resources.
Why the other options are incorrect
A. Dedicated provisioning for both LTM and ASM
Two modules cannot both run in “Dedicated” mode.
Dedicated mode allocates all resources to a single module ― the second module cannot be dedicated simultaneously.
B. LTM and ASM both Dedicated
Same issue: only one module can be Dedicated at a time.
Also unnecessary for load balancing + WAF.
D. Setting APM and AFM to Minimal
Minimal still consumes memory and CPU.
Unused modules should be set to None.
Therefore, Option C is the best provisioning strategy.

Question No : 6


Which port is an exception to the Port Lockdown function of Self-IPs if a device-group synchronization cluster is configured?

정답:
Explanation:
Self-IPs implement a security feature known as Port Lockdown, which limits which services are reachable on a Self-IP.
However, certain services required for BIG-IP device-to-device communication bypass Port Lockdown to ensure cluster and HA functionality.
TCP 4353
TCP port 4353 is used by Device Service Clustering (DSC) for:
Device trust establishment
Configuration synchronization
Failover communication
Because BIG-IP devices must always be able to communicate for HA functions to remain operational, port 4353 is exempt from Port Lockdown rules.
Why the other options are incorrect
A. TCP 443
Not required for device trust or synchronization.
HTTPS access is fully controlled by Port Lockdown.
C.UDP53
DNS traffic is not required for synchronization and has no exemption under Port Lockdown.

Question No : 7


What are the two options for securing a BIG-IP’s management interface? (Choose two.)

정답:
Explanation:
Securing the BIG-IP management interface is a fundamental administrative responsibility. F5 best practices emphasize restricting who can reach the management port and ensuring that only authorized systems are allowed access.
A. Limiting management access to trusted network segments
F5 recommends placing the management interface on a dedicated, isolated, and secured management network or VLAN, rather than exposing it to production or untrusted networks.
This reduces the attack surface by ensuring only trusted segments have visibility to administrative interfaces.
D. Restricting management access by IP or subnet
F5 BIG-IP uses the /sys httpd allow list (for HTTPS) and configuration options in sshd (for SSH) to control which IP addresses or subnets can access the device.
By specifying only known administrative IPs or ranges, unauthorized users cannot reach the login services.
Why the other options are incorrect
B. Blocking all management HTTPS/SSH ports
This would prevent any administrative access and is not a viable security practice.
C. Using Self-IP addresses for administrative access
F5 explicitly warns against using Self-IPs for management access unless strictly necessary.
Self-IPs are exposed to the data plane and should not be used as the primary administrative interface.

Question No : 8


A BIG-IP Administrator is responsible for deploying a new software image on an F5 BIG-IP HA pair and has scheduled a one-hour maintenance window.
With a focus on minimizing service disruption, which of the following strategies is the most appropriate?

정답:
Explanation:
For BIG-IP high-availability (HA) pairs, F5’s recommended upgrade workflow prioritizes service continuity, predictable failover, and minimal downtime. The established best-practice sequence is:
Upgrade the standby unit first
Because the standby device is not passing traffic, upgrading and rebooting it does not impact production.
Boot the standby unit into the newly installed version
Once online, the administrator verifies basic health, device sync status, cluster communication, and module functionality.
Perform a controlled failover to the upgraded unit
Traffic shifts to the newly upgraded device, allowing validation of the configuration and operational behavior under real traffic loads.
Upgrade the second device (now standby)
The previously active device becomes standby after failover, allowing it to be safely upgraded and rebooted without interruption.
This phased approach ensures only one device is unavailable at a time, allowing continuous traffic flow throughout the upgrade process.
Why the Correct Answer is C
Option C exactly matches F5’s documented production-safe upgrade method:
Upgrade the standby node first
Reboot into new image
Failover to upgraded device
Validate
Upgrade the remaining (now-standby) device
This procedure minimizes risk and traffic disruption.
Why the other options are incorrect:
A. Upgrade the active node first
Upgrading the active device requires removing it from service and failing over abruptly. This is not recommended and increases service disruption risk.
B. Resetting device trust
Resetting trust is unnecessary and can disrupt configuration sync, peer communication, and cluster operation. It is not part of any standard upgrade workflow.
D. Upgrading and rebooting both nodes simultaneously
This would cause total outage, because both HA members would be unavailable at the same time.

Question No : 9


The BIG-IP Administrator needs to update access to the Configuration Utility to include the 172.28.31.0/24 and 172.28.65.0/24 networks.
From the TMOS Shell (tmsh), which command should the BIG-IP Administrator use to complete this task?

정답:
Explanation:
Access to the BIG-IP Configuration Utility (TMUI) is controlled through the /sys httpd allow list.
This list defines which IP addresses or subnets are allowed to connect to the management web interface.
To allow two new subnets―172.28.31.0/24 and 172.28.65.0/24―the administrator must add both subnets to the existing list without removing current entries.
In tmsh, subnet entries must be specified in network/netmask format, for example:

Question No : 10


An F5 VE has been deployed into a VMware environment via an OVF file.
An administrator wants to configure the management IP address so the VE can be accessed for further setup.
Which two are valid methods for configuring the management-ip address? (Choose two.)

정답:
Explanation:
A newly deployed BIG-IP Virtual Edition (VE) in VMware requires initial configuration of its management-ip address so it can be accessed over the network. F5 provides several valid mechanisms during initial console access:
A. Running the config utility
The config script is available on new BIG-IP installations and VE deployments.
It launches a guided text-based wizard allowing configuration of:
Management IP
Netmask
Default route
This is a standard and recommended method during first-time setup.
B. Using TMSH with create sys management-ip
Administrators can enter TMSH directly from the console and run:
create sys management-ip <ip>/<mask>
The management-ip object resides under sys, not under ltm or any other module.
This is the correct tmsh method for defining the management interface address.
Why the other options are incorrect:
C. create ltm management-ip There is no such object under /ltm.
LTM handles traffic objects (virtual servers, pools), not system management interfaces.
D. Running the setup command
The setup command is used for general system configuration but does not configure the management-ip.
It is not the supported method for initial management IP assignment on VE deployments.
Therefore, the valid methods are running the config utility and using the sys management-ip command within TMSH.

Question No : 11


An organization is planning to upgrade a BIG-IP system from 16.1.x to 17.1.x.
For a successful upgrade, the Service Check Date must be equal to or newer than the License Check Date required for 17.1.x.
Which command will show the Service Check Date on the BIG-IP system being upgraded?

정답:
Explanation:
BIG-IP licensing information, including the Service Check Date, is stored in the file:
/config/bigip.license
This file contains all license attributes downloaded from the F5 licensing server, including:
License key
Licensed modules
Useful life date
Service check date
The Service Check Date determines whether the system is eligible for upgrades to specific TMOS versions. When reviewing upgrade readiness, administrators extract this value directly from the license file with:
grep "Service check date" /config/bigip.license
Why the other options are incorrect:
/config/bigip.conf stores BIG-IP configuration objects, not license metadata.
/config/svc_chk_date.dat is not a valid file in the licensing system; it does not contain license parameters.
/config/BigDB.dat stores internal database values, not licensing attributes.
Thus, only the bigip.license file contains the correct licensing information required for verifying upgrade eligibility.

Question No : 12


The Configuration Utility of a BIG-IP device is currently accessible via its management IP 10.53.1.245 from all VLANs.
The BIG-IP Administrator needs to restrict access so only hosts from the 10.0.0.0/24 subnet can access the Configuration Utility.
Which TMSH command accomplishes this?

정답:
Explanation:
BIG-IP controls access to the web-based Configuration Utility (TMUI) through the /sys httpd allow list. This parameter specifies which client IPs or subnets may initiate HTTP/HTTPS connections to the management interface.
To restrict TMUI access to only the 10.0.0.0/24 subnet:
The correct method is to modify the HTTPD allow list so that it contains only this subnet.
This requires replacing the entire current list with the new subnet using:
modify /sys httpd allow replace-all-with {10.0.0.0/24}
This ensures that only clients within 10.0.0.0/24 can reach the Configuration Utility.
Why the other options are incorrect:
Options A and C create network ACL objects under /net acl, which apply to data-plane traffic, not management-plane TMUI access. TMUI access is not controlled by LTM ACLs but by the HTTPD allow directive.
Option B is incorrect syntax and references /ltm httpd, which is not the proper object; the correct hierarchy is /sys httpd.
Thus, only modifying the /sys httpd allow list achieves the required restriction.

Question No : 13


The BIG-IP Administrator received a ticket that an authorized user is attempting to connect to the Configuration Utility from a jump host and is being denied.
The HTTPD allow list is configured as:
sys httpd {
allow { 172.28.31.0/255.255.255.0 172.28.65.0/255.255.255.0 }
}
The jump host IP is 172.28.32.22.
What command should the BIG-IP Administrator use to allow HTTPD access for this jump host?

정답:
Explanation:
The HTTPD allow list controls which IP addresses or subnets may access the Configuration Utility (TMUI) on the BIG-IP system. The Administrator already has two subnets allowed and needs to add a single host IP to the existing list.
The object /sys httpd allow supports actions such as add, delete, and replace-all-with.
Because the goal is to add one more entry without removing the existing permitted subnets, the correct command is:
modify /sys httpd allow add { 172.28.32.22 }
This appends the new host to the existing list while preserving the previously configured networks.
Why the other options are incorrect:
Option A (replace-all-with) would overwrite the entire allow list, removing existing permitted subnets―unacceptable.
Option B (delete) would remove the existing networks and not add the required host.
Therefore, the correct administrative action is to add the jump host’s IP.

Question No : 14


When using the tmsh shell of a BIG-IP system, which command will display the management-ip address?

정답:
Explanation:
Comprehensive and Detailed Explanation (Paraphrased from F5 BIG-IP Administration / Installation / Initial Configuration concepts)
Within the BIG-IP Traffic Management Shell (tmsh), system configuration objects―including the management IP―are organized under the /sys hierarchy. The management IP address is a configurable property stored in the system configuration and can be viewed using the tmsh list command, which displays configuration objects and their currently assigned values.
Why “list /sys management-ip” is correct
The list command in tmsh is used to display configured system values, not runtime statistics.
The object that holds the management IP settings on BIG-IP systems is located at:
/sys management-ip
Running the command:
list /sys management-ip
will reveal the settings for the management IP interface, including the address, netmask, and any associated attributes.
This is the standard method used during system setup and verification to confirm the management IP configuration.
This behavior aligns with BIG-IP administration procedures, where configuration information is retrieved using list, while operational data is retrieved using show.
Why the other options are incorrect
A. run /util bash ifconfig mgmt
This command enters the Bash shell, then runs ifconfig to display the management interface.
While this can show the management interface address, it is not a tmsh-native command, and the question specifically asks for a tmsh command.
Administrators use tmsh directly for configuration display rather than leaving the shell.
C. show /sys management-ip
The show command displays statistics or operational data, not configuration values.
The management-ip object does not maintain statistics; therefore show does not return the configuration details required.
Only the list command reveals stored configuration data such as IP address and netmask.

Question No : 15


A BIG-IP Administrator plans to upgrade a BIG-IP device to the latest TMOS version.
Which two tools could the administrator leverage to verify known issues for the target versions? (Choose two.)

정답:
Explanation:
Comprehensive and Detailed Explanation (Paraphrased from F5 BIG-IP Administration Install, Initial Configuration, and Upgrade concepts)
When performing a TMOS upgrade, F5 recommends validating the target software version to ensure that the release does not contain defects that may impact system behavior. The upgrade preparation process includes checking for known issues, validating compatibility, and reviewing advisory
information for the intended version. Two primary F5 tools serve this purpose:
B. F5 iHealth
iHealth is a cloud-based diagnostic and analysis platform used to evaluate the operational state of a BIG-IP system.
Administrators upload a QKView file to iHealth to receive an automated assessment of the system.
As part of upgrade planning, iHealth provides:
Version-specific issue analysis, comparing the system’s configuration and hardware against F5’s internal catalog of published issues.
Upgrade advisories, identifying potential risks such as deprecated features, module compatibility concerns, or changes in behavior between TMOS versions.
Checks against known defects, allowing administrators to determine whether the target TMOS version contains issues relevant to their deployment.
This aligns with F5’s recommended upgrade workflow, where iHealth is used before upgrading to confirm system readiness and detect software-level concerns.
D. F5 Bug Tracker
The Bug Tracker is F5’s dedicated interface for reviewing software defects across TMOS releases.
It enables administrators to:
Search for known bugs by TMOS version, module, severity, or defect ID.
Review the status of defects (open, resolved, fixed in later releases).
Identify whether high-impact or security-related issues are associated with the target upgrade version.
F5 documentation emphasizes reviewing known defects prior to installation of new software images, making the Bug Tracker a critical resource for upgrade validation.
Why the other options are not correct
A. F5 End User Diagnostics (EUD)
EUD is used exclusively for hardware diagnostics (ports, memory, fans). It does not provide software-
related issue verification and is not used for upgrade planning.
C. F5 University
This is a training platform, not an operational tool. It does not provide defect listings or upgrade-specific warnings.
E. F5 Downloads
Although it provides access to software images and release notes, it is not a tool for identifying known bugs. Release notes summarize general fixes and features, but systematic bug verification requires iHealth or the Bug Tracker

 / 1
F5