Course 2026 F5CAB1 Test Prep Training Practice Exam Download
F5CAB1 Exam Info and Free Practice Test Professional Quiz Study Materials
F5 F5CAB1 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 22
Which command-line tool is used to perform most administrative tasks on F5 BIG-IP?
- A. Bash
- B. TMSH
- C. SSH
- D. CLI
Answer: B
Explanation:
tmsh (Traffic Management Shell) is the command-line interface used for managing and configuring the F5 BIG-IP system.
NEW QUESTION # 23
A BIG-IP Administrator is responsible for deploying a new software image on an F5 BIG-IP HA pair and has scheduled a one-hour maintenance window. With a focus on minimizing service disruption, which of the following strategies is the most appropriate?
- A. Update the standby node first and reboot it to the newly updated boot location, failover to the newly updated node and verify functionality. Repeat the upgrade procedures on the next node, which is now in standby mode.
- B. Reset the Device Trust, apply the update to each node separately, reboot both nodes, then re- establish the Device Trust.
- C. Update the active node first, reboot to the newly updated boot location and verify functionality, then push the update from the active to the standby node and reboot the standby node.
- D. Update both nodes in the HA pair, then reboot both nodes simultaneously to ensure they run the same software version.
Answer: A
Explanation:
For BIG-IP high-availability (HA) pairs, F5's recommended upgrade workflow prioritizes service continuity, predictable failover, and minimal downtime. The established best-practice sequence is:
Upgrade the standby unit first
Because the standby device is not passing traffic, upgrading and rebooting it does not impact production.
Boot the standby unit into the newly installed version
Once online, the administrator verifies basic health, device sync status, cluster communication, and module functionality.
Perform a controlled failover to the upgraded unit
Traffic shifts to the newly upgraded device, allowing validation of the configuration and operational behavior under real traffic loads.
Upgrade the second device (now standby)
The previously active device becomes standby after failover, allowing it to be safely upgraded and rebooted without interruption.
This phased approach ensures only one device is unavailable at a time, allowing continuous traffic flow throughout the upgrade process.
Why the Correct Answer is C
Option C exactly matches F5's documented production-safe upgrade method:
Upgrade the standby node first
Reboot into new image
Failover to upgraded device
Validate
Upgrade the remaining (now-standby) device
This procedure minimizes risk and traffic disruption.
NEW QUESTION # 24
The monitoring team reports that the SNMP server is unable to poll data from a BIG-IP device.
What information will help the BIG-IP Administrator determine whether the issue originates from the BIG-IP system?
- A. The configuration on the exhibit is correct and other options should be explored.
- B. The "VLAN / Tunnel" setting must allow All Vlans.
- C. The "Traffic Group" setting must use a floating Traffic Group.
- D. The "Port Lockdown" setting is preventing the SNMP server from polling data from the BIG-IP.
Answer: D
Explanation:
The exhibit shows aSelf IPwith:
* VLAN:Data
* Port Lockdown:Allow None
Impact of "Allow None" on SNMP
When a Self IP is configured with:
Port Lockdown: Allow None
the BIG-IP blocksallservices and ports except a few hardcoded HA communication ports.
This means:
* UDP/161 (SNMP)is blocked
* UDP/162 (SNMP traps)is blocked
* The SNMP server cannot poll or receive data from the BIG-IP through this Self IP SNMP relies on access through the Self IP if out-of-band (mgmt interface) is not used.
Thus, the issue is directly caused byPort Lockdown = Allow None, which prevents SNMP communication.
Why the other options are incorrect:
B). Traffic Group must use a floating Traffic Group
* SNMP polling doesnotrequire floating Self IPs.
* Floating groups apply to HA failover IPs, not SNMP functionality.
C). VLAN/Tunnel must allow All VLANs
* Self IPs are always bound to a VLAN; SNMP doesnotrequire All VLANs.
* As long as the Self IP belongs to a reachable VLAN, SNMP can work.
D). Configuration is correct
* It is not correct:Allow Noneblocks SNMP and is the problem.
NEW QUESTION # 25
Refer to the exhibit.
What traffic will be permitted to reach the BIG-IP?
- A. Telnet
- B. SSH
- C. FTP
Answer: B
Explanation:
The exhibit shows the configuration of a Self IP with:
* Port Lockdown: Allow Custom
* A Custom List that includes the following TCP ports:
* 443
* 22
Meaning of these ports:
* TCP 443 # HTTPS (TMUI - web-based management)
* TCP 22 # SSH (command-line remote access)
No other TCP, UDP, or protocol entries are listed; therefore, only these two services are allowed to reach the BIG-IP via this Self IP.
Evaluating the answer choices:
Option
Service
Port
Allowed?
FTP
TCP 21
Not listed
Not allowed
SSH
TCP 22
Listed
Allowed
Telnet
TCP 23
Not listed
Not allowed
Thus, SSH is the only traffic permitted through this Self IP configuration.
NEW QUESTION # 26
An organization is planning to upgrade a BIG-IP system from 16.1.x to 17.1.x.
For a successful upgrade, the Service Check Date must be equal to or newer than the License Check Date required for 17.1.x.
Which command will show the Service Check Date on the BIG-IP system being upgraded?
- A. grep "Service check date" /config/bigip.license
- B. grep "Service check date" /config/svc_chk_date.dat
- C. grep "Service check date" /config/bigip.conf
- D. grep "Service check date" /config/BigDB.dat
Answer: A
Explanation:
BIG-IP licensing information, including the Service Check Date, is stored in the file:
/config/bigip.license
This file contains all license attributes downloaded from the F5 licensing server, including:
License key
Licensed modules
Useful life date
Service check date
The Service Check Date determines whether the system is eligible for upgrades to specific TMOS versions. When reviewing upgrade readiness, administrators extract this value directly from the license file with:
grep "Service check date" /config/bigip.license
Why the other options are incorrect:
/config/bigip.conf stores BIG-IP configuration objects, not license metadata.
/config/svc_chk_date.dat is not a valid file in the licensing system; it does not contain license parameters.
/config/BigDB.dat stores internal database values, not licensing attributes.
Thus, only the bigip.license file contains the correct licensing information required for verifying upgrade eligibility.
NEW QUESTION # 27
A BIG-IP Administrator needs to verify the state of equipment in the data center.
A BIG-IP appliance has a solid yellow indicator on the status LED.
How should the administrator interpret this LED indicator?
- A. A warning-level alarm condition is present
- B. Appliance is halted or in End-User Diagnostic (EUD) mode
- C. A power supply is NOT operating properly
- D. Appliance is a standby member in a device group
Answer: A
NEW QUESTION # 28
An F5 BIG-IP Administrator is asked to report which modules are provisioned on the BIG-IP. In which two ways can this be done? (Choose two.)
- A. Via the GUI at Statistics -> Module Statistics -> System
- B. Via the GUI at System -> Resource Provisioning -> Module Allocation
- C. Via TMSH with list /sys provision
- D. Via TMSH with show /sys provision
Answer: B,C
Explanation:
Provisioning determines:
Which BIG-IP modules are enabled (LTM, ASM, APM, AFM, DNS, etc.)
Their provisioning levels (None, Minimal, Nominal, Dedicated)
Two accurate ways to view provisioning settings are:
A). GUI -- System -> Resource Provisioning -> Module Allocation
This is the primary GUI screen showing:
All modules
Their provisioning level
System resource distribution impact
Administrators commonly use this page to confirm or change module provisioning.
D). TMSH -- list /sys provision
This tmsh command displays each module and its provisioning level:
sys provision ltm { level nominal }
sys provision asm { level none }
...
This is the authoritative CLI method for checking module provisioning configurations.
NEW QUESTION # 29
The Port Lockdown feature prevents unwanted connection attempts to a Self IP. Which three types of connection attempts are unaffected by Port Lockdown settings?
- A. Defined virtual server traffic, Secure Shell (SSH), Centralized Management Infrastructure (CMI)
- B. Defined virtual server traffic, Internet Control Message Protocol (ICMP), Centralized Management Infrastructure (CMI)
- C. Centralized Management Infrastructure (CMI), Secure Shell (SSH), Internet Control Message Protocol (ICMP)
Answer: B
Explanation:
Port Lockdown controls which ports and protocols a Self IP will respond to.
However, certain traffic types bypass Port Lockdown for BIG-IP functionality and routing integrity.
The three types that are NOT affected by Port Lockdown are:
1. Defined Virtual Server Traffic
Traffic destined to a Self IP that matches a configured virtual server is always accepted by the BIG-IP, regardless of Port Lockdown settings.
This ensures that traffic processing does not break when administrators restrict Self-IP ports.
2. ICMP (Internet Control Message Protocol)
ICMP (such as ping, traceroute responses, etc.) always passes through a Self IP even when Port Lockdown is set to:
Allow Default
Allow None
Allow Custom
F5 allows ICMP for reachability and diagnostic purposes independent of Port Lockdown rules.
3. Centralized Management Infrastructure (CMI)
CMI includes the internal HA services used for:
Device Trust
ConfigSync
Failover
Mirroring
These essential HA communications bypass Port Lockdown to prevent accidental cluster failure.
The well-known port for this traffic is TCP 4353, which is always permitted.
NEW QUESTION # 30
Which one of the following is a port and protocol combination allowed by the Allow Default setting for Port Lockdown?
- A. TCP 443
- B. TCP 80
- C. UDP 8443
Answer: A
Explanation:
Port Lockdown controls which ports and protocols a Self IP will respond to.
The Allow Default setting permits only a predefined set of BIG-IP internal and required service ports.
The Allow Default list includes:
TCP 443 HTTPS (Management/TMUI access via Self-IP)
TCP 4353 CMI (device sync)
TCP/UDP ports related to HA communication
Other essential internal F5 ports
Why TCP 443 is correct:
It is one of the officially allowed ports under Allow Default.
It enables HTTPS/TMUI access through a Self IP.
NEW QUESTION # 31
When using the tmsh shell of a BIG-IP system, which command will display the management-ip address?
- A. list /sys management-ip
- B. run /util bash ifconfig mgmt
- C. show /sys management-ip
Answer: A
Explanation:
Comprehensive and Detailed Explanation (Paraphrased from F5 BIG-IP Administration / Installation / Initial Configuration concepts) Within the BIG-IP Traffic Management Shell (tmsh), system configuration objects-including the management IP-are organized under the/syshierarchy. The management IP address is a configurable property stored in the system configuration and can be viewed using the tmshlistcommand, which displays configuration objects and their currently assigned values.
Why "list /sys management-ip" is correct
* The list command in tmsh is used todisplay configured system values, not runtime statistics.
* The object that holds the management IP settings on BIG-IP systems is located at:/sys management-ip
* Running the command:list /sys management-ipwill reveal the settings for the management IP interface, including the address, netmask, and any associated attributes.
* This is the standard method used during system setup and verification to confirm the management IP configuration.
This behavior aligns with BIG-IP administration procedures, where configuration information is retrieved usinglist, while operational data is retrieved usingshow.
Why the other options are incorrect
A). run /util bash ifconfig mgmt
* This command enters the Bash shell, then runs ifconfig to display the management interface.
* While this can show the management interface address, it isnot a tmsh-native command, and the question specifically asks for a tmsh command.
* Administrators use tmsh directly for configuration display rather than leaving the shell.
C). show /sys management-ip
* The show command displaysstatistics or operational data, not configuration values.
* The management-ip object does not maintain statistics; therefore show does not return the configuration details required.
* Only thelistcommand reveals stored configuration data such as IP address and netmask.
NEW QUESTION # 32
What command will allow the BIG-IP Administrator to view theconfigured management IPof a BIG-IP system?
(Choose one.)
- A. tmsh show sys management-ip
- B. tmsh list sys management-ip
- C. tmsh list net self
- D. tmsh list sys management-route
Answer: B
Explanation:
Comprehensive and Detailed Explanation (Paraphrased)
The BIG-IP stores the configured management IP address as asystem configuration objectunder the/sys hierarchy.
To display configured (persistent) values, BIG-IP uses thetmsh list command, not show.
Why tmsh list sys management-ip is correct
* The management IP configuration is defined under:
* /sys management-ip
* Running:
* tmsh list sys management-ip
displays:
* The configured management IP address
* Netmask
* Associated attributes
This command shows theactual configured management IP, which is what the question asks for.
Why the other options are incorrect
A). tmsh show sys management-ip
* The show command is used for runtime statistics and status.
* management-ip is a configuration object, not a statistics object.
C). tmsh list sys management-route
* Displays management routing information, not the management IP address itself.
D). tmsh list net self
* Displays Self IPs used on the data plane.
* Does not show the management interface IP.
NEW QUESTION # 33
An F5 BIG-IP Administrator is asked to report which modules areprovisionedon the BIG-IP.
In which two ways can this be done?
(Choose two.)
- A. Via TMSH withshow /sys provision
- B. Via the GUI atSystem # Resource Provisioning # Module Allocation
- C. Via TMSH withlist /sys provision
- D. Via the GUI atStatistics # Module Statistics # System
Answer: B,C
Explanation:
Provisioning determines:
* Which BIG-IP modules are enabled (LTM, ASM, APM, AFM, DNS, etc.)
* Their provisioning levels (None, Minimal, Nominal, Dedicated)
Two accurate ways to view provisioning settings are:
A). GUI - System # Resource Provisioning # Module Allocation
This is the primary GUI screen showing:
* All modules
* Their provisioning level
* System resource distribution impact
Administrators commonly use this page to confirm or change module provisioning.
D). TMSH - list /sys provision
This tmsh command displays each module and its provisioning level:
sys provision ltm { level nominal }
sys provision asm { level none }
This is the authoritative CLI method for checking module provisioning configurations.
Why the other options are incorrect:
B). show /sys provision
* Showsruntimeinformation butnot the actual configuration levels.
* list is the correct command for configuration details.
C). Statistics # Module Statistics
* Shows performance statistics, NOT provisioning status.
Therefore, the correct responses areAandD.
NEW QUESTION # 34
How can the BIG-IP Administrator tell when anunlicensed modulehas been provisioned?
- A. AProvisioning Warningwill be displayed in the GUI in the upper left corner.
- B. A BIG-IP does not allow unlicensed modules to be provisioned.
- C. When provisioning an unlicensed module, a warning will appear.
Answer: A
Explanation:
The BIG-IP system has built-in licensing enforcement.
If an administrator provisions a module that the device isnot licensedto run, the system will still allow the provisioning action to occurinitially, but the system detects the mismatch and displays an alert.
What actually happens:
* The GUI places awarning bannerin theupper-left cornerlabeled something similar to:"Provisioning Warning"
* This appears immediately after provisioning a module that is not included in the active license.
* The system remains in an "inconsistent state" until the module is disabled again or the license is updated.
This is the visual cue BIG-IP uses to indicate that a module was provisioned without valid licensing.
Why the other options are incorrect:
A). "A BIG-IP does not allow unlicensed modules to be provisioned."
* Not true. BIG-IPdoesallow provisioning, but warns afterward.
B). "A warning will appear when provisioning an unlicensed module."
* The warning doesnotappear during the provisioning step itself.
* It appearsafter provisioning, in the main GUI, as a system banner.
NEW QUESTION # 35
An administrator is in the process of reactivating the license using the interface displayed in the exhibit.
What is the address of the license server to which the BIG-IP device must be able to establish an outbound connection in order to use the Automatic Activation Method?
- A. activate.f5.com
- B. license.f5.com
- C. callhome.f5.com
- D. ask.f5.com
Answer: A
Explanation:
When you choose Automatic as the activation method in the License > Re-activate screen, the BIG-IP device itself contacts F5's license activation service over the Internet.
For successful automatic activation:
The BIG-IP must have outbound network connectivity (typically via the management interface).
DNS resolution and routing must allow it to reach the F5 license activation host (the one shown in option D).
The device sends its dossier and registration key to that service and receives an updated license file in return, which is then installed automatically.
The other hostnames in the options are not used by BIG-IP for license activation, so they cannot be correct in the context of Automatic Activation.
NEW QUESTION # 36
How should a BIG-IP Administrator check theprovisioned CPU percentfor a module?
(Choose two.)
- A. By checking theDashboardoutput in the Statistics tab in the GUI.
- B. By runningtmsh show /sys cpuand reviewing the specific module provisioned output.
- C. By running thetopcommand and reviewing the output for the provisioned module.
- D. By going toSystem / Resource Provisioningand hovering over the CPU section colors.
- E. By runningtmsh show /sys provisionand reviewing the specific module in the output.
Answer: D,E
Explanation:
BIG-IP allocates CPU and memory resources based on module provisioning levels.
To view how much CPU a module is assigned, administrators must check provisioning information from:
C). GUI - System Resource Provisioning
This page visually displays CPU allocation via color-coded bars.
Hovering over the CPU bar shows:
* CPU usage percent per module
* Which modules share CPU cycles
* The system's total resource allocation
This is the primary GUI method.
D). tmsh show /sys provision
This command displays detailed module provisioning information including:
* Provisioned modules
* Their provisioning level
* CPU and memory allocation data
It is the authoritative CLI method for resource provisioning status.
Why the other options are incorrect:
A). top
* Shows real-time process usage, notprovisionedCPU allocation.
B). tmsh show /sys cpu
* Displays CPU runtime utilization, not per-module provisioning.
E). Statistics Dashboard
* Only shows traffic / system runtime metrics, not provisioning resource allocations.
Therefore,C and Dare correct.
NEW QUESTION # 37
Which of the following are resource allocation settings for modules? (Pick the 2 correct responses below)
- A. Dedicated
- B. Nominal
- C. Maximum
- D. Limited
Answer: A,B
Explanation:
Comprehensive and Detailed Explanation From BIG-IP Administration - Install, Initial Configuration, and Upgrade:
When provisioning modules on a BIG-IP system, F5 provides specific resource allocation settings that define how system resources - CPU, memory, and disk - are distributed to each licensed module. The two valid and officially recognised allocation settings are Nominal and Dedicated .
Nominal instructs the system to allocate a moderate, balanced share of resources to the module. It allows the module to function effectively while sharing system resources with other provisioned modules. This is the most commonly used setting in multi-module deployments.
Dedicated allocates the maximum available system resources exclusively to a single module. When this setting is applied, it is typically the only module provisioned, as it consumes resources at a level that prevents other modules from operating concurrently in a meaningful capacity.
Option A - Maximum is not a valid BIG-IP provisioning allocation level; it does not appear in the official provisioning interface or documentation as a selectable resource tier.
Option C - Limited similarly does not exist as a defined resource allocation setting within BIG-IP module provisioning. It may superficially resemble valid terminology but has no standing in the official provisioning framework.
Administrators access these settings via System > Resource Provisioning in the Configuration Utility, where each licensed module displays its available allocation options.
Reference Topics: Module Resource Provisioning, Nominal vs. Dedicated Allocation, System Resource Management - BIG-IP Administration Study Guide.
NEW QUESTION # 38
Which two items demonstrate thecreation of a new volumefor software images?
(Choose two.)
- A. Using the GUI, go toSystem > Software Management > Available Images > Install, and in the Install Software Image pop-up window, type the new volume name or number and clickInstall.
- B. Using the GUI, go toSystem > Disk Management, selectNew Volume. In the pop-up window, type the name or number of the new volume and clickApply.
- C. tmsh install sys software image /shared/images/BIGIP-<version>.iso volume HD1.5 create-volume
- D. tmsh install software image /shared/images/BIGIP-<version>.iso volume HD1.5 create-volume
- E. tmsh install /sys software image BIGIP-<version>.iso volume HD1.5 create-volume
Answer: B,D
Explanation:
In BIG-IP, software images are installed onboot volumes(for example, HD1.1, HD1.2, HD1.3, etc.).
To install software on anew volume, the administrator must instruct the system to create a new boot location before installation.
There are two correct ways to create a new volume:
A). tmsh command (with correct syntax)
tmsh install software image /shared/images/BIGIP-<version>.iso volume HD1.5 create-volume This syntax correctly includes:
* install software image
* full path to ISO (/shared/images/...)
* volume name (HD1.5)
* create-volumekeyword
This instructs BIG-IP to create the new boot volume as part of the installation.
C). Using the GUI # System > Disk Management
From the Disk Management menu, the administrator can:
* Select "New Volume"
* Enter the volume identifier (e.g., HD1.5)
* Apply changes
This GUI method is officially supported and explicitly creates a new boot volume before installing the software.
Why the other options are incorrect:
B). Incorrect tmsh syntax
* Missing /shared/images/ path
* Incorrect command structure
D). Incorrect command structure
* Missing required keywords and correct command hierarchy
E). Software Management # Install does NOT create volumes
* This installs to anexistingvolume only
* The GUI install dialog does not create new boot volumes
Thus, onlyOption AandOption Cproperly create a new software volume.
NEW QUESTION # 39
What is the primary interface used to configure and manage F5 BIG-IP?
- A. Command-Line Interface (CLI)
- B. Browser-based web console
- C. Configuration utility (GUI)
- D. SNMP interface
Answer: C
Explanation:
The Configuration utility is the primary interface used for configuring the BIG-IP system, accessible via a web browser.
NEW QUESTION # 40
The BIG-IP Administrator uses Secure Copy Protocol (SCP) to upload a TMOS image to the /shared/images/ directory in preparation for a TMOS upgrade.
After the upload is completed, what will the system do before the image is shown in the GUI under:
System > Software Management > Image List ?
- A. The system copies the image to /var/local/images/
- B. The system performs a reboot into a new partition
- C. The system verifies the internal checksum
Answer: C
Explanation:
When a TMOS image (.iso file) is uploaded into the /shared/images/ directory, the BIG-IP performs an internal validation step before the ISO appears in the GUI.
1. The system verifies the internal checksum
* BIG-IP automatically reads the embedded checksum inside the ISO file
* Verifies integrity of the uploaded image
* Confirms the file is not corrupted or incomplete
* Ensures the image is a valid F5 TMOS software image
Only after this checksum verification succeeds does the image appear under:
System # Software Management # Image List
Why the other options are incorrect:
A). The system performs a reboot into a new partition
* Uploading an ISO file never triggers a reboot.
C). The system copies the image to /var/local/images/
* All valid TMOS images remain in /shared/images/ .
* No copying occurs.
NEW QUESTION # 41
In order to configure allowed IP addresses for SSH access to a BIG-IP device, the BIG-IP Administrator has issued the commands shown in the exhibit.
Which IP addresses will have SSH access after issuing the shown commands?
(Choose two.)
- A. 10.0.0.254
- B. 10.0.0.256
- C. 100.0.1.10
- D. 10.0.0.100
- E. 100.0.0.10
Answer: A,D
Explanation:
From the exhibit, the administrator performs the following actions:
* Displays the current SSH allow configuration:
tmsh list sys sshd allow
allow { ALL }
* Replaces the existing SSH allow list with a specific subnet:
tmsh modify sys sshd allow replace-all-with { 10.0.0.0/24 }
* Confirms the updated configuration:
tmsh list sys sshd allow
allow { 10.0.0.0/24 }
This configuration restricts SSH access to only hosts that fall within the 10.0.0.0/24 network.
Evaluation of the options
A). 10.0.0.100
This address is within the 10.0.0.0/24 subnet and is a valid host address, so SSH access is permitted.
B). 10.0.0.254
This address is also within the 10.0.0.0/24 subnet and is a valid host address, so SSH access is permitted.
C). 10.0.0.256
This is not a valid IP address because an IPv4 octet cannot exceed 255.
D). 100.0.1.10
This address is outside the configured 10.0.0.0/24 subnet and will not be allowed.
E). 100.0.0.10
This address is also outside the configured subnet and will not be allowed.
NEW QUESTION # 42
A BIG-IP Administrator discovers malicious brute-force attempts to access the BIG-IP device on the management interfacevia SSH.
The administrator needs to restrict SSH access to the management interface.
Where should this be accomplished?
- A. Network > Self IPs
- B. System > Configuration
- C. Network > Interfaces
- D. System > Platform
Answer: B
Explanation:
The BIG-IPmanagement interface (MGMT port)is controlled throughSystem settings, not through the Network menu.
SSH access on the management interface is configured here:
System # Configuration # Device # General # SSH Access / SSH IP Allow
This section allows the administrator to:
* Enable or disable SSH service
* Restrict SSH access to specific IP addresses or subnets
* Apply security policies to the management interface
Why the other options are incorrect:
A). Network > Interfaces
* Used for data-plane physical interface settings, not management plane SSH restrictions.
B). Network > Self IPs
* Controls in-band management or data-plane access, not the dedicated management port.
D). System > Platform
* Used for hostname, time zone, LCD contrast, hardware settings - not SSH security on the management port.
Therefore, restricting SSH access to themanagement interfacemust be done under:
#System # Configuration # Device # General
Which corresponds toOption C.
NEW QUESTION # 43
Which one of the following is aport and protocol combination allowedby theAllow Defaultsetting for Port Lockdown?
- A. TCP 443
- B. TCP 80
- C. UDP 8443
Answer: A
Explanation:
Port Lockdown controls which ports and protocols aSelf IPwill respond to.
TheAllow Defaultsetting permits only a predefined set of BIG-IP internal and required service ports.
The Allow Default listincludes:
* TCP 443# HTTPS (Management/TMUI access via Self-IP)
* TCP 4353 # CMI (device sync)
* TCP/UDP ports related to HA communication
* Other essential internal F5 ports
Why TCP 443 is correct:
* It is one of the officially allowed ports underAllow Default.
* It enables HTTPS/TMUI access through a Self IP.
Why the other options are incorrect:
A). TCP 80 (HTTP)
* Not allowed under Allow Default
* HTTP via Self-IP is blocked unless placed under Allow Custom
B). UDP 8443
* Not an F5 default service
* Not part of the Allow Default ports
NEW QUESTION # 44
......
Get 100% Authentic F5 F5CAB1 Dumps with Correct Answers: https://pass4sure.practicetorrent.com/F5CAB1-practice-exam-torrent.html